@nodatachat/mcp 1.3.41 → 1.3.43
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/gate.js +37 -37
- package/dist/index.js +277 -248
- package/dist/status.js +2 -2
- package/package.json +1 -1
package/dist/gate.js
CHANGED
|
@@ -1,54 +1,54 @@
|
|
|
1
|
-
/*! @nodatachat/mcp 1.3.
|
|
2
|
-
import{appendFileSync as ei,copyFileSync as Cc,existsSync as $n,mkdirSync as ti,readdirSync as ni,readFileSync as ri,statSync as kt,writeFileSync as Pc}from"node:fs";import{homedir as fe}from"node:os";import{basename as xt,extname as Tn,isAbsolute as X,join as Fe,relative as si,resolve as C}from"node:path";import{TextDecoder as un}from"node:util";var L={text:[],header:[],secrets:[],table:null};function Ze(e){e.table&&(L.table=e.table);for(let t of e.text??[])L.text.some(r=>r.kind===t.kind)||L.text.push(t);e.header&&!L.header.includes(e.header)&&L.header.push(e.header);for(let t of e.secrets??[])L.secrets.some(r=>r.id===t.id)||L.secrets.push(t)}function Ke(){return L.text}function Et(){return L.header}function J(){return L.table}function At(){return L.secrets}var be=[{id:"aws-access-key",name:"AWS Access Key",pattern:/(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)/,severity:"critical"},{id:"aws-secret-key",name:"AWS Secret Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/,severity:"critical"},{id:"gcp-api-key",name:"GCP API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"critical"},{id:"gcp-service-account",name:"GCP Service Account",pattern:/"type"\s*:\s*"service_account"/,severity:"critical"},{id:"github-token",name:"GitHub Token",pattern:/gh[pousr]_[0-9a-zA-Z]{36,}/,severity:"critical"},{id:"github-fine-grained",name:"GitHub Fine-Grained Token",pattern:/github_pat_[0-9a-zA-Z_]{22,}/,severity:"critical"},{id:"gitlab-token",name:"GitLab Token",pattern:/glpat-[0-9a-zA-Z_-]{20,}/,severity:"critical"},{id:"stripe-secret",name:"Stripe Secret Key",pattern:/sk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"stripe-restricted",name:"Stripe Restricted Key",pattern:/rk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"slack-token",name:"Slack Token",pattern:/xox[baprs]-[0-9a-zA-Z-]{10,}/,severity:"high"},{id:"slack-webhook",name:"Slack Webhook",pattern:/hooks\.slack\.com\/services\/T[0-9A-Z]{8,}\/B[0-9A-Z]{8,}\/[0-9a-zA-Z]{24}/,severity:"high"},{id:"twilio-api-key",name:"Twilio API Key",pattern:/SK[0-9a-fA-F]{32}/,severity:"high"},{id:"sendgrid-api-key",name:"SendGrid API Key",pattern:/SG\.[0-9a-zA-Z_-]{22}\.[0-9a-zA-Z_-]{43}/,severity:"critical"},{id:"postgres-uri",name:"PostgreSQL Connection String",pattern:/postgres(?:ql)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"mongodb-uri",name:"MongoDB Connection String",pattern:/mongodb(?:\+srv)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"redis-uri",name:"Redis Connection String",pattern:/redis(?:s)?:\/\/[^\s'"]{10,}/,severity:"high"},{id:"openai-key",name:"OpenAI API Key",pattern:/sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}/,severity:"critical"},{id:"openai-project-key",name:"OpenAI API Key",pattern:/sk-(?:proj|svcacct|admin)-[0-9A-Za-z_-]{40,}/,severity:"critical"},{id:"anthropic-key",name:"Anthropic API Key",pattern:/sk-ant-[0-9a-zA-Z_-]{40,}/,severity:"critical"},{id:"firebase-key",name:"Firebase API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"high"},{id:"supabase-key",name:"Supabase Service Key",pattern:/eyJ[0-9a-zA-Z_-]{100,}/,severity:"critical"},{id:"supabase-access-token",name:"Supabase Access Token",pattern:/\bsbp_[0-9a-f]{40}\b/,severity:"critical"},{id:"supabase-secret-key",name:"Supabase Secret Key",pattern:/\bsb_secret_[0-9A-Za-z_-]{20,}/,severity:"critical"},{id:"private-key",name:"Private Key",pattern:/-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,severity:"critical"},{id:"jwt-secret",name:"JWT/Generic Secret",pattern:/(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"password-in-code",name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"bearer-token",name:"Bearer Token in Code",pattern:/['"]Bearer\s+[0-9a-zA-Z._-]{20,}['"]/,severity:"high"}];function q(){let e=At().filter(t=>!be.some(r=>r.id===t.id));return[...be,...e]}var Vn=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Salary / income"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication|prescription)$/i,type:"medical",label:"Medical"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Policy"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation"}],Zn=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם הלקוח|שם בן זוג|שם המבוטח|שם המוטב|שם הילד|שם הקטין)$/i,type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מס' זהות|teudat_zehut|tz|israeli_id|il_id)$/i,type:"id",label:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה)$/i,type:"id",label:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|אימייל|כתובת מייל)$/i,type:"email",label:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|טלפון נייד)$/i,type:"phone",label:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|רחוב|מס בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|מען)$/i,type:"address",label:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|ת לידה|תאריך הולדת|יום הולדת|גיל)$/i,type:"dob",label:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|מספר חשבון|מס חשבון|סניף|iban|iban_il)$/i,type:"financial",label:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|מספר אשראי|cvv|אשראי)$/i,type:"financial",label:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|מצב רפואי|חיסון|רגישות|אלרגיה|סוג דם)$/i,type:"medical",label:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מס פוליסה|פוליסה|מספר חבר|מספר ביטוח)$/i,type:"id",label:"\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4/\u05D7\u05D1\u05E8\u05D5\u05EA"},{pattern:/^(?:שם הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|תעודת לידה)$/i,type:"minor_data",label:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|השקפה פוליטית|מצב משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מס רכב|לוחית רישוי|מספר רישוי)$/i,type:"tracking",label:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}],Kn=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|enabled|active|public|version|metadata|config|settings|data|content|note|comment|label|color|icon)$/i,Xn=/^שם[ _](?:ה)?(?:קובץ|מוצר|פריט|חברה|ארגון|עסק|פרויקט|גיליון|טבלה|שדה|קטגוריה|סניף|בנק|עיר|רחוב|ישוב|יישוב|מסמך|תוכנית|חבילה|קורס|מחלקה|אתר|דומיין|מותג|ספק|שירות|תפקיד)$|^(file|product|item|company|org|organization|project|sheet|table|field|category|branch|bank|city|street|document|plan|course|department|site|domain|brand|vendor|service|role)[ _-]?name$/i;function Y(e){if(!e)return null;let t=e.trim();if(Kn.test(t)||/^name$/i.test(t))return null;let r=t.replace(/[\s-]+/g,"_");for(let n of[...Zn,...Vn])if(n.pattern.test(t)||n.pattern.test(r))return{type:n.type,label:n.label};if(Xn.test(t))return null;if(/^שם[ _][\u0590-\u05FF"'׳ ]{2,20}$/.test(t))return{type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"};if(/^(customer|client|employee|inspector|supervisor|contact|person|patient|user|owner|manager|agent|member|driver|tenant|student|parent|beneficiary|insured)_?(full_?)?name$/i.test(r))return{type:"name",label:"Person name"};for(let n of Et()){let s=n(t);if(s)return{type:s.type,label:s.label}}return null}function It(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let r=t.padStart(9,"0"),n=0;for(let s=0;s<9;s++){let i=parseInt(r[s]??"0",10)*(s%2+1);i>9&&(i-=9),n+=i}return n%10===0&&parseInt(r,10)>0}function Jn(e){let t=String(e??"").replace(/\D/g,"");if(t.length<12||t.length>19)return!1;let r=0,n=!1;for(let s=t.length-1;s>=0;s-=1){let i=parseInt(t[s]??"0",10);n&&(i*=2,i>9&&(i-=9)),r+=i,n=!n}return r%10===0}function qn(e){let t=String(e??"").replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let r=t.slice(4)+t.slice(0,4),n=0;for(let s of r){let i=s>="A"&&s<="Z"?String(s.charCodeAt(0)-55):s;for(let o of i)n=(n*10+Number(o))%97}return n===1}var Xe="(?<!\\d)(?<!\\d[.,])",Je="(?!\\d)(?![.,]\\d)",$t=[{subkind:"israeli_id",severity:"high",pattern:new RegExp(`${Xe}\\d{9}${Je}`,"g"),validate:It,hint:"Israeli national ID (check digit verified) in plaintext. Encrypt the column or mask it at rest."},{subkind:"credit_card",severity:"critical",pattern:new RegExp(`${Xe}[2-6][ -]?(?:\\d[ -]?){11,17}\\d${Je}`,"g"),validate:Jn,hint:"Payment card number (Luhn verified) in plaintext. This is PCI scope."},{subkind:"iban",severity:"high",pattern:/\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b/g,validate:qn,hint:"Bank account in IBAN form (mod-97 verified) in plaintext."},{subkind:"israeli_phone",severity:"medium",pattern:new RegExp(`${Xe}(?:\\+972[- ]?|0)(?:[57]\\d|[2-489])[- ]?\\d{3}[- ]?\\d{4}${Je}`,"g"),validate:e=>{let t=e.replace(/\D/g,"").replace(/^972/,"0");return/^0[57]\d{8}$/.test(t)?!0:/^0[2-489]\d{7}$/.test(t)&&(/[- ]/.test(e)||e.startsWith("+972"))},hint:"Israeli phone number in plaintext."}];function _e(e,t){let r=[],n="",s=!1;for(let i=0;i<e.length;i++){let o=e[i];s?o==='"'&&e[i+1]==='"'?(n+='"',i++):o==='"'?s=!1:n+=o:o==='"'?s=!0:o===t?(r.push(n),n=""):n+=o}return r.push(n),r}import{inflateRawSync as Or}from"node:zlib";import{inflateSync as Yn}from"node:zlib";var ke=new Set([".pdf"]),Tt=8*1024*1024;function Lt(e){let t=e.toString("latin1"),r=new Map,n=/(\d+)\s+(\d+)\s+obj\b/g,s;for(;(s=n.exec(t))!==null;){let i=Number(s[1]),o=n.lastIndex,a=t.indexOf("endobj",o);if(a<0)continue;let l=t.indexOf("stream",o),c,u=null;if(l>=0&&l<a){c=t.slice(o,l);let d=l+6;t[d]==="\r"&&(d+=1),t[d]===`
|
|
3
|
-
`&&(d+=1);let p=t.indexOf("endstream",d);p>d&&(u=e.subarray(d,p))}else c=t.slice(o,a);r.set(i,{num:i,dict:c,stream:u})}for(let i of[...r.values()]){if(!i.stream||!/\/Type\s*\/ObjStm\b/.test(i.dict))continue;let o=
|
|
4
|
-
`),n="",a=0},u=()=>{n&&!n.endsWith(" ")&&a>1&&(n+=" ")},d=/\/([^\s/<>[\]()]+)\s+-?[\d.]+\s+Tf|(-?[\d.]+)\s+(-?[\d.]+)\s+T[dD]\b|(?:-?[\d.]+\s+){5}(-?[\d.]+)\s+Tm\b|T\*|\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>|\[|\]|-?\d+(?:\.\d+)?|TJ|Tj|'|"/g,p;for(;(p=d.exec(e))!==null;){let
|
|
5
|
-
`)}var
|
|
6
|
-
`);return
|
|
7
|
-
`).map(
|
|
1
|
+
/*! @nodatachat/mcp 1.3.43 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
|
|
2
|
+
import{appendFileSync as fi,copyFileSync as Yc,existsSync as Mn,mkdirSync as hi,readdirSync as mi,readFileSync as gi,statSync as At,writeFileSync as Qc}from"node:fs";import{homedir as J}from"node:os";import{basename as It,extname as Hn,isAbsolute as q,join as je,relative as yi,resolve as C}from"node:path";import{TextDecoder as yn}from"node:util";var L={text:[],header:[],secrets:[],table:null};function Je(e){e.table&&(L.table=e.table);for(let t of e.text??[])L.text.some(r=>r.kind===t.kind)||L.text.push(t);e.header&&!L.header.includes(e.header)&&L.header.push(e.header);for(let t of e.secrets??[])L.secrets.some(r=>r.id===t.id)||L.secrets.push(t)}function qe(){return L.text}function Ct(){return L.header}function Q(){return L.table}function Pt(){return L.secrets}var xe=[{id:"aws-access-key",name:"AWS Access Key",pattern:/(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)/,severity:"critical"},{id:"aws-secret-key",name:"AWS Secret Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/,severity:"critical"},{id:"gcp-api-key",name:"GCP API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"critical"},{id:"gcp-service-account",name:"GCP Service Account",pattern:/"type"\s*:\s*"service_account"/,severity:"critical"},{id:"github-token",name:"GitHub Token",pattern:/gh[pousr]_[0-9a-zA-Z]{36,}/,severity:"critical"},{id:"github-fine-grained",name:"GitHub Fine-Grained Token",pattern:/github_pat_[0-9a-zA-Z_]{22,}/,severity:"critical"},{id:"gitlab-token",name:"GitLab Token",pattern:/glpat-[0-9a-zA-Z_-]{20,}/,severity:"critical"},{id:"stripe-secret",name:"Stripe Secret Key",pattern:/sk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"stripe-restricted",name:"Stripe Restricted Key",pattern:/rk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"slack-token",name:"Slack Token",pattern:/xox[baprs]-[0-9a-zA-Z-]{10,}/,severity:"high"},{id:"slack-webhook",name:"Slack Webhook",pattern:/hooks\.slack\.com\/services\/T[0-9A-Z]{8,}\/B[0-9A-Z]{8,}\/[0-9a-zA-Z]{24}/,severity:"high"},{id:"twilio-api-key",name:"Twilio API Key",pattern:/SK[0-9a-fA-F]{32}/,severity:"high"},{id:"sendgrid-api-key",name:"SendGrid API Key",pattern:/SG\.[0-9a-zA-Z_-]{22}\.[0-9a-zA-Z_-]{43}/,severity:"critical"},{id:"postgres-uri",name:"PostgreSQL Connection String",pattern:/postgres(?:ql)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"mongodb-uri",name:"MongoDB Connection String",pattern:/mongodb(?:\+srv)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"redis-uri",name:"Redis Connection String",pattern:/redis(?:s)?:\/\/[^\s'"]{10,}/,severity:"high"},{id:"openai-key",name:"OpenAI API Key",pattern:/sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}/,severity:"critical"},{id:"openai-project-key",name:"OpenAI API Key",pattern:/sk-(?:proj|svcacct|admin)-[0-9A-Za-z_-]{40,}/,severity:"critical"},{id:"anthropic-key",name:"Anthropic API Key",pattern:/sk-ant-[0-9a-zA-Z_-]{40,}/,severity:"critical"},{id:"firebase-key",name:"Firebase API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"high"},{id:"supabase-key",name:"Supabase Service Key",pattern:/eyJ[0-9a-zA-Z_-]{100,}/,severity:"critical"},{id:"supabase-access-token",name:"Supabase Access Token",pattern:/\bsbp_[0-9a-f]{40}\b/,severity:"critical"},{id:"supabase-secret-key",name:"Supabase Secret Key",pattern:/\bsb_secret_[0-9A-Za-z_-]{20,}/,severity:"critical"},{id:"private-key",name:"Private Key",pattern:/-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,severity:"critical"},{id:"jwt-secret",name:"JWT/Generic Secret",pattern:/(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"password-in-code",name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"bearer-token",name:"Bearer Token in Code",pattern:/['"]Bearer\s+[0-9a-zA-Z._-]{20,}['"]/,severity:"high"}];function ee(){let e=Pt().filter(t=>!xe.some(r=>r.id===t.id));return[...xe,...e]}var or=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Salary / income"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication|prescription)$/i,type:"medical",label:"Medical"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Policy"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation"}],ar=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם הלקוח|שם בן זוג|שם המבוטח|שם המוטב|שם הילד|שם הקטין)$/i,type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מס' זהות|teudat_zehut|tz|israeli_id|il_id)$/i,type:"id",label:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה)$/i,type:"id",label:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|אימייל|כתובת מייל)$/i,type:"email",label:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|טלפון נייד)$/i,type:"phone",label:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|רחוב|מס בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|מען)$/i,type:"address",label:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|ת לידה|תאריך הולדת|יום הולדת|גיל)$/i,type:"dob",label:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|מספר חשבון|מס חשבון|סניף|iban|iban_il)$/i,type:"financial",label:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|מספר אשראי|cvv|אשראי)$/i,type:"financial",label:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|מצב רפואי|חיסון|רגישות|אלרגיה|סוג דם)$/i,type:"medical",label:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מס פוליסה|פוליסה|מספר חבר|מספר ביטוח)$/i,type:"id",label:"\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4/\u05D7\u05D1\u05E8\u05D5\u05EA"},{pattern:/^(?:שם הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|תעודת לידה)$/i,type:"minor_data",label:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|השקפה פוליטית|מצב משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מס רכב|לוחית רישוי|מספר רישוי)$/i,type:"tracking",label:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}],cr=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|enabled|active|public|version|metadata|config|settings|data|content|note|comment|label|color|icon)$/i,lr=/^שם[ _](?:ה)?(?:קובץ|מוצר|פריט|חברה|ארגון|עסק|פרויקט|גיליון|טבלה|שדה|קטגוריה|סניף|בנק|עיר|רחוב|ישוב|יישוב|מסמך|תוכנית|חבילה|קורס|מחלקה|אתר|דומיין|מותג|ספק|שירות|תפקיד)$|^(file|product|item|company|org|organization|project|sheet|table|field|category|branch|bank|city|street|document|plan|course|department|site|domain|brand|vendor|service|role)[ _-]?name$/i;function te(e){if(!e)return null;let t=e.trim();if(cr.test(t)||/^name$/i.test(t))return null;let r=t.replace(/[\s-]+/g,"_");for(let n of[...ar,...or])if(n.pattern.test(t)||n.pattern.test(r))return{type:n.type,label:n.label};if(lr.test(t))return null;if(/^שם[ _][\u0590-\u05FF"'׳ ]{2,20}$/.test(t))return{type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"};if(/^(customer|client|employee|inspector|supervisor|contact|person|patient|user|owner|manager|agent|member|driver|tenant|student|parent|beneficiary|insured)_?(full_?)?name$/i.test(r))return{type:"name",label:"Person name"};for(let n of Ct()){let s=n(t);if(s)return{type:s.type,label:s.label}}return null}function Lt(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let r=t.padStart(9,"0"),n=0;for(let s=0;s<9;s++){let i=parseInt(r[s]??"0",10)*(s%2+1);i>9&&(i-=9),n+=i}return n%10===0&&parseInt(r,10)>0}function dr(e){let t=String(e??"").replace(/\D/g,"");if(t.length<12||t.length>19)return!1;let r=0,n=!1;for(let s=t.length-1;s>=0;s-=1){let i=parseInt(t[s]??"0",10);n&&(i*=2,i>9&&(i-=9)),r+=i,n=!n}return r%10===0}function ur(e){let t=String(e??"").replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let r=t.slice(4)+t.slice(0,4),n=0;for(let s of r){let i=s>="A"&&s<="Z"?String(s.charCodeAt(0)-55):s;for(let o of i)n=(n*10+Number(o))%97}return n===1}var Ye="(?<!\\d)(?<!\\d[.,])",Qe="(?!\\d)(?![.,]\\d)",Dt=[{subkind:"israeli_id",severity:"high",pattern:new RegExp(`${Ye}\\d{9}${Qe}`,"g"),validate:Lt,hint:"Israeli national ID (check digit verified) in plaintext. Encrypt the column or mask it at rest."},{subkind:"credit_card",severity:"critical",pattern:new RegExp(`${Ye}[2-6][ -]?(?:\\d[ -]?){11,17}\\d${Qe}`,"g"),validate:dr,hint:"Payment card number (Luhn verified) in plaintext. This is PCI scope."},{subkind:"iban",severity:"high",pattern:/\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b/g,validate:ur,hint:"Bank account in IBAN form (mod-97 verified) in plaintext."},{subkind:"israeli_phone",severity:"medium",pattern:new RegExp(`${Ye}(?:\\+972[- ]?|0)(?:[57]\\d|[2-489])[- ]?\\d{3}[- ]?\\d{4}${Qe}`,"g"),validate:e=>{let t=e.replace(/\D/g,"").replace(/^972/,"0");return/^0[57]\d{8}$/.test(t)?!0:/^0[2-489]\d{7}$/.test(t)&&(/[- ]/.test(e)||e.startsWith("+972"))},hint:"Israeli phone number in plaintext."}];function we(e,t){let r=[],n="",s=!1;for(let i=0;i<e.length;i++){let o=e[i];s?o==='"'&&e[i+1]==='"'?(n+='"',i++):o==='"'?s=!1:n+=o:o==='"'?s=!0:o===t?(r.push(n),n=""):n+=o}return r.push(n),r}import{inflateRawSync as Xr}from"node:zlib";import{inflateSync as pr}from"node:zlib";var ve=new Set([".pdf"]),Ot=8*1024*1024;function Ht(e){let t=e.toString("latin1"),r=new Map,n=/(\d+)\s+(\d+)\s+obj\b/g,s;for(;(s=n.exec(t))!==null;){let i=Number(s[1]),o=n.lastIndex,a=t.indexOf("endobj",o);if(a<0)continue;let l=t.indexOf("stream",o),c,u=null;if(l>=0&&l<a){c=t.slice(o,l);let d=l+6;t[d]==="\r"&&(d+=1),t[d]===`
|
|
3
|
+
`&&(d+=1);let p=t.indexOf("endstream",d);p>d&&(u=e.subarray(d,p))}else c=t.slice(o,a);r.set(i,{num:i,dict:c,stream:u})}for(let i of[...r.values()]){if(!i.stream||!/\/Type\s*\/ObjStm\b/.test(i.dict))continue;let o=Se(i),a=Number(/\/N\s+(\d+)/.exec(i.dict)?.[1]??0),l=Number(/\/First\s+(\d+)/.exec(i.dict)?.[1]??-1);if(o===null||!a||l<0)continue;let c=o.slice(0,l).trim().split(/\s+/).map(Number);for(let u=0;u<a;u+=1){let d=c[2*u],p=c[2*u+1];if(d===void 0||p===void 0||Number.isNaN(d)||Number.isNaN(p))break;let f=u+1<a?c[2*(u+1)+1]:void 0,m=o.slice(l+p,f!==void 0?l+f:void 0);r.has(d)||r.set(d,{num:d,dict:m,stream:null})}}return r}function et(e){let t=[...e.replace(/\s+/g,"")];if(t.length<40)return!1;let r=0,n=0;for(let s of t){let i=s.codePointAt(0)??0;i<32||i>=127&&i<=191||i===65533||i>=57344&&i<=63743?r+=1:/[\p{L}\p{N}]/u.test(s)&&(n+=1)}return r/t.length>.2||n/t.length<.25}function fr(e){let t=e.toString("latin1").replace(/\s/g,"");t.startsWith("<~")&&(t=t.slice(2));let r=t.indexOf("~>");r>=0&&(t=t.slice(0,r));let n=[],s=0,i=0;for(let o of t){if(o==="z"&&i===0){n.push(0,0,0,0);continue}let a=o.charCodeAt(0)-33;if(a<0||a>84)return null;s=s*85+a,i+=1,i===5&&(n.push(s>>>24&255,s>>>16&255,s>>>8&255,s&255),s=0,i=0)}if(i>0){for(let a=i;a<5;a+=1)s=s*85+84;let o=[s>>>24&255,s>>>16&255,s>>>8&255,s&255];for(let a=0;a<i-1;a+=1)n.push(o[a]??0)}return Buffer.from(n)}function hr(e){let t=e.toString("latin1").replace(/\s/g,"").split(">")[0]??"",r=t.length%2?t+"0":t;return/^[0-9A-Fa-f]*$/.test(r)?Buffer.from(r,"hex"):null}function mr(e){let t=/\/Filter\s*(\[[^\]]*\]|\/\w+)/.exec(e);return!t||!t[1]?[]:[...t[1].matchAll(/\/(\w+)/g)].map(r=>r[1]??"")}function Se(e){if(!e.stream)return null;let t=e.stream;for(let r of mr(e.dict)){let n=null;if(r==="FlateDecode")try{n=pr(t)}catch{return null}else if(r==="ASCII85Decode")n=fr(t);else if(r==="ASCIIHexDecode")n=hr(t);else return null;if(n===null)return null;t=n}return t.toString("latin1")}function gr(e){let t=new Map,r=1,n=/begincodespacerange([\s\S]*?)endcodespacerange/.exec(e);if(n&&n[1]){let l=/<([0-9A-Fa-f]+)>/.exec(n[1]);l&&l[1]&&l[1].length>=4&&(r=2)}let s=l=>{let c="";for(let u=0;u+3<l.length+1;u+=4){let d=parseInt(l.slice(u,u+4),16);Number.isFinite(d)&&d>0&&(c+=String.fromCharCode(d))}return c},i=/beginbfchar([\s\S]*?)endbfchar/g,o;for(;(o=i.exec(e))!==null;){let l=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,c;for(;(c=l.exec(o[1]??""))!==null;)t.set(parseInt(c[1]??"0",16),s(c[2]??""))}let a=/beginbfrange([\s\S]*?)endbfrange/g;for(;(o=a.exec(e))!==null;){let l=o[1]??"",c=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,u;for(;(u=c.exec(l))!==null;){let d=parseInt(u[1]??"0",16),p=parseInt(u[2]??"0",16),f=parseInt((u[3]??"0").slice(0,4)||"0",16);if(!(p-d>65535))for(let m=d;m<=p;m+=1)t.set(m,String.fromCharCode(f+(m-d)))}}return{map:t,bytes:r}}function yr(e){let t=new Map,r=[],n=[];for(let i of e.values()){for(let o of i.dict.matchAll(/\/Font\s*<<([\s\S]*?)>>/g))o[1]&&n.push(o[1]);for(let o of i.dict.matchAll(/\/Font\s+(\d+)\s+\d+\s+R/g)){let a=e.get(Number(o[1]));a&&n.push(a.dict)}}let s=new Set;for(let i of n){let o=/\/([^\s/<>[\]()]+)\s+(\d+)\s+\d+\s+R/g,a;for(;(a=o.exec(i))!==null;){let l=`${a[1]}#${a[2]}`;s.has(l)||(s.add(l),r.push([a[1]??"",Number(a[2])]))}}for(let[i,o]of r){let a=e.get(o);if(!a)continue;let l=null,c=/\/ToUnicode\s+(\d+)\s+\d+\s+R/.exec(a.dict);if(c){let d=e.get(Number(c[1])),p=d?Se(d):null;p&&(l=gr(p))}if(l||(l=kr(a.dict,e)),!l)continue;let u=t.get(i)??[];u.push(l),t.set(i,u)}return t}var br=["alef","bet","gimel","dalet","he","vav","zayin","het","tet","yod","finalkaf","kaf","lamed","finalmem","mem","finalnun","nun","samekh","ayin","finalpe","pe","finaltsadi","tsadi","qof","resh","shin","tav"];function _r(e){let t=/^uni([0-9A-Fa-f]{4})$/.exec(e)??/^u([0-9A-Fa-f]{4,6})$/.exec(e);if(t)return String.fromCodePoint(parseInt(t[1],16));let r=/^afii(\d{5})$/.exec(e);if(r){let i=Number(r[1]);if(i>=57664&&i<=57690)return String.fromCharCode(1488+(i-57664))}let n=br.indexOf(e.replace(/hebrew$/,""));return n>=0?String.fromCharCode(1488+n):e==="space"?" ":/^[A-Za-z]$/.test(e)?e:{zero:"0",one:"1",two:"2",three:"3",four:"4",five:"5",six:"6",seven:"7",eight:"8",nine:"9",period:".",comma:",",hyphen:"-",colon:":",slash:"/",at:"@"}[e]??null}function kr(e,t){let r=e,n=/\/Encoding\s+(\d+)\s+\d+\s+R/.exec(e);n&&(r=t.get(Number(n[1]))?.dict??"");let s=/\/Differences\s*\[([^\]]*)\]/.exec(r);if(!s?.[1])return null;let i=new Map,o=0;for(let a of s[1].match(/\d+|\/[^\s/[\]]+/g)??[]){if(/^\d+$/.test(a)){o=Number(a);continue}let l=_r(a.slice(1));l!==null&&i.set(o,l),o+=1}return i.size?{map:i,bytes:1}:null}function jt(e){let t=[];for(let r=0;r<e.length;r+=1){let n=e[r];if(n!=="\\"){t.push(n.charCodeAt(0)&255);continue}let s=e[r+1];if(s===void 0)break;if(s>="0"&&s<="7"){let o="",a=r+1;for(;a<e.length&&o.length<3&&e[a]>="0"&&e[a]<="7";)o+=e[a],a+=1;t.push(parseInt(o,8)&255),r=a-1;continue}let i={n:10,r:13,t:9,b:8,f:12};t.push(i[s]??s.charCodeAt(0)&255),r+=1}return t}function Ut(e){if(e.length<2||e[0]!==254||e[1]!==255)return null;let t="";for(let r=2;r+1<e.length;r+=2)t+=String.fromCharCode((e[r]??0)<<8|(e[r+1]??0));return t}function Nt(e,t){let r=Ut(e);if(r!==null)return r;if(!t)return e.map(s=>String.fromCharCode(s)).join("");let n="";if(t.bytes===2)for(let s=0;s+1<e.length;s+=2){let i=(e[s]??0)<<8|(e[s+1]??0);n+=t.map.get(i)??""}else for(let s of e)n+=t.map.get(s)??String.fromCharCode(s);return n}function xr(e){let t=0;for(let r of e){let n=r.codePointAt(0)??0;/[\p{L}\p{N}]/u.test(r)?t+=1:(n<32||n>=127&&n<=191||n===65533)&&(t-=2)}return t}function Ft(e,t){if(!t||t.length<=1)return Nt(e,t?.[0]);let r="",n=-1/0;for(let s of t){let i=Nt(e,s),o=xr(i);o>n&&(r=i,n=o)}return r}function wr(e,t){let r="",n="",s,i=!1,o="",a=0,l=null,c=()=>{n.trim()&&(r+=n+`
|
|
4
|
+
`),n="",a=0},u=()=>{n&&!n.endsWith(" ")&&a>1&&(n+=" ")},d=/\/([^\s/<>[\]()]+)\s+-?[\d.]+\s+Tf|(-?[\d.]+)\s+(-?[\d.]+)\s+T[dD]\b|(?:-?[\d.]+\s+){5}(-?[\d.]+)\s+Tm\b|T\*|\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>|\[|\]|-?\d+(?:\.\d+)?|TJ|Tj|'|"/g,p;for(;(p=d.exec(e))!==null;){let f=p[0];if(p[1]!==void 0&&f.endsWith("Tf")){s=t.get(p[1]);continue}if(p[2]!==void 0){Math.abs(Number(p[3]))>.01?c():Number(p[2])!==0&&u();continue}if(p[4]!==void 0){let m=Number(p[4]);l!==null&&Math.abs(m-l)>.01?c():l!==null&&u(),l=m;continue}if(f==="T*"){c();continue}if(f==="["){i=!0;continue}if(f==="]"){i=!1;continue}if(f==="TJ"||f==="Tj"||f==="'"||f==='"'){(f==="'"||f==='"')&&c(),o&&(n+=o,a=o.trim().length,o="");continue}if(f.startsWith("("))o+=Ft(jt(f.slice(1,-1)),s);else if(f.startsWith("<")){let m=f.slice(1,-1).replace(/\s+/g,""),h=[];for(let k=0;k+1<m.length;k+=2)h.push(parseInt(m.slice(k,k+2),16));o+=Ft(h,s)}else i&&Number(f)<-200&&o&&!o.endsWith(" ")&&(o+=" ")}return o&&(n+=o),c(),r}function vr(e,t){let r=e.toString("latin1"),n=/\/Info\s+(\d+)\s+\d+\s+R/.exec(r),s=n?t.get(Number(n[1]))?.dict:void 0;if(!s)return"";let i=[],o=/\/(Author|Title|Subject|Keywords|Creator|Producer)\s*(\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>)/g,a;for(;(a=o.exec(s))!==null;){let l=a[2]??"";if(l.startsWith("(")){let c=jt(l.slice(1,-1));i.push(Ut(c)??c.map(u=>String.fromCharCode(u)).join(""))}else{let c=l.slice(1,-1).replace(/\s+/g,""),u="";if(c.toUpperCase().startsWith("FEFF"))for(let d=4;d+3<c.length+1;d+=4)u+=String.fromCharCode(parseInt(c.slice(d,d+4),16));else for(let d=0;d+1<c.length;d+=2)u+=String.fromCharCode(parseInt(c.slice(d,d+2),16));i.push(u)}}return i.join(`
|
|
5
|
+
`)}var Mt="\u05DD\u05DF\u05E5\u05E3\u05DA";function Ee(e){let t=0,r=0;for(let n of e.match(/[\u05D0-\u05EA]{2,}/g)??[])Mt.includes(n[0])&&(t+=1),Mt.includes(n[n.length-1])&&(r+=1);return t>=3&&t>r*2}var Sr={"(":")",")":"(","[":"]","]":"[","<":">",">":"<","{":"}","}":"{"};function Ae(e){return/[\u05D0-\u05EA]/.test(e)?[...e].reverse().map(r=>Sr[r]??r).join("").replace(/[A-Za-z0-9](?:[A-Za-z0-9@._\-/:+]*[A-Za-z0-9])?/g,r=>[...r].reverse().join("")):e}function zt(e){if(!e.subarray(0,8).toString("latin1").startsWith("%PDF-")||e.toString("latin1",0,Math.min(e.length,4096)).includes("/Encrypt"))return null;let r=Ht(e);if(r.size===0)return null;let n=yr(r),s=[];s.push(vr(e,r));let i=0,o=0,a=!1;for(let c of r.values()){if(!c.stream||!/\/Subtype\s*\/Form\b/.test(c.dict)&&/\/Subtype|\/Type\s*\/(XObject|Font|Metadata|ObjStm|XRef)|\/FontFile/.test(c.dict))continue;let d=Se(c);if(d===null||!/(TJ|Tj)\b/.test(d))continue;let p=wr(d,n);if(p.trim().length!==0){if(o+=1,i+p.length>Ot){s.push(p.slice(0,Math.max(0,Ot-i))),a=!0;break}s.push(p),i+=p.length}}if(o===0)return null;let l=s.slice(1).join(`
|
|
6
|
+
`);return et(l)?null:(Ee(l)&&(l=l.split(`
|
|
7
|
+
`).map(Ae).join(`
|
|
8
8
|
`)),{text:[s[0]??"",l].join(`
|
|
9
|
-
`),truncated:a,streams:o})}function
|
|
9
|
+
`),truncated:a,streams:o})}function Bt(e){if(!e.subarray(0,8).toString("latin1").startsWith("%PDF-"))return"not a valid PDF";if(e.toString("latin1",0,Math.min(e.length,4096)).includes("/Encrypt"))return"encrypted (password or copy protection)";let r=Ht(e),n=0,s=0,i=0;for(let o of r.values()){if(!o.stream)continue;if(/\/Subtype\s*\/Image\b/.test(o.dict)){s+=1;continue}let a=Se(o);if(a===null){/\/Type\s*\/(Font|Metadata|XRef)|\/FontFile|\/Length1/.test(o.dict)||(i+=1);continue}/(TJ|Tj)\b/.test(a)&&(n+=1)}return n===0&&s>0?"no text layer \u2014 a scanned image (needs OCR, which NoData does not do)":n===0&&i>0?"its pages are compressed in a way NoData cannot open":n===0?"no text in it":"its fonts have no usable letter map \u2014 the text decodes to symbols"}import{execFileSync as Er}from"node:child_process";import{existsSync as Ar,mkdtempSync as Ir,readFileSync as Gt,readdirSync as Te,rmSync as $r,statSync as Tr,writeFileSync as Vt}from"node:fs";import{tmpdir as Rr}from"node:os";import{delimiter as Cr,join as I}from"node:path";var ne="install the free tools once (they run only on this computer): winget install oschwartz10612.Poppler and winget install UB-Mannheim.TesseractOCR (tick Hebrew in its installer)",Ie=null;function Wt(e){try{return Tr(e).isFile()}catch{return!1}}function Pr(){let e=[],t=[process.env.ProgramFiles,process.env["ProgramFiles(x86)"]].filter(Boolean),r=process.env.LOCALAPPDATA;for(let n of t)e.push(I(n,"Tesseract-OCR"));if(r){e.push(I(r,"Programs","Tesseract-OCR"),I(r,"Microsoft","WinGet","Links"));let n=I(r,"Microsoft","WinGet","Packages");try{for(let s of Te(n))if(/^oschwartz10612\.Poppler/i.test(s))for(let i of Te(I(n,s)))e.push(I(n,s,i,"Library","bin"))}catch{}}for(let n of t)try{for(let s of Te(n))/^poppler/i.test(s)&&e.push(I(n,s,"Library","bin"),I(n,s,"bin"))}catch{}return e}function $e(e,t){let r=process.env[t];if(r)return Wt(r)?r:void 0;let n=process.platform==="win32",s=n?[`${e}.exe`,e]:[e],i=(process.env.PATH??"").split(Cr).filter(Boolean);n&&i.push(...Pr());for(let o of i)for(let a of s)if(Wt(I(o,a)))return I(o,a)}function B(e,t,r){try{return Er(e,t,{encoding:"utf8",timeout:r,maxBuffer:64*1024*1024,stdio:["ignore","pipe","ignore"],windowsHide:!0})}catch{return null}}function re(){if(Ie)return Ie;if(/^(0|off|false|no)$/i.test(process.env.NODATA_PDF_TOOLS??""))return Ie={ocrLangs:[],osd:!1};let e={pdftotext:$e("pdftotext","NODATA_PDFTOTEXT"),pdftoppm:$e("pdftoppm","NODATA_PDFTOPPM"),tesseract:$e("tesseract","NODATA_TESSERACT"),ocrmypdf:$e("ocrmypdf","NODATA_OCRMYPDF"),ocrLangs:[],osd:!1};if(e.tesseract){let t=new Set((B(e.tesseract,["--list-langs"],15e3)??"").split(/\r?\n/).map(r=>r.trim()));e.ocrLangs=["heb","eng"].filter(r=>t.has(r)),e.osd=t.has("osd")}return Ie=e}function Kt(e,t,r=".pdf"){let n=Ir(I(Rr(),"nd-read-"));try{let s=I(n,`in${r}`);return Vt(s,e,{mode:384}),t(n,s)}finally{$r(n,{recursive:!0,force:!0})}}function nt(e){let t=e.replace(/[\u200E\u200F\u202A-\u202E\u2066-\u2069]/g,"").replace(/\f/g,`
|
|
10
10
|
`).replace(/[ \t]+\n/g,`
|
|
11
|
-
`).trim();return t.replace(/\s/g,"").length<2||
|
|
12
|
-
`).map(
|
|
13
|
-
`):t}function
|
|
11
|
+
`).trim();return t.replace(/\s/g,"").length<2||et(t)?null:Ee(t)?t.split(`
|
|
12
|
+
`).map(Ae).join(`
|
|
13
|
+
`):t}function Lr(e){let t=re().pdftotext;if(!t)return null;let r=Kt(e,(n,s)=>B(t,["-enc","UTF-8","-q",s,"-"],6e4));return r===null?null:nt(r)}var Dr=()=>Math.max(1,Number(process.env.NODATA_OCR_MAX_PAGES)||10);function Or(e){let t=e.toString("latin1",0,64).match(/^P5\s+(\d+)\s+(\d+)\s+255\s/);return t?{w:Number(t[1]),h:Number(t[2]),at:t[0].length}:null}function Nr(e,t){let r=Or(e);if(!r)return null;let{w:n,h:s,at:i}=r,o=e.subarray(i),[a,l]=t===180?[n,s]:[s,n],c=Buffer.alloc(a*l);for(let u=0;u<s;u++)for(let d=0;d<n;d++){let p=o[u*n+d];t===180?c[(s-1-u)*n+(n-1-d)]=p:t===90?c[d*a+(s-1-u)]=p:c[(n-1-d)*a+u]=p}return Buffer.concat([Buffer.from(`P5
|
|
14
14
|
${a} ${l}
|
|
15
15
|
255
|
|
16
|
-
`,"latin1"),c])}function
|
|
17
|
-
`))??
|
|
18
|
-
`).filter(u=>[...
|
|
16
|
+
`,"latin1"),c])}function Fr(e,t){if(!e.osd)return;let r=B(e.tesseract,[t,"-","--psm","0"],6e4)??"",n=Number(r.match(/Rotate:\s*(\d+)/)?.[1]??0),s=Number(r.match(/Orientation confidence:\s*([\d.]+)/)?.[1]??0);if(!(n===90||n===180||n===270)||s<2)return;let i=Nr(Gt(t),n);i&&Vt(t,i,{mode:384})}function Mr(e,t,r){if(!e.ocrmypdf||e.ocrLangs.length===0)return null;let n=I(t,"side.txt");return B(e.ocrmypdf,["-q","-l",e.ocrLangs.join("+"),"--rotate-pages","--deskew","--force-ocr","--sidecar",n,r,I(t,"out.pdf")],3e5),Ar(n)?nt(Gt(n,"utf8")):null}function Hr(e){let t=re();if(!t.pdftoppm||!t.tesseract||t.ocrLangs.length===0)return null;let r=Dr();return Kt(e,(n,s)=>{if(B(t.pdftoppm,["-r","300","-gray","-f","1","-l",String(r+1),s,I(n,"p")],12e4)===null)return null;let i=Te(n).filter(c=>/^p-\d+\.pgm$/.test(c)).sort((c,u)=>Number(c.match(/\d+/)[0])-Number(u.match(/\d+/)[0])),o=i.length>r,a=[];for(let c of i.slice(0,r)){Fr(t,I(n,c));let u=B(t.tesseract,[I(n,c),"stdout","-l",t.ocrLangs.join("+"),"--psm","3"],12e4);u&&a.push(u)}let l=nt(a.join(`
|
|
17
|
+
`))??Mr(t,n,s);return l===null?null:{text:l,truncated:o,pages:Math.min(i.length,r)}})}function tt(e){return new Set(e.match(/[\p{L}\p{N}]{2,}/gu)??[])}function Re(e,t={}){let r=zt(e),n=Lr(e);if(r){if(n===null)return{...r,engine:"builtin",uncertain:!1};let i=tt(r.text),o=n.split(`
|
|
18
|
+
`).filter(u=>[...tt(u)].some(d=>!i.has(d))),a=tt(n),l=[...a].filter(u=>!i.has(u)),c=l.length>Math.max(3,a.size*.1)||l.some(u=>/^\d{5,}$/.test(u));return o.length===0?{...r,engine:"builtin",uncertain:!1}:{...r,text:r.text+`
|
|
19
19
|
`+o.join(`
|
|
20
|
-
`),engine:"builtin",uncertain:c}}if(!e.subarray(0,8).toString("latin1").startsWith("%PDF-"))return null;if(n!==null)return{text:n,truncated:!1,streams:0,engine:"pdftotext",uncertain:!1};if(!t.ocr)return null;let s=
|
|
20
|
+
`),engine:"builtin",uncertain:c}}if(!e.subarray(0,8).toString("latin1").startsWith("%PDF-"))return null;if(n!==null)return{text:n,truncated:!1,streams:0,engine:"pdftotext",uncertain:!1};if(!t.ocr)return null;let s=Hr(e);return s?{text:s.text,truncated:s.truncated,streams:0,engine:"ocr",uncertain:!1}:null}function Zt(e){let t=Bt(e),r=re();return/scanned image/.test(t)?r.tesseract&&r.pdftoppm&&r.ocrLangs.length?"no text layer \u2014 a scanned image; the folder scan reads it with OCR on this computer, the read gate does not wait for OCR":`no text layer \u2014 a scanned image. To read it: ${ne}`:/encrypted/.test(t)?t+(r.pdftotext?"":` \u2014 if it opens without a password, the second reader can read it: ${ne}`):/letter map|compressed/.test(t)&&!r.pdftotext?`${t}. A second reader may read it: ${ne}`:/letter map|compressed/.test(t)?`${t} (the second reader, pdftotext, could not read it either)`:t}var Xt=[208,207,17,224,161,177,26,225],rt=4294967294,Ce=4294967295,jr=64*1024*1024;function se(e){if(e.length<512)return!1;for(let t=0;t<Xt.length;t+=1)if(e[t]!==Xt[t])return!1;return!0}function st(e){if(!se(e))return null;try{let t=e.readUInt16LE(30),r=e.readUInt16LE(32);if(t!==9&&t!==12)return null;let n=1<<t,s=1<<r,i=e.readUInt32LE(44),o=e.readUInt32LE(48),a=e.readUInt32LE(56),l=e.readUInt32LE(60),c=e.readUInt32LE(68),u=e.readUInt32LE(72),d=Math.floor((e.length-n)/n)+1,p=y=>{let b=(y+1)*n;return y>=d||b>=e.length?null:e.subarray(b,Math.min(b+n,e.length))},f=[];for(let y=0;y<109&&f.length<i;y+=1){let b=e.readUInt32LE(76+y*4);b!==Ce&&f.push(b)}let m=c;for(let y=0;y<u&&m!==rt&&m!==Ce;y+=1){let b=p(m);if(!b)return null;let S=n/4-1;for(let E=0;E<S&&f.length<i;E+=1){let w=b.readUInt32LE(E*4);w!==Ce&&f.push(w)}m=b.readUInt32LE(S*4)}let h=[];for(let y of f){let b=p(y);if(!b)return null;for(let S=0;S+4<=b.length;S+=4)h.push(b.readUInt32LE(S))}let k=(y,b,S)=>{let E=[],w=y;for(;w!==rt&&w!==Ce;){if(w>=b.length||E.length>S)return null;E.push(w),w=b[w]}return E},g=(y,b)=>{let S=k(y,h,d);if(!S)return null;let E=[];for(let ke of S){let Rt=p(ke);if(!Rt)return null;E.push(Rt)}let w=Buffer.concat(E);return b>=0?w.subarray(0,Math.min(b,w.length)):w},x=g(o,-1);if(!x)return null;let _=[],A=new Map;for(let y=0,b=0;y+128<=x.length;y+=128,b+=1){let S=x.readUInt16LE(y+64),E=x[y+66];if(E===0||S<2||S>64)continue;let w=x.subarray(y,y+S-2).toString("utf16le"),ke={id:b,name:w,type:E,left:x.readUInt32LE(y+68),right:x.readUInt32LE(y+72),child:x.readUInt32LE(y+76),start:x.readUInt32LE(y+116),size:x.readUInt32LE(y+120),path:w};_.push(ke),A.set(b,ke)}let P=new Set,F=(y,b)=>{let S=[y];for(;S.length;){let E=S.pop(),w=A.get(E);!w||P.has(E)||(P.add(E),w.path=b?`${b}/${w.name}`:w.name,S.push(w.left,w.right),w.type===1&&F(w.child,w.path))}},ye=_.find(y=>y.type===5);ye&&F(ye.child,"");let T=_.find(y=>y.type===5);if(!T)return null;let R=null,M=[];if(_.some(y=>y.type===2&&y.size<a&&y.size>0)){R=g(T.start,T.size);let y=l!==rt?g(l,-1):null;if(y)for(let b=0;b+4<=y.length;b+=4)M.push(y.readUInt32LE(b));else M=[]}let H=new Map,_e=new Map,D=(y,b)=>{H.has(y.name)||H.set(y.name,b),_e.set(y.path,b)};for(let y of _)if(y.type===2&&!(y.size>jr)){if(y.size===0){D(y,Buffer.alloc(0));continue}if(y.size<a){if(!R)continue;let b=k(y.start,M,Math.ceil(R.length/s)+1);if(!b)continue;let S=b.map(E=>R.subarray(E*s,E*s+s));D(y,Buffer.concat(S).subarray(0,y.size))}else{let b=g(y.start,y.size);b&&D(y,b)}}return{streams:H,paths:_e}}catch{return null}}import{TextDecoder as Jt}from"node:util";var ie="password-protected: open it with its password, or check it by hand";function Ur(e){let t=e.streams;return t.has("EncryptionInfo")&&t.has("EncryptedPackage")?"encrypted-ooxml":t.has("WordDocument")?"doc":t.has("Workbook")||t.has("Book")?"xls":t.has("PowerPoint Document")?"ppt":[...t.keys()].some(r=>r.startsWith("__substg1.0_"))?"msg":null}var en=e=>{try{return new Jt(e)}catch{return new Jt("latin1")}},W=en("windows-1252");function oe(e){return e.replace(/[\r\x07\x0b\x0c]/g,`
|
|
21
21
|
`).replace(/[\x13\x14\x15]/g," ").replace(/[\x00-\x08\x0e-\x1f]/g,"").replace(/\n{3,}/g,`
|
|
22
22
|
|
|
23
|
-
`)}function
|
|
24
|
-
`))}function
|
|
25
|
-
`))}function
|
|
26
|
-
`))}function
|
|
27
|
-
`)):!o&&(
|
|
23
|
+
`)}function zr(e,t){return e.length>t?{text:e.slice(0,t),truncated:!0}:{text:e,truncated:!1}}function Br(e){let t=e.streams.get("WordDocument");if(t.length<512)return{kind:"doc",reason:"damaged Word file"};let r=t.readUInt16LE(10);if(r&256||r&32768)return{kind:"doc",reason:ie};if(t.readUInt16LE(2)<101){let m=t.readUInt32LE(24),h=t.readUInt32LE(28);return h<=m||h>t.length?{kind:"doc",reason:"damaged Word file"}:oe(W.decode(t.subarray(m,h)))}let s=e.streams.get(r&512?"1Table":"0Table");if(!s)return{kind:"doc",reason:"damaged Word file (no table stream)"};let i=32;i+=2+t.readUInt16LE(i)*2,i+=2+t.readUInt16LE(i)*4;let o=i+2,a=t.readUInt32LE(o+264),l=t.readUInt32LE(o+264+4);if(!l||a+l>s.length)return{kind:"doc",reason:"damaged Word file (no piece table)"};let c=a,u=a+l,d=null;for(;c<u;){let m=s[c];if(m===1)c+=3+s.readInt16LE(c+1);else if(m===2){let h=s.readUInt32LE(c+1);d=s.subarray(c+5,Math.min(c+5+h,s.length));break}else break}if(!d||d.length<16)return{kind:"doc",reason:"damaged Word file (no piece table)"};let p=Math.floor((d.length-4)/12),f=[];for(let m=0;m<p;m+=1){let h=d.readUInt32LE(m*4),g=d.readUInt32LE((m+1)*4)-h;if(g<=0||g>t.length)continue;let x=d.readUInt32LE(4*(p+1)+m*8+2);if(x&1073741824){let _=(x&1073741823)/2;f.push(W.decode(t.subarray(_,Math.min(_+g,t.length))))}else f.push(t.subarray(x,Math.min(x+g*2,t.length)).toString("utf16le"))}return oe(f.join(""))}var it=class{segs;i=0;p=0;constructor(t){this.segs=t}here(){for(;this.i<this.segs.length&&this.p>=this.segs[this.i].length;)this.i+=1,this.p=0;return this.i<this.segs.length?this.segs[this.i]:null}get done(){return this.here()===null}atSeam(){return this.p===0&&this.i>0}u8(){let t=this.here();if(!t)throw new Error("eof");return t[this.p++]}u16(){return this.u8()|this.u8()<<8}u32(){return(this.u16()|this.u16()<<16)>>>0}skip(t){for(let r=0;r<t;r+=1)this.u8()}chars(t,r){let n="",s=t,i=r;for(;s>0&&this.here();){this.p===0&&n.length>0&&(i=(this.u8()&1)===1);let a=this.here();if(!a)break;let l=Math.floor((a.length-this.p)/(i?2:1)),c=Math.min(s,l);if(c<=0){this.p=a.length;continue}let u=a.subarray(this.p,this.p+c*(i?2:1));n+=i?u.toString("utf16le"):u.toString("latin1"),this.p+=u.length,s-=c}return n}};function Wr(e){let t=new it(e),r=[];try{t.u32();let n=t.u32();for(let s=0;s<n&&!t.done;s+=1){let i=t.u16(),o=t.u8(),a=o&8?t.u16():0,l=o&4?t.u32():0;r.push(t.chars(i,(o&1)===1)),t.skip(a*4+l)}}catch{}return r}function qt(e,t,r,n){if(t+2>e.length)return"";let s=e.readUInt16LE(t);if(!r)return n.decode(e.subarray(t+2,t+2+s));let i=e[t+2],o=t+3;return i&8&&(o+=2),i&4&&(o+=4),i&1?e.subarray(o,o+s*2).toString("utf16le"):e.subarray(o,o+s).toString("latin1")}function Yt(e){let t;if(e&2)t=e>>2;else{let r=Buffer.alloc(8);r.writeUInt32LE(0,0),r.writeUInt32LE((e&4294967292)>>>0,4),t=r.readDoubleLE(0)}return e&1?t/100:t}var Pe=e=>Number.isFinite(e)?String(e):"";function Gr(e){let t=e.streams.get("Workbook")??e.streams.get("Book"),r=!0,n=W,s=[],i=new Set,o=[],a=[],l=-1,c=null,u=0,d=(h,k,g)=>{if(l<0||!g)return;let x=a[l],_=x.get(h)??new Map;_.set(k,g),x.set(h,_)},p=0;for(;p+4<=t.length;){let h=t.readUInt16LE(p),k=t.readUInt16LE(p+2),g=t.subarray(p+4,Math.min(p+4+k,t.length)),x=p+4+k;switch(h){case 2057:u+=1,g.length>=4&&(r=g.readUInt16LE(0)===1536),u===1&&g.length>=4&&g.readUInt16LE(2)!==5&&(l=a.length,a.push(new Map));break;case 10:u=Math.max(0,u-1);break;case 47:return{kind:"xls",reason:ie};case 66:if(g.length>=2&&!r){let _=g.readUInt16LE(0);n=_===1200?W:en(`windows-${_}`)}break;case 133:if(g.length>6){let _=g[6];if(r){let A=g[7]&1;o.push(A?g.subarray(8,8+_*2).toString("utf16le"):g.subarray(8,8+_).toString("latin1"))}else o.push(n.decode(g.subarray(7,7+_)))}break;case 252:{let _=[g];for(;x+4<=t.length&&t.readUInt16LE(x)===60;){let A=t.readUInt16LE(x+2);_.push(t.subarray(x+4,Math.min(x+4+A,t.length))),x+=4+A}s=Wr(_);break}case 253:if(g.length>=10){let _=g.readUInt32LE(6);i.add(_),d(g.readUInt16LE(0),g.readUInt16LE(2),s[_]??"")}break;case 516:case 214:g.length>=8&&d(g.readUInt16LE(0),g.readUInt16LE(2),qt(g,6,r,n));break;case 515:g.length>=14&&d(g.readUInt16LE(0),g.readUInt16LE(2),Pe(g.readDoubleLE(6)));break;case 638:g.length>=10&&d(g.readUInt16LE(0),g.readUInt16LE(2),Pe(Yt(g.readUInt32LE(6))));break;case 189:{if(g.length>=6){let _=g.readUInt16LE(0),A=g.readUInt16LE(2);for(let P=4;P+6<=g.length-2;P+=6)d(_,A++,Pe(Yt(g.readUInt32LE(P+2))))}break}case 6:if(g.length>=14){let _=g.readUInt16LE(0),A=g.readUInt16LE(2);g.readUInt16LE(12)===65535?c=g[6]===0?[_,A]:null:d(_,A,Pe(g.readDoubleLE(6)))}break;case 519:c&&d(c[0],c[1],qt(g,0,r,n)),c=null;break}p=x}let f=[];a.forEach((h,k)=>{f.push(o[k]??"");for(let g of[...h.keys()].sort((x,_)=>x-_)){let x=h.get(g);f.push([...x.keys()].sort((_,A)=>_-A).map(_=>x.get(_)).join(" "))}f.push("")});let m=s.filter((h,k)=>!i.has(k));return m.length&&f.push(...m),oe(f.join(`
|
|
24
|
+
`))}function Vr(e){if(e.streams.has("EncryptedSummary"))return{kind:"ppt",reason:ie};let t=e.streams.get("PowerPoint Document"),r=[],n=0;for(;n+8<=t.length;){let s=t.readUInt16LE(n)&15,i=t.readUInt16LE(n+2),o=t.readUInt32LE(n+4);if(i===12052)return{kind:"ppt",reason:ie};if(s===15){n+=8;continue}let a=t.subarray(n+8,Math.min(n+8+o,t.length));i===4e3||i===4026?r.push(a.toString("utf16le")):i===4008&&r.push(W.decode(a)),n+=8+o}return oe(r.join(`
|
|
25
|
+
`))}function Kr(e){let t=[];for(let[r,n]of e.paths){if(r.startsWith("__attach_"))continue;let s=/(?:^|\/)__substg1\.0_([0-9A-F]{4})(001F|001E)$/i.exec(r);s&&t.push(s[2].toUpperCase()==="001F"?n.toString("utf16le"):W.decode(n))}return oe(t.join(`
|
|
26
|
+
`))}function Qt(e){let t=new Map;for(let[r,n]of e.paths){let s=/^(__attach_version1\.0_#[0-9A-F]{8})\/__substg1\.0_(3707|3704|3701)(001F|0102)$/i.exec(r);if(!s)continue;let i=t.get(s[1])??{};s[2]==="3701"&&s[3]==="0102"?i.data=n:s[2]==="3707"?i.name=n.toString("utf16le").replace(/\0+$/,""):s[2]==="3704"&&(i.short=n.toString("utf16le").replace(/\0+$/,"")),t.set(s[1],i)}return[...t.values()].filter(r=>r.data).map((r,n)=>({name:r.name||r.short||`attachment-${n+1}`,data:r.data}))}function ot(e,t){let r=st(e);if(!r)return{kind:null,reason:"damaged Office 97-2003 file"};let n=Ur(r);if(!n)return{kind:null,reason:"a compound file that is not a Word, Excel, PowerPoint or Outlook file"};if(n==="encrypted-ooxml")return{kind:n,reason:ie};let s;try{s=n==="doc"?Br(r):n==="xls"?Gr(r):n==="ppt"?Vr(r):Kr(r)}catch{s={kind:n,reason:"damaged Office 97-2003 file"}}if(typeof s!="string")return s;if(!s.trim()&&!(n==="msg"&&Qt(r).length))return{kind:n,reason:"no text inside (an empty file, or only pictures)"};let i=zr(s,t),o=n==="msg"?Qt(r):[];return{kind:n,text:i.text,truncated:i.truncated,parts:[`cfb:${n}`],...o.length?{attachments:o}:{}}}import{TextDecoder as tn}from"node:util";var Zr=new Set(["fonttbl","colortbl","stylesheet","listtable","listoverridetable","rsidtbl","generator","pict","object","objdata","themedata","colorschememapping","datastore","latentstyles","xmlnstbl","mmathpr","filetbl","revtbl","pgdsctbl","bkmkstart","bkmkend","fldinst","shppict","nonshppict","blipuid","panose","falt","wgrffmtfilter","defchp","defpap"]),nn=e=>{try{return new tn(e===65001?"utf-8":`windows-${e}`)}catch{return new tn("windows-1252")}};function Le(e){return e.length>=5&&e.subarray(0,5).toString("latin1")==="{\\rtf"}function at(e){let t=nn(1252),r=[],n=[],s=()=>{n.length&&(r.push(t.decode(Uint8Array.from(n))),n=[])},i=[],o=!1,a=1,l=0,c=0,u=e.length;for(;c<u;){let d=e[c];if(d==="{"){s(),i.push({skip:o,uc:a}),c+=1,e.startsWith("\\*",c)&&(o=!0);continue}if(d==="}"){s();let p=i.pop();p&&(o=p.skip,a=p.uc),c+=1;continue}if(d==="\\"){let p=e[c+1];if(p==="'"){let k=parseInt(e.substr(c+2,2),16);if(c+=4,l>0){l-=1;continue}!o&&Number.isFinite(k)&&n.push(k);continue}if(p==="\\"||p==="{"||p==="}"){o||(s(),r.push(p)),c+=2;continue}if(p==="~"){o||r.push(" "),c+=2;continue}let f=/^([a-zA-Z]+)(-?\d+)? ?/.exec(e.slice(c+1,c+40));if(!f){c+=2;continue}c+=1+f[0].length;let m=f[1].toLowerCase(),h=f[2]!==void 0?Number(f[2]):null;if(Zr.has(m)){o=!0;continue}m==="ansicpg"&&h?t=nn(h):m==="uc"&&h!==null?a=h:m==="u"&&h!==null?(s(),o||r.push(String.fromCharCode(h<0?h+65536:h)),l=a):!o&&(m==="par"||m==="line"||m==="row"||m==="sect"||m==="page")?(s(),r.push(`
|
|
27
|
+
`)):!o&&(m==="tab"||m==="cell")&&(s(),r.push(" "));continue}if(d==="\r"||d===`
|
|
28
28
|
`){c+=1;continue}if(l>0){l-=1,c+=1;continue}o||(s(),r.push(d)),c+=1}return s(),r.join("").replace(/\n{3,}/g,`
|
|
29
29
|
|
|
30
|
-
`)}var
|
|
30
|
+
`)}var ct=new Set([".xlsx",".xlsm",".xltx",".xltm",".docx",".docm",".dotx",".dotm",".pptx",".pptm",".ppsx",".ppsm",".potx"]),De=new Set([".odt",".ods",".odp",".ott",".ots",".otp"]),lt=new Set([".doc",".dot",".xls",".xlt",".ppt",".pps",".pot",".msg"]),rn=new Set([".rtf"]);function Jr(e){return/^\.(xls[xm]|xlt[xm])$/.test(e)?".xlsx":/^\.(doc[xm]|dot[xm])$/.test(e)?".docx":/^\.(ppt[xm]|pps[xm]|potx)$/.test(e)?".pptx":e}var G=8*1024*1024,qr=101010256,Yr=33639248,Qr=67324752;function ae(e){let t=Math.min(e.length,67584),r=-1;for(let o=e.length-22;o>=e.length-t&&o>=0;o-=1)if(e.readUInt32LE(o)===qr){r=o;break}if(r<0)return null;let n=e.readUInt16LE(r+10),s=e.readUInt32LE(r+16);if(s>=e.length)return null;let i=[];for(let o=0;o<n&&!(s+46>e.length||e.readUInt32LE(s)!==Yr);o+=1){let a=e.readUInt16LE(s+8),l=e.readUInt16LE(s+10),c=e.readUInt32LE(s+20),u=e.readUInt32LE(s+24),d=e.readUInt16LE(s+28),p=e.readUInt16LE(s+30),f=e.readUInt16LE(s+32),m=e.readUInt32LE(s+42),h=e.subarray(s+46,s+46+d).toString("utf8");i.push({name:h,flags:a,method:l,compSize:c,uncompSize:u,localHeaderOffset:m}),s+=46+d+p+f}return i}function ce(e,t,r=256*1024*1024){let n=t.localHeaderOffset;if(n+30>e.length||e.readUInt32LE(n)!==Qr)return null;let s=e.readUInt16LE(n+26),i=e.readUInt16LE(n+28),o=n+30+s+i,a=o+t.compSize;if(a>e.length)return null;let l=e.subarray(o,a);try{if(t.method===0)return l.length<=r?Buffer.from(l):null;if(t.method===8)return Xr(l,{maxOutputLength:r})}catch{return null}return null}function es(e,t){return ce(e,t)?.toString("utf8")??null}var ts={"&":"&","<":"<",">":">",""":'"',"'":"'"};function j(e){return e.replace(/&(amp|lt|gt|quot|apos);/g,t=>ts[t]??t).replace(/&#(\d+);/g,(t,r)=>{let n=Number(r);return n>0&&n<1114112?String.fromCodePoint(n):""}).replace(/&#x([0-9a-fA-F]+);/g,(t,r)=>{let n=parseInt(r,16);return n>0&&n<1114112?String.fromCodePoint(n):""})}function ns(e){return j(e.replace(/<[^>]*>/g,`
|
|
31
31
|
`)).replace(/\n{2,}/g,`
|
|
32
|
-
`)}function
|
|
33
|
-
`+
|
|
32
|
+
`)}function rs(e,t,r){let n=new RegExp(`<${t}\\b[^>]*\\b${r}="([^"]*)"`,"g"),s=[],i;for(;(i=n.exec(e))!==null;)i[1]&&s.push(j(i[1]));return s}function ss(e,t){let r=[];if(De.has(e)){for(let n of t)(n==="content.xml"||n==="styles.xml"||n==="meta.xml")&&r.push(n);return r}e=Jr(e);for(let n of t)(n==="docProps/core.xml"||n==="docProps/app.xml")&&r.push(n);if(e===".xlsx"||e===".xlsm")for(let n of t)(n==="xl/sharedStrings.xml"||n==="xl/workbook.xml"||/^xl\/worksheets\/sheet\d+\.xml$/.test(n)||/^xl\/comments\d*\.xml$/.test(n))&&r.push(n);else if(e===".docx")for(let n of t)(n==="word/document.xml"||/^word\/(header|footer|footnotes|endnotes|comments)\d*\.xml$/.test(n))&&r.push(n);else if(e===".pptx")for(let n of t)/^ppt\/(slides|notesSlides)\/(slide|notesSlide)\d+\.xml$/.test(n)&&r.push(n);return r}function is(e,t){let r=ae(e);if(!r||r.length===0)return null;let n=new Map(r.map(c=>[c.name,c])),s=ss(t,r.map(c=>c.name));if(s.length===0)return null;let i=[],o=[],a=0,l=!1;for(let c of s){if(a>=G){l=!0;break}let u=n.get(c);if(!u)continue;let d=es(e,u);if(d===null)continue;let p=ns(d);if(c==="xl/workbook.xml"){let f=rs(d,"sheet","name");f.length&&(p+=`
|
|
33
|
+
`+f.join(`
|
|
34
34
|
`))}a+p.length>G&&(p=p.slice(0,Math.max(0,G-a)),l=!0),p.trim().length!==0&&(i.push(p),o.push(c),a+=p.length)}return i.length===0?null:{text:i.join(`
|
|
35
|
-
`),truncated:l,parts:o}}function
|
|
36
|
-
`)?`"${e.replace(/"/g,'""')}"`:e}function
|
|
37
|
-
`),counts:o,columnsHidden:s.filter((h,y)=>i[y])}}var Jr=/^xl\/(pivotCache|charts|externalLinks)\//,on=10;function qr(e,t,r=1){e[t]=(e[t]??0)+r}function an(e){return e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""")}function cn(e){let t=e.replace(/<rPh\b[\s\S]*?<\/rPh>/g,""),r="";for(let n of t.matchAll(/<t(?:\s[^>]*)?>([\s\S]*?)<\/t>/g))r+=n[1];return M(r)}function Yr(e){return e?[...e.matchAll(/<si\b[^>]*>([\s\S]*?)<\/si>|<si\b[^>]*\/>/g)].map(t=>cn(t[1]??"")):[]}var ln=/<c\b([^>]*?)(?:\/>|>([\s\S]*?)<\/c>)/g;function Pe(e,t){let r=new RegExp(`\\b${t}="([^"]*)"`).exec(e);return r?r[1]:null}function V(e,t){if(e.type==="s"){let n=/<v>([^<]*)<\/v>/.exec(e.inner);return n?t[Number(n[1])]??null:null}if(e.type==="inlineStr"){let n=/<is>([\s\S]*?)<\/is>/.exec(e.inner);return n?cn(n[1]):null}if(e.type==="b"||e.type==="e")return null;let r=/<v>([^<]*)<\/v>/.exec(e.inner);return r?M(r[1]):null}function Qr(e){let t=[];for(let r of e.matchAll(ln)){let n=Pe(r[1],"r"),s=n?/^([A-Z]+)(\d+)$/.exec(n):null;if(!s)return null;t.push({full:r[0],attrs:r[1],inner:r[2]??"",col:s[1],row:Number(s[2]),type:Pe(r[1],"t")??"n"})}return t}function es(e,t){let r=[...new Set(e.map(n=>n.row))].sort((n,s)=>n-s).slice(0,on);for(let n of r){let s=new Map;for(let i of e.filter(o=>o.row===n)){let o=V(i,t),a=o?Y(o):null;a&&s.set(i.col,{type:a.type,header:o.trim()})}if(s.size>0)return{row:n,cols:s}}return{row:-1,cols:new Map}}var ts=/^xl\/worksheets\/sheet\d+\.xml$/,ns=200;function rs(e){let t=e.trim();return/^[\d.,\-+/:%$₪€\s]+$/.test(t)||t.length>60}function ss(e,t){let r=[...new Set(e.map(i=>i.row))].sort((i,o)=>i-o).slice(0,on),n=-1,s=-1/0;for(let i of r){let o=e.filter(c=>c.row===i).map(c=>(V(c,t)??"").trim()).filter(Boolean);if(o.length<2)continue;let a=o.filter(c=>!rs(c)).length,l=a*2-(o.length-a);l>s&&(s=l,n=i)}return n}function is(e,t,r){let n=es(t,r),s=J();if(!s)return n;let i=n.row>=0?n.row:ss(t,r);if(i<0)return n;let o=t.filter(d=>d.row===i).map(d=>({col:d.col,text:(V(d,r)??"").trim()})).filter(d=>d.text),a=new Map(o.map((d,p)=>[d.col,p])),l=new Map;for(let d of t){if(d.row<=i)continue;let p=a.get(d.col);if(p!==void 0){if(!l.has(d.row)){if(l.size>=ns)continue;l.set(d.row,o.map(()=>""))}l.get(d.row)[p]=V(d,r)??""}}let c=new Map(i===n.row?n.cols:[]),u=o.map(d=>d.text);for(let d of s({name:e,headers:u,rows:[...l.values()]})){let p=u.indexOf(d.column);p<0||c.set(o[p].col,{type:d.type,header:d.column,category:d.category,severity:d.severity,how:d.how})}return{row:i,cols:c}}function rn(e,t){return`<c${e.replace(/\s*\bt="[^"]*"/,"")} t="inlineStr"><is><t xml:space="preserve">${an(t)}</t></is></c>`}var os=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t+=1){let r=t;for(let n=0;n<8;n+=1)r=r&1?3988292384^r>>>1:r>>>1;e[t]=r>>>0}return e})();function as(e){let t=4294967295;for(let r=0;r<e.length;r+=1)t=os[(t^e[r])&255]^t>>>8;return(t^4294967295)>>>0}var sn=33;function dn(e){let t=[],r=[],n=0;for(let o of e){let a=Buffer.from(o.name,"utf8"),l=o.name.endsWith("/"),c=l?Buffer.alloc(0):Xr(o.data),u=l?0:8,d=l?0:as(o.data),p=Buffer.alloc(30);p.writeUInt32LE(67324752,0),p.writeUInt16LE(20,4),p.writeUInt16LE(2048,6),p.writeUInt16LE(u,8),p.writeUInt16LE(sn,12),p.writeUInt32LE(d,14),p.writeUInt32LE(c.length,18),p.writeUInt32LE(o.data.length,22),p.writeUInt16LE(a.length,26),t.push(p,a,c);let h=Buffer.alloc(46);h.writeUInt32LE(33639248,0),h.writeUInt16LE(20,4),h.writeUInt16LE(20,6),h.writeUInt16LE(2048,8),h.writeUInt16LE(u,10),h.writeUInt16LE(sn,14),h.writeUInt32LE(d,16),h.writeUInt32LE(c.length,20),h.writeUInt32LE(o.data.length,24),h.writeUInt16LE(a.length,28),h.writeUInt32LE(n,42),r.push(h,a),n+=p.length+a.length+c.length}let s=Buffer.concat(r),i=Buffer.alloc(22);return i.writeUInt32LE(101010256,0),i.writeUInt16LE(e.length,8),i.writeUInt16LE(e.length,10),i.writeUInt32LE(s.length,12),i.writeUInt32LE(n,16),Buffer.concat([...t,s,i])}function ft(e){let t=se(e);if(!t||t.length===0||t.some(f=>Jr.test(f.name)))return null;let r=new Map;for(let f of t){if(f.name.endsWith("/")){r.set(f.name,Buffer.alloc(0));continue}let k=ie(e,f);if(!k)return null;r.set(f.name,k)}let n=[...r.keys()].filter(f=>ts.test(f));if(n.length===0)return null;let s=r.get("xl/sharedStrings.xml")?.toString("utf8")??null,i=Yr(s),o=new Set,a={},l=new Set,c=lt();for(let f of n){let k=r.get(f).toString("utf8"),m=Qr(k);if(!m)return null;let x=is(f.replace(/^xl\/worksheets\//,"").replace(/\.xml$/,""),m,i),_=x.row,A=new Map;for(let $ of m){if($.type!=="n"||$.row<=_)continue;let T=V($,i);T!==null&&A.set($.col,[...A.get($.col)??[],T])}let P=ut(A),N=new Map;for(let[$,{type:T,header:F,how:me}]of x.cols)me==="header"&&P.has($)||(N.set($,T),l.add(F));let he=k.replace(ln,($,T,F)=>{let me=Pe(T,"r"),[,H,ge]=/^([A-Z]+)(\d+)$/.exec(me),D={full:$,attrs:T,inner:F??"",col:H,row:Number(ge),type:Pe(T,"t")??"n"},g=V(D,i),b=()=>{if(D.type==="s"){let v=/<v>([^<]*)<\/v>/.exec(D.inner);v&&o.add(Number(v[1]))}return $};if(g===null||g.trim()==="")return b();let S=N.get(H);if(S&&D.row>_&&!dt(g))return qr(a,`column:${S}`),rn(T,c(S,g));if(D.type==="n"&&P.has(H))return b();let E=O(g,a);return E.text===g?b():rn(T,E.text)});r.set(f,Buffer.from(he,"utf8"))}if(s){let f=-1,k=s.replace(/<si\b[^>]*>[\s\S]*?<\/si>|<si\b[^>]*\/>/g,m=>(f+=1,o.has(f)?m:"<si><t></t></si>"));r.set("xl/sharedStrings.xml",Buffer.from(k,"utf8"))}for(let f of[...r.keys()].filter(k=>/^xl\/comments\d*\.xml$/.test(k))){let m=r.get(f).toString("utf8").replace(/(<t(?:\s[^>]*)?>)([\s\S]*?)(<\/t>)/g,(x,_,A,P)=>{let N=O(M(A),a);return`${_}${an(N.text)}${P}`});r.set(f,Buffer.from(m,"utf8"))}let u=r.get("docProps/core.xml");if(u){let f=u.toString("utf8").replace(/(<dc:creator>)[\s\S]*?(<\/dc:creator>)/,"$1$2").replace(/(<cp:lastModifiedBy>)[\s\S]*?(<\/cp:lastModifiedBy>)/,"$1$2");r.set("docProps/core.xml",Buffer.from(f,"utf8"))}let d=r.get("xl/workbook.xml");if(d){let f=d.toString("utf8").replace(/<(\w+:)?absPath\b[^>]*\/>|<(\w+:)?absPath\b[^>]*>[\s\S]*?<\/(\w+:)?absPath>/g,"");r.set("xl/workbook.xml",Buffer.from(f,"utf8"))}let p=r.get("docProps/app.xml");if(p){let f=p.toString("utf8").replace(/(<Company>)[\s\S]*?(<\/Company>)/,"$1$2").replace(/(<Manager>)[\s\S]*?(<\/Manager>)/,"$1$2");r.set("docProps/app.xml",Buffer.from(f,"utf8"))}let h=r.has("xl/calcChain.xml"),y=t.map(f=>f.name).filter(f=>!(h&&f==="xl/calcChain.xml"));if(h)for(let f of["[Content_Types].xml","xl/_rels/workbook.xml.rels"]){let k=r.get(f);k&&r.set(f,Buffer.from(k.toString("utf8").replace(/<(Override|Relationship)\b[^>]*calcChain[^>]*\/>/g,""),"utf8"))}return{bytes:dn(y.map(f=>({name:f,data:r.get(f)}))),counts:a,columnsHidden:[...l]}}var Z=/(^|\/)(\.env(\.[\w.-]+)?|[\w.-]+\.env(\.[\w.-]+)?)$/i,cs=/(SECRET|PASSWORD|PASSWD|PASS|PWD|TOKEN|PRIVATE|CREDENTIAL|API_?KEY|_KEY|KEY_ID|DSN|DATABASE_URL|_URI|POOLER_URL|SALT|PEPPER)$/i,ls=/(^NEXT_PUBLIC_|^VITE_|^EXPO_PUBLIC_|ANON_KEY$|PUBLISHABLE_KEY$|PUBLIC_KEY$)/i;function ht(e){let t=0;for(let r of e.split(/\r?\n/)){let n=/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(r);if(!n||!cs.test(n[1])||ls.test(n[1]))continue;let s=n[2].trim().replace(/^(['"])(.*)\1$/,"$2");s.length>=8&&!/^\$\{?[A-Z_]+\}?$/.test(s)&&t++}return t}var la=64*1024*1024,da=4*1024*1024;var ua=512*1024*1024,pa=1024*1024*1024;var fa=256*1024*1024;var ha=new un("utf-8",{fatal:!0}),ma=new un("windows-1255");var ga=new Set([".cache",".cargo",".rustup",".npm",".pnpm-store",".yarn",".gradle",".m2",".nuget",".conda",".pyenv",".rbenv",".nvm",".volta",".bun",".deno",".docker",".android",".vscode-server",".agents",".agent",".codeium",".continue","antigravity",".antigravity","__pycache__",".venv","venv","site-packages",".next",".turbo",".expo",".nx",".parcel-cache",".svelte-kit","appdata",".trash","$recycle.bin"].map(e=>e.toLowerCase()));var xs=["Put the new key where the app reads it (for a developer machine: the NoData vault + nodata_run, not a .env file).","Check that the app still works with the new key.","Only then delete / revoke the OLD key \u2014 until you do, whoever copied it can still use it."],w=(e,t,r)=>({provider:e,url:t,steps:[...r,...xs]}),vs={"aws-access-key":w("AWS","https://console.aws.amazon.com/iam/home#/security_credentials",["Open IAM \u2192 your user \u2192 Security credentials.","Create a NEW access key (you see its secret once \u2014 keep it only in the vault)."]),"aws-secret-key":w("AWS","https://console.aws.amazon.com/iam/home#/security_credentials",["Open IAM \u2192 your user \u2192 Security credentials.","Create a NEW access key (you see its secret once \u2014 keep it only in the vault).","Mark the old key Inactive before deleting it."]),"gcp-api-key":w("Google Cloud","https://console.cloud.google.com/apis/credentials",["Open APIs & Services \u2192 Credentials.","Pick the key \u2192 Regenerate key (or create a new one and restrict it to the APIs you use)."]),"gcp-service-account":w("Google Cloud (service account)","https://console.cloud.google.com/iam-admin/serviceaccounts",["Open IAM & Admin \u2192 Service accounts \u2192 the account \u2192 Keys.","Add key \u2192 Create new key (JSON). Keep the file out of Git and out of shared folders."]),"firebase-key":w("Firebase / Google Cloud","https://console.cloud.google.com/apis/credentials",["A Firebase web key is meant to be public \u2014 restrict it instead: Credentials \u2192 the key \u2192 Application restrictions (your domains only).","If it is not a web key, regenerate it."]),"github-token":w("GitHub","https://github.com/settings/tokens",["Open Settings \u2192 Developer settings \u2192 Personal access tokens.","Generate a new token with only the scopes you need."]),"github-fine-grained":w("GitHub","https://github.com/settings/tokens?type=beta",["Open Fine-grained tokens.","Regenerate the token (or create a new one for only the repositories you need)."]),"gitlab-token":w("GitLab","https://gitlab.com/-/user_settings/personal_access_tokens",["Open Access tokens.","Create a new token with only the scopes you need."]),"stripe-secret":w("Stripe","https://dashboard.stripe.com/apikeys",["Open Developers \u2192 API keys.","Roll the secret key (Stripe can keep the old one alive for a short overlap)."]),"stripe-restricted":w("Stripe","https://dashboard.stripe.com/apikeys",["Open Developers \u2192 API keys \u2192 Restricted keys.","Roll the key, or create a new restricted key."]),"slack-token":w("Slack","https://api.slack.com/apps",["Open your app \u2192 OAuth & Permissions.","Rotate / reinstall to get a new token."]),"slack-webhook":w("Slack","https://api.slack.com/apps",["Open your app \u2192 Incoming Webhooks.","Add a new webhook URL for the channel."]),"twilio-api-key":w("Twilio","https://console.twilio.com/us1/account/keys-credentials/api-keys",["Open Account \u2192 API keys & tokens.","Create a new API key."]),"sendgrid-api-key":w("SendGrid","https://app.sendgrid.com/settings/api_keys",["Open Settings \u2192 API Keys.","Create a new key with only the permissions you need."]),"openai-key":w("OpenAI","https://platform.openai.com/api-keys",["Open API keys.","Create a new secret key."]),"openai-project-key":w("OpenAI","https://platform.openai.com/api-keys",["Open API keys (per project).","Create a new secret key for the same project."]),"anthropic-key":w("Anthropic","https://console.anthropic.com/settings/keys",["Open Settings \u2192 API keys.","Create a new key."]),"supabase-key":w("Supabase","https://supabase.com/dashboard/project/_/settings/api-keys",["Open the project \u2192 Project Settings \u2192 API Keys.","Create a new SECRET key (a service_role / secret key bypasses every database rule \u2014 treat it like a root password).","Older projects with JWT keys: rotating the JWT secret replaces every key and signs everyone out \u2014 plan it."]),"supabase-access-token":w("Supabase (personal access token \u2014 reaches every project of the account)","https://supabase.com/dashboard/account/tokens",["Open Account \u2192 Access Tokens.","Revoke this token, then generate a new one only where it is needed (CLI, MCP) \u2014 prefer a read-only MCP."]),"supabase-secret-key":w("Supabase","https://supabase.com/dashboard/project/_/settings/api-keys",["Open the project \u2192 Project Settings \u2192 API Keys.","Create a new secret key, switch your servers to it, then delete this one."]),"postgres-uri":w("PostgreSQL (the password in the connection string)","https://supabase.com/dashboard/project/_/settings/database",["Change the database user's password: in Supabase \u2192 Project Settings \u2192 Database \u2192 Reset password; elsewhere, your host's console or ALTER USER \u2026 WITH PASSWORD.","Update the connection string with the new password."]),"mongodb-uri":w("MongoDB","https://cloud.mongodb.com/",["Open Atlas \u2192 Database Access \u2192 the user \u2192 Edit \u2192 Edit password.","Update the connection string."]),"redis-uri":w("Redis","",["Reset the password in your Redis host's console (or CONFIG SET requirepass on your own server).","Update the connection string."]),"private-key":w("Private key (SSH / TLS / signing)","",["Generate a new key pair.","Register the new PUBLIC key where the old one was trusted (server authorized_keys, certificate, service settings)."]),"jwt-secret":w("Your app's JWT secret","",["Set a new long random secret in the app's configuration.","Every signed-in user will be signed out \u2014 plan the moment."]),"password-in-code":w("A password in code","",["Change the password in the system it belongs to."]),"bearer-token":w("An access token","",["Revoke the token in the service that issued it and issue a new one."])},ws=w("A credential","",["Find the service it belongs to and issue a new credential there."]);function mt(e){return vs[e]??ws}function hn(e){return/\.ndc$/i.test(e)||/\.clean\.[A-Za-z0-9]+$/.test(e)||Ss(e)}function Ss(e){return/(^|[\\/])\.nodata[\\/]/.test(e)}import{existsSync as Es,mkdirSync as pc,readFileSync as As,statSync as mn,writeFileSync as fc}from"node:fs";import{homedir as Is}from"node:os";import{join as $s}from"node:path";var Ts=()=>$s(Is(),".nodata","flagged.json");function Rs(e){let t=e.replace(/\\/g,"/");return process.platform==="win32"?t.toLowerCase():t}var ce=null;function Cs(){let e=Ts();try{if(!Es(e))return{};let t=mn(e).mtimeMs;if(ce&&ce.path===e&&ce.mtimeMs===t)return ce.store;let r=JSON.parse(As(e,"utf8"));return ce={path:e,mtimeMs:t,store:r},r}catch{return{}}}function Le(e){let t=Cs()[Rs(e)];if(!t)return null;try{if(mn(e).mtimeMs>t.mtimeMs+1e3)return null}catch{return null}return t.kinds}import{existsSync as Ps,mkdirSync as bc,readFileSync as Ls,writeFileSync as _c}from"node:fs";import{homedir as Ds}from"node:os";import{join as Os}from"node:path";var gn=()=>Os(Ds(),".nodata","prefs.json");function Ns(){try{let e=Ps(gn())?JSON.parse(Ls(gn(),"utf8")).lang:null;return e==="he"||e==="en"?e:null}catch{return null}}function Fs(){let t=process.env.LC_ALL||process.env.LC_MESSAGES||process.env.LANG||"";try{t||=Intl.DateTimeFormat().resolvedOptions().locale}catch{}return/^(he|iw)(?:[-_.@]|$)/i.test(t)?"he":"en"}function K(){return Ns()??Fs()}function R(e,t,r=K()){return r==="he"?e:t}import{createHmac as Ms,randomBytes as js}from"node:crypto";import{existsSync as Oe,mkdirSync as Us,readdirSync as zs,readFileSync as gt,writeFileSync as Bs}from"node:fs";import{homedir as de}from"node:os";import{basename as Ws,extname as Gs,isAbsolute as Vs,join as ue,relative as Zs,resolve as Ks}from"node:path";function j(e){return typeof e=="number"&&Number.isFinite(e)?e:typeof e=="string"&&e.trim()!==""&&!Number.isNaN(Number(e))?Number(e):null}function Hs(e,t,r){return t===null||r===null?!1:t<=r?e>=t&&e<=r:e>=t||e<=r}function yn(e,t,r){switch(t){case"eq":return e===r;case"ne":return e!==r;case"in":return Array.isArray(r)&&r.includes(e);case"not_in":return Array.isArray(r)&&!r.includes(e);case"prefix":return typeof e=="string"&&typeof r=="string"&&e.toLowerCase().startsWith(r.toLowerCase());case"gte":{let n=j(e),s=j(r);return n!==null&&s!==null&&n>=s}case"lte":{let n=j(e),s=j(r);return n!==null&&s!==null&&n<=s}case"between":{let n=j(e);return n!==null&&Array.isArray(r)&&r.length===2&&Hs(n,j(r[0]),j(r[1]))}default:return!1}}function bn(e,t,r){switch(t){case"in":return Array.isArray(r)&&e.some(n=>r.includes(n));case"not_in":return Array.isArray(r)&&!e.some(n=>r.includes(n));default:return!1}}var _n=()=>ue(de(),".nodata","rules.json"),De=()=>ue(de(),".nodata","rules-key"),kn={allow:0,ask:1,clean_copy:2,deny:3},Xs={action:{cardinality:"scalar",ops:["eq","ne","in","not_in"],enumValues:["read","search","run","write"],label:"what the agent does (read, search, run, write)",extract:e=>e.action},"time.hour":{cardinality:"scalar",ops:["between","gte","lte","eq"],label:"hour on this computer (0-23; 18..6 wraps overnight)",extract:e=>e.now.getHours()},"time.weekday":{cardinality:"scalar",ops:["in","not_in","between","eq"],label:"weekday on this computer (0 Sunday \u2026 6 Saturday)",extract:e=>e.now.getDay()},"file.ext":{cardinality:"scalar",ops:["eq","ne","in","not_in"],label:"file type (.xlsx, .pdf, .env \u2026)",extract:e=>Gs(e.path).toLowerCase()||void 0},"file.name":{cardinality:"scalar",ops:["eq","in","prefix"],label:"file name",extract:e=>Ws(e.path).toLowerCase()}};function Js(){try{if(Oe(De())){let t=gt(De(),"utf8").trim();if(/^[0-9a-f]{64}$/.test(t))return Buffer.from(t,"hex")}}catch{}let e=js(32);return Us(ue(de(),".nodata"),{recursive:!0}),Bs(De(),e.toString("hex")+`
|
|
38
|
-
`,{mode:384}),e}var qs=(e,t)=>Ms("sha256",t).update(JSON.stringify(e)).digest("hex");function xn(){if(!Oe(_n()))return{rules:[],tampered:!1};try{let e=JSON.parse(gt(_n(),"utf8")),t=Array.isArray(e.rules)?e.rules:[],r=Oe(De())&&typeof e.mac=="string"&&e.mac===qs(t,Js());return{rules:t,tampered:!r}}catch{return{rules:[],tampered:!0}}}var le=e=>{let t=Ks(e.replace(/^~(?=[\\/]|$)/,de())).replace(/\\/g,"/");return process.platform==="win32"?t.toLowerCase():t};function U(e,t){if(e.startsWith("**/")){let n=e.slice(3).replace(/\\/g,"/").replace(/\/+$/,"").toLowerCase(),s=le(t).toLowerCase();return s.endsWith("/"+n)||s.includes("/"+n+"/")}let r=Zs(le(e),le(t));return r===""||!r.startsWith("..")&&!Vs(r)}function vn(e,t){let r=Xs[e.field];if(!r)return!1;let n=r.extract(t);return e.op==="exists"?n!==void 0&&n!=="":n===void 0?!1:r.cardinality==="set"?bn(Array.isArray(n)?n:[],e.op,e.value):yn(n,e.op,e.value)}function yt(e,t){let r=e.map((n,s)=>({rule:n,n:s+1})).filter(n=>U(n.rule.path,t.path)).sort((n,s)=>le(s.rule.path).length-le(n.rule.path).length||n.n-s.n);for(let n of r)if((n.rule.when??[]).every(s=>vn(s,t)))return{...n,touched:t.path};return null}function bt(e,t,r,n){let s=null;for(let[i,o]of e.entries())U(o.path,t)||(o.path.startsWith("**/")?!Ys(t,o.path):!U(t,o.path))||(o.when??[]).every(a=>vn(a,{action:r,path:o.path,now:n}))&&(!s||kn[o.effect]>kn[s.rule.effect])&&(s={rule:o,n:i+1,touched:o.path});return s}function Ys(e,t){let r=0,n=(s,i)=>{if(i>5||r>4e3)return!1;let o;try{o=zs(s,{withFileTypes:!0})}catch{return!1}for(let a of o){if(++r>4e3||!a.isDirectory()||a.name==="node_modules"||a.name===".git")continue;let l=ue(s,a.name);if(U(t,l)||n(l,i+1))return!0}return!1};return n(e,0)}var Qs={allow:["allowed","\u05DE\u05D5\u05EA\u05E8"],ask:["ask the person","\u05DC\u05E9\u05D0\u05D5\u05DC \u05D0\u05D5\u05EA\u05DA"],clean_copy:["clean copy only","\u05E8\u05E7 \u05E2\u05D5\u05EA\u05E7 \u05E0\u05E7\u05D9"],deny:["not allowed","\u05D0\u05E1\u05D5\u05E8"]};var wn=(e,t=!1)=>Qs[e][t?1:0];function Sn(){try{let e=ue(de(),".nodata","org-mandate.json");if(!Oe(e))return[];let t=JSON.parse(gt(e,"utf8"));return Array.isArray(t.folder_rules)?t.folder_rules:[]}catch{return[]}}var ii=new Set([".csv",".tsv",".txt",".md",".json",".log",".xml",".sql",".yaml",".yml",".eml",...ct]),oi=50*1024*1024,ai=8,ci={israeli_id:"Israeli ID",credit_card:"card",iban:"IBAN",israeli_phone:"phone",email:"email",secret:"secret"};function vt(e){let t=xt(e).toLowerCase();return ii.has(Tn(t))||Z.test(t)}var li=/^(reports|receipts)(\/|$)|^(prefs|consent|flagged|statusline-prev|key-backup|connection)\.json$|^(gate|status)\.mjs$|^(gate|answers)\.log$/i,di=/\.nodata[\\/]+(device-key\.json|secrets\.json|credentials\.json|issuer-ed25519\.json|capsule\.json|capsule-key|shares|approvals|fabric-key\.json|machine-salt|pending-link\.json|api-shares\.json|secret-shares\.json)\b/i;function pe(e){let t=Fe(fe(),".nodata").replace(/\\/g,"/").toLowerCase();if(!e.replace(/\\/g,"/").toLowerCase().startsWith(t+"/"))return!1;let n=e.replace(/\\/g,"/").slice(t.length+1);return n!==""&&!li.test(n)}function ui(e){return di.test(e)}var En=/(\.claude[\\/]+settings(\.local)?\.json|node_modules[\\/]+@nodatachat[\\/])/i,pi=/(>|\bsed\s+-i|\btee\b|\b(rm|del|erase|mv|move|cp|copy|ren|rename)\b|Set-Content|Add-Content|Out-File|Remove-Item|Move-Item|Copy-Item|Rename-Item|WriteAllText|writeFileSync|unlinkSync)/i;function fi(e,t,r){if(e==="Bash"||e==="PowerShell"){let s=typeof t.command=="string"?t.command:"";return En.test(s)&&pi.test(s)}let n=typeof t.file_path=="string"?t.file_path:typeof t.notebook_path=="string"?t.notebook_path:"";return n?En.test((X(n)?n:C(r,n)).replace(/\\/g,"/")):!1}function hi(e){return vt(e)||Le(e)!==null}var He=class extends Error{};function mi(e){let t=Tn(e).toLowerCase(),r=ri(e),n,s;if(t===".csv"||t===".tsv")s=r.toString("utf8"),n=pt(s,t===".tsv"?" ":void 0).counts;else if(ct.has(t)){let o=t===".xlsx"||t===".xlsm"?ft(r):null,a=at(r,t);if(!a&&!o)throw new He;s=a?.text??"",n=o?o.counts:O(s).counts}else s=r.toString("utf8"),n=O(s).counts;let i=be.filter(o=>o.pattern.test(s)).length;return Z.test(xt(e).toLowerCase())&&(i=Math.max(i,ht(s))),i&&(n.secret=Math.max(n.secret??0,i)),n}var gi={israeli_id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",credit_card:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9",iban:"IBAN",israeli_phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",email:'\u05D3\u05D5\u05D0"\u05DC',secret:"\u05E1\u05D5\u05D3",name:"\u05E9\u05DD",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",financial:"\u05DE\u05D9\u05D3\u05E2 \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",bank_account:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7",plate:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"};function Rn(e){let t=K()==="he",r=n=>(t?gi[n]:ci[n])??n;return Object.entries(e).sort((n,s)=>s[1]-n[1]).map(([n,s])=>`${s} ${n.startsWith("column:")?`${r(n.slice(7))} (${t?"\u05E2\u05DE\u05D5\u05D3\u05D4":"column"})`:r(n)}`).join(", ")}function yi(e){return Rn(e)}function Cn(e,t,r){let n=i=>X(i)?i:C(r,i),s=i=>{try{return kt(i).isFile()}catch{return!1}};if(e==="Read"&&typeof t.file_path=="string")return[n(t.file_path)];if(e==="Grep"&&typeof t.path=="string"&&s(n(t.path)))return[n(t.path)];if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"){let i=t.command,o=[...[...i.matchAll(/"([^"]*)"/g)].map(l=>l[1]),...[...i.matchAll(/'([^']*)'/g)].map(l=>l[1]),...i.split(/[\s|;&<>(),=`]+/)],a=[];for(let l of o){let c=l.trim().replace(/^['"]|['"]$/g,"").replace(/\\\\/g,"\\").replace(/^~(?=[\\/])/,fe()).replace(/^\/([a-zA-Z])\//,(d,p)=>process.platform==="win32"?`${p}:/`:d);if(!c)continue;let u=n(c);if(!(!vt(c)&&!pe(u)&&Le(u)===null)&&(s(u)&&!a.includes(u)&&a.push(u),a.length>=ai))break}return a}return[]}function z(e){return e.replace(/\\+/g,"/")}function bi(e){let t=e.trim();return/[;|&\n]|`|\$\(/.test(t.replace(/^cmd(?:\.exe)?\s+\/c\s+/i,""))?!1:/^(?:cmd(?:\.exe)?\s+\/c\s+)?(?:explorer(?:\.exe)?|start|invoke-item|ii|start-process|open|xdg-open)\b/i.test(t)}function Pn(e,t,r){let n=[];if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"&&bi(t.command))return n;for(let s of Cn(e,t,r)){if(!hi(s)||hn(s)||!$n(s))continue;let i,o=vt(s)?null:Le(s);if(o){i=`${z(s)}: ${R("\u05E7\u05D5\u05D3 \u05E9\u05D4\u05E1\u05E8\u05D9\u05E7\u05D4 \u05D4\u05D0\u05D7\u05E8\u05D5\u05E0\u05D4 \u05E1\u05D9\u05DE\u05E0\u05D4","code your last scan flagged")} \u2014 ${yi(o)}`,n.push(i);continue}try{if(kt(s).size>oi)i=`${z(s)}: too large to check here (over 50 MB)`;else{let a=mi(s);if(Object.keys(a).length===0)continue;i=`${z(s)}: ${Rn(a)}`}}catch(a){i=a instanceof He?`${z(s)}: ${R("\u05DC\u05D0 \u05E0\u05D9\u05EA\u05DF \u05DC\u05E7\u05E8\u05D5\u05D0 \u05D0\u05EA \u05D4\u05D8\u05E7\u05E1\u05D8 (\u05E1\u05E8\u05D9\u05E7\u05D4, \u05D4\u05E6\u05E4\u05E0\u05D4 \u05D0\u05D5 \u05D2\u05D5\u05E4\u05DF \u05DC\u05D0 \u05E0\u05EA\u05DE\u05DA) \u2014 \u05DC\u05D0 \u05E0\u05D1\u05D3\u05E7, \u05D4\u05EA\u05D9\u05D9\u05D7\u05E1 \u05D0\u05DC\u05D9\u05D5 \u05DB\u05E8\u05D2\u05D9\u05E9","its text could not be read (a scan, encryption or an unsupported font) \u2014 NOT checked, treat it as sensitive")}`:`${z(s)}: could not be checked`}n.push(i)}return n}var _t=/(?:\.aws[\\/]+credentials|\.npmrc|\.yarnrc\.yml|\.pypirc|[._]netrc|\.git-credentials|\.pgpass|\.docker[\\/]+config\.json|\.kube[\\/]+config|gh[\\/]+hosts\.yml|\.supabase[\\/]+access-token|application_default_credentials\.json|gcloud[\\/]+(?:credentials|access_tokens)\.db|\.azure[\\/]+(?:msal_token_cache|accessTokens)|com\.vercel\.cli[\\/]+auth\.json|\.ssh[\\/]+id_(?:rsa|ed25519|ecdsa|dsa)(?![\w.]))/i,Me=/(?:TOKEN|SECRET|PASSW(?:OR)?D|API_?KEY|PRIVATE_?KEY|ACCESS_?KEY|CREDENTIAL|SERVICE_ROLE|_KEY$)/i,_i=[[/^(?:env|set|export\s+-p|declare\s+-x|get-childitem\s+env:\S*|gci\s+env:\S*|dir\s+env:\S*|ls\s+env:\S*)\s*$/i,"every environment variable"],[/^gh\s+auth\s+(?:token\b|status\b.*(?:\s-t\b|--show-token))/i,"the GitHub login token"],[/^gcloud\s+auth\s+(?:application-default\s+)?print-(?:access|identity)-token\b/i,"a Google Cloud access token"],[/^az\s+account\s+get-access-token\b/i,"an Azure access token"],[/^aws\s+(?:configure\s+(?:get\s+\S*(?:secret|token)\S*|export-credentials)|sts\s+get-session-token|ecr\s+get-login-password)\b/i,"AWS credentials"],[/^supabase\s+projects\s+api-keys\b/i,"the project's Supabase keys (incl. service_role)"],[/^heroku\s+auth:token\b/i,"the Heroku login token"],[/^op\s+(?:read|item\s+get)\b/i,"a 1Password secret"],[/^vault\s+(?:kv\s+get|read)\b/i,"a Vault secret"],[/^doppler\s+secrets\b/i,"Doppler secrets"],[/^security\s+find-(?:generic|internet)-password\b.*\s-w\b/i,"a keychain password"],[/^git\s+credential\s+fill\b/i,"a saved Git password"],[/^(?:npx\s+(?:-y\s+)?@nodatachat\/mcp(?:@\S+)?|nodata-mcp)\s+(?:secrets-run|secrets-login)\b|^node\s+\S*nodata-pull\.mjs\b/i,"the vault's secrets, outside nodata_run's approval and each key's policy"],[/^kubectl\s+get\s+secrets?\b.*\s-o\b/i,"Kubernetes secrets"]],ki=/^(?:echo|printf|print|write-output|write-host|say)\b/i,Ln=/^(?:cat|type|get-content|gc|more|less|head|tail|bat|nl|strings|xxd|od|hexdump|grep|egrep|rg|select-string|sls|awk|sed|jq|yq|python\d*|py|node|ruby|perl)\b/i,xi=/\$\{?env:([A-Za-z_][\w]*)|\$\{?([A-Za-z_][\w]*)|%([A-Za-z_][\w]*)%|GetEnvironmentVariable\(\s*['"]([^'"]+)['"]/g;function vi(e,t,r){let n=e==="Read"&&typeof t.file_path=="string"?t.file_path:e==="Grep"&&typeof t.path=="string"?t.path:"";if(n&&_t.test((X(n)?n:C(r,n)).replace(/\\/g,"/")))return`a saved login (${xt(n)})`;if(e!=="Bash"&&e!=="PowerShell"||typeof t.command!="string")return null;let s=t.command.split(/(\|\||&&|[;|\n])/);for(let i=0;i<s.length;i+=2){let o=s[i+1]==="|",a=s[i].trim().replace(/^(?:sudo\s+|cmd(?:\.exe)?\s+\/c\s+|powershell(?:\.exe)?\s+(?:-command\s+)?|pwsh\s+(?:-c(?:ommand)?\s+)?)+/i,"").replace(/^["']|["']$/g,"");if(Ln.test(a)&&_t.test(a))return"a saved login file";for(let[c,u]of _i)if(c.test(a))return u;let l=a.match(/^printenv(?:\s+(\S+))?\s*$/i);if(l&&(!l[1]||Me.test(l[1])))return l[1]?`the variable ${l[1]}`:"every environment variable";if(!o&&(ki.test(a)||/GetEnvironmentVariable/i.test(a)))for(let c of a.matchAll(xi)){let u=c[1]??c[2]??c[3]??c[4]??"";if(Me.test(u))return`the variable ${u}`}}return null}var Dn=/^(?:grep|egrep|fgrep|rg|ag|ack|git\s+grep|findstr|select-string|sls)\b/i,wi=/(?:^|\s)(?:-[a-zA-Z]*[rR][a-zA-Z]*|--recursive|--dereference-recursive|\/s|-recurse)(?=\s|$)/i,Si=new Set(["node_modules",".git",".next","dist","build",".venv","venv","__pycache__",".cache"]),An=4e3,Ei=5;function Ai(e){let t=0,r=0,n=(s,i)=>{if(i>Ei||t>An)return;let o;try{o=ni(s,{withFileTypes:!0})}catch{return}for(let a of o){if(++t>An)return;let l=Fe(s,a.name);a.isDirectory()?Si.has(a.name)||n(l,i+1):(Z.test(a.name.toLowerCase())||_t.test(l.replace(/\\/g,"/"))||pe(l))&&r++}};return n(e,0),r}var je=e=>{try{return kt(e).isDirectory()}catch{return!1}};function Ii(e,t){let r=si(C(t),C(e));return r===""||!r.startsWith("..")&&!X(r)}function $i(e,t,r){let n=i=>C(r,i.replace(/^~(?=[\\/]|$)/,fe())),s=[];if(e==="Grep"){let i=typeof t.path=="string"&&t.path?n(t.path):C(r);if(je(i)){let o=[t.pattern,t.glob,t.type].filter(a=>typeof a=="string").join(" ");s.push({roots:[i],bySecret:Me.test(o)||/\.env|env\b/i.test(String(t.glob??""))})}}else if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string")for(let i of t.command.split(/\|\||&&|[;|\n]/)){let o=i.trim().replace(/^(?:sudo\s+|xargs\s+(?:-\S+\s+)*)/i,"");if(!/^find\b.*-exec\s+(?:grep|egrep|rg|cat)\b/i.test(o)&&!(Dn.test(o)&&(wi.test(o)||/^(?:rg|ag|ack|git\s+grep)\b/i.test(o))))continue;let c=o.split(/\s+/).slice(1).map(u=>u.replace(/^['"]|['"]$/g,"")).filter(u=>u&&!u.startsWith("-")&&!/^\/[a-z]$/i.test(u)).map(n).filter(je);s.push({roots:c.length?c:[C(r)],bySecret:Me.test(o)||/\.env\b/i.test(o)})}for(let i of s)for(let o of i.roots){if(!i.bySecret&&Ii(o,r))continue;let a=Ai(o);if(a>0)return{why:i.bySecret?"by_name":"outside",root:o,keyFiles:a}}return null}var Ne=new Set(["Write","Edit","MultiEdit","NotebookEdit"]);function Ti(e,t,r){let n=s=>C(r,s.replace(/^~(?=[\\/]|$)/,fe()));if(e==="Read"&&typeof t.file_path=="string")return{action:"read",paths:[n(t.file_path)],roots:[]};if(Ne.has(e)){let s=typeof t.file_path=="string"?t.file_path:typeof t.notebook_path=="string"?t.notebook_path:"";return s?{action:"write",paths:[n(s)],roots:[]}:null}if(e==="Grep"){let s=typeof t.path=="string"&&t.path?n(t.path):C(r);return{action:"search",paths:[s],roots:je(s)?[s]:[]}}if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"){let s=t.command,o=[...[...s.matchAll(/"([^"]*)"/g)].map(c=>c[1]),...[...s.matchAll(/'([^']*)'/g)].map(c=>c[1]),...s.split(/[\s|;&<>(),=`]+/)].map(c=>c.trim()).filter(c=>c&&!c.startsWith("-")&&/[\\/.~]/.test(c)).map(n).filter(c=>$n(c)),a=s.split(/\|\||&&|[;|\n]/).some(c=>Dn.test(c.trim())||/^find\b/i.test(c.trim())),l=o.filter(je);return{action:a?"search":Ln.test(s.trim())?"read":"run",paths:[C(r),...o],roots:a?l.length?l:[C(r)]:[]}}return null}function Ri(e,t,r,n=new Date){let s=Ti(e,t,r);if(!s)return null;let{rules:i,tampered:o}=xn(),a=Sn();if(!i.length&&!a.length)return null;let l={allow:0,ask:1,clean_copy:2,deny:3},c=null;for(let d of s.paths){let p=yt(a,{action:s.action,path:d,now:n});p&&(!c||l[p.rule.effect]>l[c.rule.effect])&&(c={...p,org:!0})}for(let d of s.roots){let p=bt(a,d,s.action,n);p&&p.rule.effect!=="allow"&&(!c||l[p.rule.effect]>l[c.rule.effect])&&(c={...p,org:!0})}let u=Ci(i,o,s,n,l);return c&&(!u||l[c.rule.effect]>=l[u.rule.effect])?c:u}function Ci(e,t,r,n,s){if(!e.length)return null;if(t){for(let o of r.paths){let a=e.find(l=>U(l.path,o)||U(o,l.path));if(a)return{rule:{...a,effect:"deny",when:[]},n:e.indexOf(a)+1,touched:o,tampered:!0}}return null}let i=null;for(let o of r.paths){let a=yt(e,{action:r.action,path:o,now:n});a&&(!i||s[a.rule.effect]>s[i.rule.effect])&&(i=a)}for(let o of r.roots){let a=bt(e,o,r.action,n);a&&a.rule.effect!=="allow"&&(!i||s[a.rule.effect]>s[i.rule.effect])&&(i=a)}return i}function Pi(e){let t;try{t=typeof e=="string"?e:JSON.stringify(e??"")}catch{return{}}if(!t)return{};t=t.slice(0,2*1024*1024);let r={};for(let n of q()){let s=new RegExp(n.pattern.source,n.pattern.flags.includes("g")?n.pattern.flags:n.pattern.flags+"g"),i=(t.match(s)??[]).length;i&&(r[n.id]=(r[n.id]??0)+i)}return r}function Li(e){let t=Object.keys(e);if(t.length===0)return null;let r=t.reduce((s,i)=>s+e[i],0),n=[...new Set(t.map(s=>{let i=mt(s);return i.url?`${i.provider}: ${i.url}`:i.provider}))];return`NoData \xB7 A CREDENTIAL IS IN THIS OUTPUT (${r}: ${t.join(", ")}). It is now in this conversation and was sent to the AI model. Do not repeat, quote, shorten, mask-by-hand or reuse it \u2014 not in your answer, not in a command, not in a file. Tell the user in one line that a key was shown here and should be replaced at its provider (${n.join(" \xB7 ")}); nodata_scan_folder gives the full steps. Next time, run commands that need secrets through nodata_run: the output comes back with every value blanked.`+(K()==="he"?" Answer the user in Hebrew.":"")}function Di(e,t,r){let n=(e==="Bash"||e==="PowerShell")&&typeof t.command=="string"?t.command:"",s=e==="Grep"&&typeof t.path=="string"?t.path:e==="Read"&&typeof t.file_path=="string"?t.file_path:"";return n&&ui(n)||s&&pe(X(s)?s:C(r,s))||Cn(e,t,r).some(pe)?R("NoData \u05D7\u05E1\u05DD: \u05D6\u05D4 \u05E7\u05D5\u05D1\u05E5 \u05DE\u05E4\u05EA\u05D7 \u05E9\u05DC NoData (\u05DE\u05E4\u05EA\u05D7 \u05D4\u05DE\u05DB\u05E9\u05D9\u05E8, \u05D4\u05DB\u05E1\u05E4\u05EA \u05D0\u05D5 \u05D4\u05D0\u05E8\u05D2\u05D5\u05DF). \u05DE\u05D9 \u05E9\u05E7\u05D5\u05E8\u05D0 \u05D0\u05D5\u05EA\u05D5 \u05D9\u05DB\u05D5\u05DC \u05DC\u05E4\u05EA\u05D5\u05D7 \u05DB\u05DC \u05E7\u05D5\u05D1\u05E5 \u05E0\u05E2\u05D5\u05DC, \u05D5\u05DC\u05DB\u05DF \u05D0\u05E3 \u05E1\u05D5\u05DB\u05DF \u05DC\u05D0 \u05E7\u05D5\u05E8\u05D0 \u05D0\u05D5\u05EA\u05D5 \u2014 \u05D2\u05DD \u05DC\u05D0 \u05D1\u05D0\u05D9\u05E9\u05D5\u05E8. \u05DC-NoData \u05D0\u05D9\u05DF \u05E2\u05D5\u05EA\u05E7 \u05E9\u05DC \u05D4\u05DE\u05E4\u05EA\u05D7 \u05D5\u05D0\u05D9\u05DF \u05D3\u05E8\u05DA \u05DC\u05E9\u05D7\u05D6\u05E8 \u05D0\u05D5\u05EA\u05D5: \u05D4\u05D2\u05D9\u05D1\u05D5\u05D9 \u05E9\u05DC\u05DA \u05D4\u05D5\u05D0 \u05D4\u05D3\u05E8\u05DA \u05D4\u05D9\u05D7\u05D9\u05D3\u05D4. \u05DC\u05D2\u05D9\u05D1\u05D5\u05D9, \u05D1\u05D8\u05E8\u05DE\u05D9\u05E0\u05DC \u05D5\u05DC\u05D0 \u05D1\u05E6'\u05D0\u05D8: npx -y @nodatachat/mcp@latest key-backup E: (E: = \u05D4\u05D3\u05D9\u05E1\u05E7-\u05D0\u05D5\u05DF-\u05E7\u05D9).","NoData refused: this is one of NoData's own key files (the device key, the vault login or the org credential). Whoever reads it can open every sealed file, so no agent reads it \u2014 not even with approval. NoData holds no copy of this key and cannot recover it: your backup is the only recovery. To back it up, in a terminal (not the chat): npx -y @nodatachat/mcp@latest key-backup E: (E: = your USB drive). Do not suggest other recovery routes \u2014 there are none."):null}function Oi(e,t,r,n){let s=Di(e,t,r);if(s)return{decision:"deny",reason:s};let i=vi(e,t,r);if(i){let u=R(`NoData: \u05D4\u05E4\u05E7\u05D5\u05D3\u05D4 \u05D4\u05D6\u05D5 \u05DE\u05E6\u05D9\u05D2\u05D4 ${i}. \u05DE\u05D4 \u05E9\u05D4\u05D9\u05D0 \u05DE\u05D3\u05E4\u05D9\u05E1\u05D4 \u05E0\u05DB\u05E0\u05E1 \u05DC\u05E9\u05D9\u05D7\u05D4 \u05D5\u05E0\u05E9\u05DC\u05D7 \u05DC\u05DE\u05D5\u05D3\u05DC \u05D4\u05D1\u05D9\u05E0\u05D4 \u05D4\u05DE\u05DC\u05D0\u05DB\u05D5\u05EA\u05D9\u05EA, \u05D5\u05DE\u05E4\u05EA\u05D7 \u05E9\u05E0\u05E8\u05D0\u05D4 \u05DB\u05D0\u05DF \u05E6\u05E8\u05D9\u05DA \u05DC\u05D4\u05D7\u05DC\u05D9\u05E3.
|
|
39
|
-
\u05D1\u05DE\u05E7\u05D5\u05DD \u05D6\u05D4: \u05DC\u05D4\u05E8\u05D9\u05E5 \u05D0\u05D5\u05EA\u05D4 \u05D1\u05E2\u05E6\u05DE\u05DA \u05D1\u05D8\u05E8\u05DE\u05D9\u05E0\u05DC (\u05DC\u05D0 \u05D1\u05E6'\u05D0\u05D8), \u05D0\u05D5 nodata_run \u2014 \u05E9\u05DE\u05E8\u05D9\u05E5 \u05E4\u05E7\u05D5\u05D3\u05D4 \u05E2\u05DD \u05D4\u05E1\u05D5\u05D3\u05D5\u05EA \u05D5\u05DE\u05D7\u05D6\u05D9\u05E8 \u05D0\u05EA \u05D4\u05E4\u05DC\u05D8 \u05DB\u05E9\u05DB\u05DC \u05E2\u05E8\u05DA \u05DE\u05D5\u05E1\u05EA\u05E8.`+(n?"":" \u05DC\u05D0\u05E9\u05E8 \u05D1\u05DB\u05DC \u05D6\u05D0\u05EA?"),`NoData: this shows ${
|
|
40
|
-
Instead: run it yourself in a terminal (not the chat), or nodata_run \u2014 it runs a command with the secrets and returns the output with every value blanked.`+(n?"":" Allow anyway?"));return{decision:n?"deny":"ask",reason:
|
|
41
|
-
\u05D1\u05DE\u05E7\u05D5\u05DD \u05D6\u05D4: \u05DC\u05D7\u05E4\u05E9 \u05D1\u05EA\u05D5\u05DA \u05D4\u05E4\u05E8\u05D5\u05D9\u05E7\u05D8, \u05D0\u05D5 nodata_run \u05E2\u05DD \u05D4\u05DE\u05E4\u05EA\u05D7\u05D5\u05EA \u05DE\u05D4\u05DB\u05E1\u05E4\u05EA (\u05DB\u05DC \u05E4\u05E7\u05D5\u05D3\u05D4 \u05DE\u05D0\u05D5\u05E9\u05E8\u05EA \u05DB\u05DE\u05D5 \u05E9\u05D4\u05D9\u05D0).`+(n?"":" \u05DC\u05D0\u05E9\u05E8 \u05D1\u05DB\u05DC \u05D6\u05D0\u05EA?"),`NoData: this is ${
|
|
42
|
-
Instead: search inside the project, or nodata_run with the keys from the vault (each command approved as written).`+(n?"":" Allow anyway?"));return{decision:n?"deny":"ask",reason:
|
|
43
|
-
${
|
|
35
|
+
`),truncated:l,parts:o}}function sn(e,t,r={}){if(se(e)){let n=ot(e,G);return"text"in n?{ok:!0,result:{text:n.text,truncated:n.truncated,parts:n.parts,attachments:n.attachments}}:{ok:!1,reason:n.reason}}if(Le(e)){let n=at(e.toString("latin1"));if(!n.trim())return{ok:!1,reason:"no text inside (an empty file, or only pictures)"};let s=n.length>G;return{ok:!0,result:{text:s?n.slice(0,G):n,truncated:s,parts:["rtf"]}}}if(ct.has(t)||De.has(t)){let n=is(e,t);return n?{ok:!0,result:n}:{ok:!1,reason:"damaged, or not really an Office file"}}if(ve.has(t)){let n=Re(e,r);return n?{ok:!0,result:{text:n.text,truncated:n.truncated,parts:[`pdf:${n.engine}`],engine:n.engine,uncertain:n.uncertain}}:{ok:!1,reason:Zt(e)}}return lt.has(t)?{ok:!1,reason:"not a Word, Excel, PowerPoint or Outlook file inside, despite its name"}:{ok:!1,reason:"unsupported format"}}function dt(e,t,r={}){let n=sn(e,t,r);return n.ok?n.result:null}var ut=new Set([...ct,...De,...lt,...rn,...ve]);var Go=5*6e4,Vo=2*6e4;import{deflateRawSync as ls}from"node:zlib";var on={israeli_id:"[ID]",credit_card:"[CARD]",iban:"[IBAN]",israeli_phone:"[PHONE]",email:"[EMAIL]"},os=/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g,as=[...Dt].sort((e,t)=>+(t.subkind==="iban")-+(e.subkind==="iban"));function le(e,t,r=1){e[t]=(e[t]??0)+r}var an=null,de=e=>{let t=e.trim();an&&t&&an.add(t)};function O(e,t={}){let r=e;for(let n of ee()){let s=new RegExp(n.pattern.source,n.pattern.flags.includes("g")?n.pattern.flags:n.pattern.flags+"g");r=r.replace(s,i=>(le(t,"secret"),de(i),"[SECRET]"))}for(let n of as)n.pattern.lastIndex=0,r=r.replace(n.pattern,s=>n.validate(s)?(le(t,n.subkind),de(s),on[n.subkind]??`[${n.subkind.toUpperCase()}]`):s);r=r.replace(os,n=>(le(t,"email"),de(n),on.email));for(let n of qe()){let s=n.find(r).sort((i,o)=>o.start-i.start);for(let i of s)de(r.slice(i.start,i.end)),r=r.slice(0,i.start)+`[${n.kind.toUpperCase()}]`+r.slice(i.end),le(t,n.kind)}return{text:r,counts:t,columnsHidden:[]}}function pt(){let e=new Map,t={};return(r,n)=>{de(n);let s=`${r}\0${n.trim()}`,i=e.get(s);return i===void 0&&(i=t[r]=(t[r]??0)+1,e.set(s,i)),`[${r.toUpperCase()}-${i}]`}}function ft(e){let t=e.trim();return/^\[[A-Z_]+(?:-\d+)?\]$/.test(t)||/^[\d]{0,4}[*•xX]{3,}[\d]{0,4}$/.test(t)}var ln=/^\s*-?\d+(?:\.\d+)?\s*$/;function ht(e){let t=new Set;for(let[r,n]of e){let s=n.filter(o=>ln.test(o));if(s.length<3)continue;s.filter(o=>O(o).text!==o).length/s.length<.5&&t.add(r)}return t}function cn(e,t){return e.includes(t)||e.includes('"')||e.includes(`
|
|
36
|
+
`)?`"${e.replace(/"/g,'""')}"`:e}function cs(e){let t=(e.match(/\t/g)??[]).length,r=(e.match(/;/g)??[]).length,n=(e.match(/,/g)??[]).length;return t>n&&t>=r?" ":r>n?";":","}function mt(e,t){let r=e.split(/\r?\n/),n=t??cs(r[0]??""),s=we(r[0]??"",n),i=s.map(f=>te(f)),o={},a=pt(),l=r.slice(1).map(f=>f===""?null:we(f,n)),c=new Map;for(let f of l)f?.forEach((m,h)=>c.set(h,[...c.get(h)??[],m]));let u=ht(c),d=Q();if(d){let f=l.filter(m=>m!==null).slice(0,200);for(let m of d({name:"table",headers:s,rows:f})){let h=s.indexOf(m.column);h>=0&&!(m.how==="header"&&u.has(h))&&(i[h]={type:m.type,label:m.category})}}let p=[s.map(f=>cn(f,n)).join(n)];for(let f of l){if(f===null){p.push("");continue}let m=f.map((h,k)=>{let g=i[k];return g&&h.trim()!==""&&!ft(h)?(le(o,`column:${g.type}`),a(g.type,h)):u.has(k)&&ln.test(h)?h:O(h,o).text});p.push(m.map(h=>cn(h,n)).join(n))}return{text:p.join(`
|
|
37
|
+
`),counts:o,columnsHidden:s.filter((f,m)=>i[m])}}var ds=/^xl\/(pivotCache|charts|externalLinks)\//,pn=10;function us(e,t,r=1){e[t]=(e[t]??0)+r}function fn(e){return e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""")}function hn(e){let t=e.replace(/<rPh\b[\s\S]*?<\/rPh>/g,""),r="";for(let n of t.matchAll(/<t(?:\s[^>]*)?>([\s\S]*?)<\/t>/g))r+=n[1];return j(r)}function ps(e){return e?[...e.matchAll(/<si\b[^>]*>([\s\S]*?)<\/si>|<si\b[^>]*\/>/g)].map(t=>hn(t[1]??"")):[]}var mn=/<c\b([^>]*?)(?:\/>|>([\s\S]*?)<\/c>)/g;function Oe(e,t){let r=new RegExp(`\\b${t}="([^"]*)"`).exec(e);return r?r[1]:null}function V(e,t){if(e.type==="s"){let n=/<v>([^<]*)<\/v>/.exec(e.inner);return n?t[Number(n[1])]??null:null}if(e.type==="inlineStr"){let n=/<is>([\s\S]*?)<\/is>/.exec(e.inner);return n?hn(n[1]):null}if(e.type==="b"||e.type==="e")return null;let r=/<v>([^<]*)<\/v>/.exec(e.inner);return r?j(r[1]):null}function fs(e){let t=[];for(let r of e.matchAll(mn)){let n=Oe(r[1],"r"),s=n?/^([A-Z]+)(\d+)$/.exec(n):null;if(!s)return null;t.push({full:r[0],attrs:r[1],inner:r[2]??"",col:s[1],row:Number(s[2]),type:Oe(r[1],"t")??"n"})}return t}function hs(e,t){let r=[...new Set(e.map(n=>n.row))].sort((n,s)=>n-s).slice(0,pn);for(let n of r){let s=new Map;for(let i of e.filter(o=>o.row===n)){let o=V(i,t),a=o?te(o):null;a&&s.set(i.col,{type:a.type,header:o.trim()})}if(s.size>0)return{row:n,cols:s}}return{row:-1,cols:new Map}}var ms=/^xl\/worksheets\/sheet\d+\.xml$/,gs=200;function ys(e){let t=e.trim();return/^[\d.,\-+/:%$₪€\s]+$/.test(t)||t.length>60}function bs(e,t){let r=[...new Set(e.map(i=>i.row))].sort((i,o)=>i-o).slice(0,pn),n=-1,s=-1/0;for(let i of r){let o=e.filter(c=>c.row===i).map(c=>(V(c,t)??"").trim()).filter(Boolean);if(o.length<2)continue;let a=o.filter(c=>!ys(c)).length,l=a*2-(o.length-a);l>s&&(s=l,n=i)}return n}function _s(e,t,r){let n=hs(t,r),s=Q();if(!s)return n;let i=n.row>=0?n.row:bs(t,r);if(i<0)return n;let o=t.filter(d=>d.row===i).map(d=>({col:d.col,text:(V(d,r)??"").trim()})).filter(d=>d.text),a=new Map(o.map((d,p)=>[d.col,p])),l=new Map;for(let d of t){if(d.row<=i)continue;let p=a.get(d.col);if(p!==void 0){if(!l.has(d.row)){if(l.size>=gs)continue;l.set(d.row,o.map(()=>""))}l.get(d.row)[p]=V(d,r)??""}}let c=new Map(i===n.row?n.cols:[]),u=o.map(d=>d.text);for(let d of s({name:e,headers:u,rows:[...l.values()]})){let p=u.indexOf(d.column);p<0||c.set(o[p].col,{type:d.type,header:d.column,category:d.category,severity:d.severity,how:d.how})}return{row:i,cols:c}}function dn(e,t){return`<c${e.replace(/\s*\bt="[^"]*"/,"")} t="inlineStr"><is><t xml:space="preserve">${fn(t)}</t></is></c>`}var ks=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t+=1){let r=t;for(let n=0;n<8;n+=1)r=r&1?3988292384^r>>>1:r>>>1;e[t]=r>>>0}return e})();function xs(e){let t=4294967295;for(let r=0;r<e.length;r+=1)t=ks[(t^e[r])&255]^t>>>8;return(t^4294967295)>>>0}var un=33;function gn(e){let t=[],r=[],n=0;for(let o of e){let a=Buffer.from(o.name,"utf8"),l=o.name.endsWith("/"),c=l?Buffer.alloc(0):ls(o.data),u=l?0:8,d=l?0:xs(o.data),p=Buffer.alloc(30);p.writeUInt32LE(67324752,0),p.writeUInt16LE(20,4),p.writeUInt16LE(2048,6),p.writeUInt16LE(u,8),p.writeUInt16LE(un,12),p.writeUInt32LE(d,14),p.writeUInt32LE(c.length,18),p.writeUInt32LE(o.data.length,22),p.writeUInt16LE(a.length,26),t.push(p,a,c);let f=Buffer.alloc(46);f.writeUInt32LE(33639248,0),f.writeUInt16LE(20,4),f.writeUInt16LE(20,6),f.writeUInt16LE(2048,8),f.writeUInt16LE(u,10),f.writeUInt16LE(un,14),f.writeUInt32LE(d,16),f.writeUInt32LE(c.length,20),f.writeUInt32LE(o.data.length,24),f.writeUInt16LE(a.length,28),f.writeUInt32LE(n,42),r.push(f,a),n+=p.length+a.length+c.length}let s=Buffer.concat(r),i=Buffer.alloc(22);return i.writeUInt32LE(101010256,0),i.writeUInt16LE(e.length,8),i.writeUInt16LE(e.length,10),i.writeUInt32LE(s.length,12),i.writeUInt32LE(n,16),Buffer.concat([...t,s,i])}function gt(e){let t=ae(e);if(!t||t.length===0||t.some(h=>ds.test(h.name)))return null;let r=new Map;for(let h of t){if(h.name.endsWith("/")){r.set(h.name,Buffer.alloc(0));continue}let k=ce(e,h);if(!k)return null;r.set(h.name,k)}let n=[...r.keys()].filter(h=>ms.test(h));if(n.length===0)return null;let s=r.get("xl/sharedStrings.xml")?.toString("utf8")??null,i=ps(s),o=new Set,a={},l=new Set,c=pt();for(let h of n){let k=r.get(h).toString("utf8"),g=fs(k);if(!g)return null;let x=_s(h.replace(/^xl\/worksheets\//,"").replace(/\.xml$/,""),g,i),_=x.row,A=new Map;for(let T of g){if(T.type!=="n"||T.row<=_)continue;let R=V(T,i);R!==null&&A.set(T.col,[...A.get(T.col)??[],R])}let P=ht(A),F=new Map;for(let[T,{type:R,header:M,how:be}]of x.cols)be==="header"&&P.has(T)||(F.set(T,R),l.add(M));let ye=k.replace(mn,(T,R,M)=>{let be=Oe(R,"r"),[,H,_e]=/^([A-Z]+)(\d+)$/.exec(be),D={full:T,attrs:R,inner:M??"",col:H,row:Number(_e),type:Oe(R,"t")??"n"},y=V(D,i),b=()=>{if(D.type==="s"){let w=/<v>([^<]*)<\/v>/.exec(D.inner);w&&o.add(Number(w[1]))}return T};if(y===null||y.trim()==="")return b();let S=F.get(H);if(S&&D.row>_&&!ft(y))return us(a,`column:${S}`),dn(R,c(S,y));if(D.type==="n"&&P.has(H))return b();let E=O(y,a);return E.text===y?b():dn(R,E.text)});r.set(h,Buffer.from(ye,"utf8"))}if(s){let h=-1,k=s.replace(/<si\b[^>]*>[\s\S]*?<\/si>|<si\b[^>]*\/>/g,g=>(h+=1,o.has(h)?g:"<si><t></t></si>"));r.set("xl/sharedStrings.xml",Buffer.from(k,"utf8"))}for(let h of[...r.keys()].filter(k=>/^xl\/comments\d*\.xml$/.test(k))){let g=r.get(h).toString("utf8").replace(/(<t(?:\s[^>]*)?>)([\s\S]*?)(<\/t>)/g,(x,_,A,P)=>{let F=O(j(A),a);return`${_}${fn(F.text)}${P}`});r.set(h,Buffer.from(g,"utf8"))}let u=r.get("docProps/core.xml");if(u){let h=u.toString("utf8").replace(/(<dc:creator>)[\s\S]*?(<\/dc:creator>)/,"$1$2").replace(/(<cp:lastModifiedBy>)[\s\S]*?(<\/cp:lastModifiedBy>)/,"$1$2");r.set("docProps/core.xml",Buffer.from(h,"utf8"))}let d=r.get("xl/workbook.xml");if(d){let h=d.toString("utf8").replace(/<(\w+:)?absPath\b[^>]*\/>|<(\w+:)?absPath\b[^>]*>[\s\S]*?<\/(\w+:)?absPath>/g,"");r.set("xl/workbook.xml",Buffer.from(h,"utf8"))}let p=r.get("docProps/app.xml");if(p){let h=p.toString("utf8").replace(/(<Company>)[\s\S]*?(<\/Company>)/,"$1$2").replace(/(<Manager>)[\s\S]*?(<\/Manager>)/,"$1$2");r.set("docProps/app.xml",Buffer.from(h,"utf8"))}let f=r.has("xl/calcChain.xml"),m=t.map(h=>h.name).filter(h=>!(f&&h==="xl/calcChain.xml"));if(f)for(let h of["[Content_Types].xml","xl/_rels/workbook.xml.rels"]){let k=r.get(h);k&&r.set(h,Buffer.from(k.toString("utf8").replace(/<(Override|Relationship)\b[^>]*calcChain[^>]*\/>/g,""),"utf8"))}return{bytes:gn(m.map(h=>({name:h,data:r.get(h)}))),counts:a,columnsHidden:[...l]}}var K=/(^|\/)(\.env(\.[\w.-]+)?|[\w.-]+\.env(\.[\w.-]+)?)$/i,ws=/(SECRET|PASSWORD|PASSWD|PASS|PWD|TOKEN|PRIVATE|CREDENTIAL|API_?KEY|_KEY|KEY_ID|DSN|DATABASE_URL|_URI|POOLER_URL|SALT|PEPPER)$/i,vs=/(^NEXT_PUBLIC_|^VITE_|^EXPO_PUBLIC_|ANON_KEY$|PUBLISHABLE_KEY$|PUBLIC_KEY$)/i;function yt(e){let t=0;for(let r of e.split(/\r?\n/)){let n=/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(r);if(!n||!ws.test(n[1])||vs.test(n[1]))continue;let s=n[2].trim().replace(/^(['"])(.*)\1$/,"$2");s.length>=8&&!/^\$\{?[A-Z_]+\}?$/.test(s)&&t++}return t}var Ta=64*1024*1024,Ra=4*1024*1024;var Ca=512*1024*1024,Pa=1024*1024*1024;var La=256*1024*1024;var Da=new yn("utf-8",{fatal:!0}),Oa=new yn("windows-1255");var Na=new Set([".cache",".cargo",".rustup",".npm",".pnpm-store",".yarn",".gradle",".m2",".nuget",".conda",".pyenv",".rbenv",".nvm",".volta",".bun",".deno",".docker",".android",".vscode-server",".agents",".agent",".codeium",".continue","antigravity",".antigravity","__pycache__",".venv","venv","site-packages",".next",".turbo",".expo",".nx",".parcel-cache",".svelte-kit","appdata",".trash","$recycle.bin"].map(e=>e.toLowerCase()));var Os=["Put the new key where the app reads it (for a developer machine: the NoData vault + nodata_run, not a .env file).","Check that the app still works with the new key.","Only then delete / revoke the OLD key \u2014 until you do, whoever copied it can still use it."],v=(e,t,r)=>({provider:e,url:t,steps:[...r,...Os]}),Ns={"aws-access-key":v("AWS","https://console.aws.amazon.com/iam/home#/security_credentials",["Open IAM \u2192 your user \u2192 Security credentials.","Create a NEW access key (you see its secret once \u2014 keep it only in the vault)."]),"aws-secret-key":v("AWS","https://console.aws.amazon.com/iam/home#/security_credentials",["Open IAM \u2192 your user \u2192 Security credentials.","Create a NEW access key (you see its secret once \u2014 keep it only in the vault).","Mark the old key Inactive before deleting it."]),"gcp-api-key":v("Google Cloud","https://console.cloud.google.com/apis/credentials",["Open APIs & Services \u2192 Credentials.","Pick the key \u2192 Regenerate key (or create a new one and restrict it to the APIs you use)."]),"gcp-service-account":v("Google Cloud (service account)","https://console.cloud.google.com/iam-admin/serviceaccounts",["Open IAM & Admin \u2192 Service accounts \u2192 the account \u2192 Keys.","Add key \u2192 Create new key (JSON). Keep the file out of Git and out of shared folders."]),"firebase-key":v("Firebase / Google Cloud","https://console.cloud.google.com/apis/credentials",["A Firebase web key is meant to be public \u2014 restrict it instead: Credentials \u2192 the key \u2192 Application restrictions (your domains only).","If it is not a web key, regenerate it."]),"github-token":v("GitHub","https://github.com/settings/tokens",["Open Settings \u2192 Developer settings \u2192 Personal access tokens.","Generate a new token with only the scopes you need."]),"github-fine-grained":v("GitHub","https://github.com/settings/tokens?type=beta",["Open Fine-grained tokens.","Regenerate the token (or create a new one for only the repositories you need)."]),"gitlab-token":v("GitLab","https://gitlab.com/-/user_settings/personal_access_tokens",["Open Access tokens.","Create a new token with only the scopes you need."]),"stripe-secret":v("Stripe","https://dashboard.stripe.com/apikeys",["Open Developers \u2192 API keys.","Roll the secret key (Stripe can keep the old one alive for a short overlap)."]),"stripe-restricted":v("Stripe","https://dashboard.stripe.com/apikeys",["Open Developers \u2192 API keys \u2192 Restricted keys.","Roll the key, or create a new restricted key."]),"slack-token":v("Slack","https://api.slack.com/apps",["Open your app \u2192 OAuth & Permissions.","Rotate / reinstall to get a new token."]),"slack-webhook":v("Slack","https://api.slack.com/apps",["Open your app \u2192 Incoming Webhooks.","Add a new webhook URL for the channel."]),"twilio-api-key":v("Twilio","https://console.twilio.com/us1/account/keys-credentials/api-keys",["Open Account \u2192 API keys & tokens.","Create a new API key."]),"sendgrid-api-key":v("SendGrid","https://app.sendgrid.com/settings/api_keys",["Open Settings \u2192 API Keys.","Create a new key with only the permissions you need."]),"openai-key":v("OpenAI","https://platform.openai.com/api-keys",["Open API keys.","Create a new secret key."]),"openai-project-key":v("OpenAI","https://platform.openai.com/api-keys",["Open API keys (per project).","Create a new secret key for the same project."]),"anthropic-key":v("Anthropic","https://console.anthropic.com/settings/keys",["Open Settings \u2192 API keys.","Create a new key."]),"supabase-key":v("Supabase","https://supabase.com/dashboard/project/_/settings/api-keys",["Open the project \u2192 Project Settings \u2192 API Keys.","Create a new SECRET key (a service_role / secret key bypasses every database rule \u2014 treat it like a root password).","Older projects with JWT keys: rotating the JWT secret replaces every key and signs everyone out \u2014 plan it."]),"supabase-access-token":v("Supabase (personal access token \u2014 reaches every project of the account)","https://supabase.com/dashboard/account/tokens",["Open Account \u2192 Access Tokens.","Revoke this token, then generate a new one only where it is needed (CLI, MCP) \u2014 prefer a read-only MCP."]),"supabase-secret-key":v("Supabase","https://supabase.com/dashboard/project/_/settings/api-keys",["Open the project \u2192 Project Settings \u2192 API Keys.","Create a new secret key, switch your servers to it, then delete this one."]),"postgres-uri":v("PostgreSQL (the password in the connection string)","https://supabase.com/dashboard/project/_/settings/database",["Change the database user's password: in Supabase \u2192 Project Settings \u2192 Database \u2192 Reset password; elsewhere, your host's console or ALTER USER \u2026 WITH PASSWORD.","Update the connection string with the new password."]),"mongodb-uri":v("MongoDB","https://cloud.mongodb.com/",["Open Atlas \u2192 Database Access \u2192 the user \u2192 Edit \u2192 Edit password.","Update the connection string."]),"redis-uri":v("Redis","",["Reset the password in your Redis host's console (or CONFIG SET requirepass on your own server).","Update the connection string."]),"private-key":v("Private key (SSH / TLS / signing)","",["Generate a new key pair.","Register the new PUBLIC key where the old one was trusted (server authorized_keys, certificate, service settings)."]),"jwt-secret":v("Your app's JWT secret","",["Set a new long random secret in the app's configuration.","Every signed-in user will be signed out \u2014 plan the moment."]),"password-in-code":v("A password in code","",["Change the password in the system it belongs to."]),"bearer-token":v("An access token","",["Revoke the token in the service that issued it and issue a new one."])},Fs=v("A credential","",["Find the service it belongs to and issue a new credential there."]);function bt(e){return Ns[e]??Fs}function kn(e){return/\.ndc$/i.test(e)||/\.clean\.[A-Za-z0-9]+$/.test(e)||Ms(e)}function Ms(e){return/(^|[\\/])\.nodata[\\/]/.test(e)}import{existsSync as Hs,mkdirSync as Lc,readFileSync as js,statSync as _t,writeFileSync as Dc}from"node:fs";import{homedir as Us}from"node:os";import{join as zs}from"node:path";var Bs=()=>zs(Us(),".nodata","flagged.json");var xn="unread";function wn(e){let t=e.replace(/\\/g,"/");return process.platform==="win32"?t.toLowerCase():t}var ue=null;function vn(){let e=Bs();try{if(!Hs(e))return{};let t=_t(e).mtimeMs;if(ue&&ue.path===e&&ue.mtimeMs===t)return ue.store;let r=JSON.parse(js(e,"utf8"));return ue={path:e,mtimeMs:t,store:r},r}catch{return{}}}function Ne(e){let t=vn()[wn(e)];if(!t)return null;try{if(_t(e).mtimeMs>t.mtimeMs+1e3)return null}catch{return null}let r=Object.fromEntries(Object.entries(t.kinds).filter(([n])=>n!==xn));return Object.keys(r).length?r:null}function Fe(e){let t=vn()[wn(e)];if(!t||!t.kinds[xn])return null;try{return{changed:_t(e).mtimeMs>t.mtimeMs+1e3}}catch{return null}}import{existsSync as Ws,mkdirSync as Hc,readFileSync as Gs,writeFileSync as jc}from"node:fs";import{homedir as Vs}from"node:os";import{join as Ks}from"node:path";var Sn=()=>Ks(Vs(),".nodata","prefs.json");function Zs(){try{let e=Ws(Sn())?JSON.parse(Gs(Sn(),"utf8")).lang:null;return e==="he"||e==="en"?e:null}catch{return null}}function Xs(){let t=process.env.LC_ALL||process.env.LC_MESSAGES||process.env.LANG||"";try{t||=Intl.DateTimeFormat().resolvedOptions().locale}catch{}return/^(he|iw)(?:[-_.@]|$)/i.test(t)?"he":"en"}function Z(){return Zs()??Xs()}function $(e,t,r=Z()){return r==="he"?e:t}import{createHmac as qs,randomBytes as Ys}from"node:crypto";import{existsSync as He,mkdirSync as Qs,readdirSync as ei,readFileSync as kt,writeFileSync as ti}from"node:fs";import{homedir as fe}from"node:os";import{basename as ni,extname as ri,isAbsolute as si,join as he,relative as ii,resolve as oi}from"node:path";function U(e){return typeof e=="number"&&Number.isFinite(e)?e:typeof e=="string"&&e.trim()!==""&&!Number.isNaN(Number(e))?Number(e):null}function Js(e,t,r){return t===null||r===null?!1:t<=r?e>=t&&e<=r:e>=t||e<=r}function En(e,t,r){switch(t){case"eq":return e===r;case"ne":return e!==r;case"in":return Array.isArray(r)&&r.includes(e);case"not_in":return Array.isArray(r)&&!r.includes(e);case"prefix":return typeof e=="string"&&typeof r=="string"&&e.toLowerCase().startsWith(r.toLowerCase());case"gte":{let n=U(e),s=U(r);return n!==null&&s!==null&&n>=s}case"lte":{let n=U(e),s=U(r);return n!==null&&s!==null&&n<=s}case"between":{let n=U(e);return n!==null&&Array.isArray(r)&&r.length===2&&Js(n,U(r[0]),U(r[1]))}default:return!1}}function An(e,t,r){switch(t){case"in":return Array.isArray(r)&&e.some(n=>r.includes(n));case"not_in":return Array.isArray(r)&&!e.some(n=>r.includes(n));default:return!1}}var In=()=>he(fe(),".nodata","rules.json"),Me=()=>he(fe(),".nodata","rules-key"),$n={allow:0,ask:1,clean_copy:2,deny:3},ai=["claude-code","cursor","windsurf","codex","gemini","vscode","claude-desktop"],Tn=e=>typeof e=="string"&&e.trim()?e.trim().toLowerCase():void 0,ci={action:{cardinality:"scalar",ops:["eq","ne","in","not_in"],enumValues:["read","search","run","write"],label:"what the agent does (read, search, run, write)",extract:e=>e.action},"time.hour":{cardinality:"scalar",ops:["between","gte","lte","eq"],label:"hour on this computer (0-23; 18..6 wraps overnight)",extract:e=>e.now.getHours()},"time.weekday":{cardinality:"scalar",ops:["in","not_in","between","eq"],label:"weekday on this computer (0 Sunday \u2026 6 Saturday)",extract:e=>e.now.getDay()},"file.ext":{cardinality:"scalar",ops:["eq","ne","in","not_in"],label:"file type (.xlsx, .pdf, .env \u2026)",extract:e=>ri(e.path).toLowerCase()||void 0},"file.name":{cardinality:"scalar",ops:["eq","in","prefix"],label:"file name",extract:e=>ni(e.path).toLowerCase()},agent:{cardinality:"scalar",ops:["eq","ne","in","not_in"],agentScope:!0,label:`which agent (${ai.join(", ")} \u2026)`,extract:e=>Tn(e.who?.host)},"agent.type":{cardinality:"scalar",ops:["eq","ne","in","not_in"],agentScope:!0,label:"sub-agent type inside the agent (main = the main conversation; general-purpose, explore \u2026)",extract:e=>Tn(e.who?.type)}};function li(){try{if(He(Me())){let t=kt(Me(),"utf8").trim();if(/^[0-9a-f]{64}$/.test(t))return Buffer.from(t,"hex")}}catch{}let e=Ys(32);return Qs(he(fe(),".nodata"),{recursive:!0}),ti(Me(),e.toString("hex")+`
|
|
38
|
+
`,{mode:384}),e}var di=(e,t)=>qs("sha256",t).update(JSON.stringify(e)).digest("hex");function Rn(){if(!He(In()))return{rules:[],tampered:!1};try{let e=JSON.parse(kt(In(),"utf8")),t=Array.isArray(e.rules)?e.rules:[],r=He(Me())&&typeof e.mac=="string"&&e.mac===di(t,li());return{rules:t,tampered:!r}}catch{return{rules:[],tampered:!0}}}var pe=e=>{let t=oi(e.replace(/^~(?=[\\/]|$)/,fe())).replace(/\\/g,"/");return process.platform==="win32"?t.toLowerCase():t};function z(e,t){if(e.startsWith("**/")){let n=e.slice(3).replace(/\\/g,"/").replace(/\/+$/,"").toLowerCase(),s=pe(t).toLowerCase();return s.endsWith("/"+n)||s.includes("/"+n+"/")}let r=ii(pe(e),pe(t));return r===""||!r.startsWith("..")&&!si(r)}function Cn(e,t,r){let n=ci[e.field];if(!n)return!1;let s=n.extract(t);return n.agentScope&&s===void 0?r!=="allow":e.op==="exists"?s!==void 0&&s!=="":s===void 0?!1:n.cardinality==="set"?An(Array.isArray(s)?s:[],e.op,e.value):En(s,e.op,e.value)}function xt(e,t){let r=e.map((n,s)=>({rule:n,n:s+1})).filter(n=>z(n.rule.path,t.path)).sort((n,s)=>pe(s.rule.path).length-pe(n.rule.path).length||n.n-s.n);for(let n of r)if((n.rule.when??[]).every(s=>Cn(s,t,n.rule.effect)))return{...n,touched:t.path};return null}function wt(e,t,r,n,s){let i=null;for(let[o,a]of e.entries())z(a.path,t)||(a.path.startsWith("**/")?!ui(t,a.path):!z(t,a.path))||(a.when??[]).every(l=>Cn(l,{action:r,path:a.path,now:n,who:s},a.effect))&&(!i||$n[a.effect]>$n[i.rule.effect])&&(i={rule:a,n:o+1,touched:a.path});return i}function ui(e,t){let r=0,n=(s,i)=>{if(i>5||r>4e3)return!1;let o;try{o=ei(s,{withFileTypes:!0})}catch{return!1}for(let a of o){if(++r>4e3||!a.isDirectory()||a.name==="node_modules"||a.name===".git")continue;let l=he(s,a.name);if(z(t,l)||n(l,i+1))return!0}return!1};return n(e,0)}var pi={allow:["allowed","\u05DE\u05D5\u05EA\u05E8"],ask:["ask the person","\u05DC\u05E9\u05D0\u05D5\u05DC \u05D0\u05D5\u05EA\u05DA"],clean_copy:["clean copy only","\u05E8\u05E7 \u05E2\u05D5\u05EA\u05E7 \u05E0\u05E7\u05D9"],deny:["not allowed","\u05D0\u05E1\u05D5\u05E8"]};var Pn=(e,t=!1)=>pi[e][t?1:0];function Ln(){try{let e=he(fe(),".nodata","org-mandate.json");if(!He(e))return[];let t=JSON.parse(kt(e,"utf8"));return Array.isArray(t.folder_rules)?t.folder_rules:[]}catch{return[]}}var bi=new Set([".csv",".tsv",".txt",".md",".json",".log",".xml",".sql",".yaml",".yml",".eml",...ut]),_i=50*1024*1024,Dn=8,ki={israeli_id:"Israeli ID",credit_card:"card",iban:"IBAN",israeli_phone:"phone",email:"email",secret:"secret"};function $t(e){let t=It(e).toLowerCase();return bi.has(Hn(t))||K.test(t)}var xi=/^(reports|receipts)(\/|$)|^(prefs|consent|flagged|statusline-prev|key-backup|connection)\.json$|^(gate|status)\.mjs$|^(gate|answers)\.log$/i,wi=/\.nodata[\\/]+(device-key\.json|secrets\.json|credentials\.json|issuer-ed25519\.json|capsule\.json|capsule-key|shares|approvals|fabric-key\.json|machine-salt|pending-link\.json|api-shares\.json|secret-shares\.json|quarantine)\b/i;function X(e){let t=je(J(),".nodata").replace(/\\/g,"/").toLowerCase();if(!e.replace(/\\/g,"/").toLowerCase().startsWith(t+"/"))return!1;let n=e.replace(/\\/g,"/").slice(t.length+1);return n!==""&&!xi.test(n)}function vi(e){return wi.test(e)}var Y=e=>e.startsWith("mcp__"),jn=e=>/^mcp__.+__nodata_[a-z0-9_]+$/i.test(e),Si=/(path|file|dir|folder|root|uri|target|source|destination|cwd)/i,Ei=/(write|edit|create|save|update|delete|remove|move|rename|append|put|upload|patch|insert|mkdir)/i,Ai=/(search|grep|find|glob|list|tree|director|query)/i,On=16;function Be(e){let t=e.split("__").slice(2).join("__");return Ei.test(t)?"write":Ai.test(t)?"search":"read"}function ge(e,t){let r=[],n=(i,o)=>{let a=i.trim();if(/^file:\/\//i.test(a))try{a=decodeURIComponent(new URL(a).pathname).replace(/^\/([a-zA-Z]:)/,"$1")}catch{return}else if(!(o||/^(~[\\/]|\/|[a-zA-Z]:[\\/])/.test(a)))return;if(!a||a.length>1024||/[\n\r]/.test(a)||/^[a-z][a-z0-9+.-]*:\/\//i.test(a))return;let l=C(t,a.replace(/^~(?=[\\/]|$)/,J()));!r.includes(l)&&r.length<On&&r.push(l)},s=(i,o,a)=>{if(!(a>3||r.length>=On)){if(typeof i=="string")n(i,Si.test(o));else if(Array.isArray(i))for(let l of i.slice(0,50))s(l,o,a+1);else if(i&&typeof i=="object")for(let[l,c]of Object.entries(i))s(c,l,a+1)}};return s(e,"",0),r}var vt=/(\.claude[\\/]+settings(\.local)?\.json|node_modules[\\/]+@nodatachat[\\/])/i,Ii=/(>|\bsed\s+-i|\btee\b|\b(rm|del|erase|mv|move|cp|copy|ren|rename)\b|Set-Content|Add-Content|Out-File|Remove-Item|Move-Item|Copy-Item|Rename-Item|WriteAllText|writeFileSync|unlinkSync)/i;function $i(e,t,r){if(e==="Bash"||e==="PowerShell"){let s=typeof t.command=="string"?t.command:"";return vt.test(s)&&Ii.test(s)}if(Y(e))return Be(e)==="write"&&ge(t,r).some(s=>vt.test(s.replace(/\\/g,"/")));let n=typeof t.file_path=="string"?t.file_path:typeof t.notebook_path=="string"?t.notebook_path:"";return n?vt.test((q(n)?n:C(r,n)).replace(/\\/g,"/")):!1}function Ti(e){return $t(e)||Ne(e)!==null||Fe(e)!==null}var Ue=class extends Error{};function Ri(e){let t=Hn(e).toLowerCase(),r=gi(e),n,s;if(t===".csv"||t===".tsv")s=r.toString("utf8"),n=mt(s,t===".tsv"?" ":void 0).counts;else if(ut.has(t)){let o=t===".xlsx"||t===".xlsm"?gt(r):null,a=dt(r,t);if(!a&&!o)throw new Ue;s=a?.text??"",n=o?o.counts:O(s).counts}else s=r.toString("utf8"),n=O(s).counts;let i=xe.filter(o=>o.pattern.test(s)).length;return K.test(It(e).toLowerCase())&&(i=Math.max(i,yt(s))),i&&(n.secret=Math.max(n.secret??0,i)),n}var Ci={israeli_id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",credit_card:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9",iban:"IBAN",israeli_phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",email:'\u05D3\u05D5\u05D0"\u05DC',secret:"\u05E1\u05D5\u05D3",name:"\u05E9\u05DD",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",financial:"\u05DE\u05D9\u05D3\u05E2 \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",bank_account:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7",plate:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"};function Un(e){let t=Z()==="he",r=n=>(t?Ci[n]:ki[n])??n;return Object.entries(e).sort((n,s)=>s[1]-n[1]).map(([n,s])=>`${s} ${n.startsWith("column:")?`${r(n.slice(7))} (${t?"\u05E2\u05DE\u05D5\u05D3\u05D4":"column"})`:r(n)}`).join(", ")}function Pi(e){return Un(e)}function zn(e,t,r){let n=i=>q(i)?i:C(r,i),s=i=>{try{return At(i).isFile()}catch{return!1}};if(e==="Read"&&typeof t.file_path=="string")return[n(t.file_path)];if(e==="Grep"&&typeof t.path=="string"&&s(n(t.path)))return[n(t.path)];if(Y(e))return Be(e)==="write"?[]:ge(t,r).filter(s).slice(0,Dn);if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"){let i=t.command,o=[...[...i.matchAll(/"([^"]*)"/g)].map(l=>l[1]),...[...i.matchAll(/'([^']*)'/g)].map(l=>l[1]),...i.split(/[\s|;&<>(),=`]+/)],a=[];for(let l of o){let c=l.trim().replace(/^['"]|['"]$/g,"").replace(/\\\\/g,"\\").replace(/^~(?=[\\/])/,J()).replace(/^\/([a-zA-Z])\//,(d,p)=>process.platform==="win32"?`${p}:/`:d);if(!c)continue;let u=n(c);if(!(!$t(c)&&!X(u)&&Ne(u)===null&&Fe(u)===null)&&(s(u)&&!a.includes(u)&&a.push(u),a.length>=Dn))break}return a}return[]}function N(e){return e.replace(/\\+/g,"/")}function Li(e){let t=e.trim();return/[;|&\n]|`|\$\(/.test(t.replace(/^cmd(?:\.exe)?\s+\/c\s+/i,""))?!1:/^(?:cmd(?:\.exe)?\s+\/c\s+)?(?:explorer(?:\.exe)?|start|invoke-item|ii|start-process|open|xdg-open)\b/i.test(t)}function Nn(e,t){return`${N(e)}: ${t?$("\u05D4\u05E1\u05E8\u05D9\u05E7\u05D4 \u05D4\u05D0\u05D7\u05E8\u05D5\u05E0\u05D4 \u05DC\u05D0 \u05D4\u05E6\u05DC\u05D9\u05D7\u05D4 \u05DC\u05E7\u05E8\u05D5\u05D0 \u05D0\u05D5\u05EA\u05D5, \u05D5\u05D4\u05D5\u05D0 \u05D4\u05E9\u05EA\u05E0\u05D4 \u05DE\u05D0\u05D6 \u2014 \u05DC\u05D0 \u05E0\u05D1\u05D3\u05E7, \u05D4\u05EA\u05D9\u05D9\u05D7\u05E1 \u05D0\u05DC\u05D9\u05D5 \u05DB\u05E8\u05D2\u05D9\u05E9","your last scan could not read it, and it changed since \u2014 NOT checked, treat it as sensitive"):$("\u05D4\u05E1\u05E8\u05D9\u05E7\u05D4 \u05D4\u05D0\u05D7\u05E8\u05D5\u05E0\u05D4 \u05DC\u05D0 \u05D4\u05E6\u05DC\u05D9\u05D7\u05D4 \u05DC\u05E7\u05E8\u05D5\u05D0 \u05D0\u05D5\u05EA\u05D5 \u2014 \u05DC\u05D0 \u05E0\u05D1\u05D3\u05E7, \u05D4\u05EA\u05D9\u05D9\u05D7\u05E1 \u05D0\u05DC\u05D9\u05D5 \u05DB\u05E8\u05D2\u05D9\u05E9","your last scan could not read it \u2014 NOT checked, treat it as sensitive")}`}function Bn(e,t,r){let n=[];if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"&&Li(t.command))return n;for(let s of zn(e,t,r)){if(!Ti(s)||kn(s)||!Mn(s))continue;let i=Fe(s);if(!$t(s)){let o=Ne(s);o?n.push({line:`${N(s)}: ${$("\u05E7\u05D5\u05D3 \u05E9\u05D4\u05E1\u05E8\u05D9\u05E7\u05D4 \u05D4\u05D0\u05D7\u05E8\u05D5\u05E0\u05D4 \u05E1\u05D9\u05DE\u05E0\u05D4","code your last scan flagged")} \u2014 ${Pi(o)}`,kind:"flagged_code"}):i&&n.push({line:Nn(s,i.changed),kind:"unread"});continue}try{if(At(s).size>_i)n.push({line:`${N(s)}: too large to check here (over 50 MB)`,kind:"too_large"});else{let o=Ri(s);Object.keys(o).length?n.push({line:`${N(s)}: ${Un(o)}`,kind:"data_file"}):i&&!i.changed&&n.push({line:Nn(s,!1),kind:"unread"})}}catch(o){n.push(o instanceof Ue?{line:`${N(s)}: ${$("\u05DC\u05D0 \u05E0\u05D9\u05EA\u05DF \u05DC\u05E7\u05E8\u05D5\u05D0 \u05D0\u05EA \u05D4\u05D8\u05E7\u05E1\u05D8 (\u05E1\u05E8\u05D9\u05E7\u05D4, \u05D4\u05E6\u05E4\u05E0\u05D4 \u05D0\u05D5 \u05D2\u05D5\u05E4\u05DF \u05DC\u05D0 \u05E0\u05EA\u05DE\u05DA) \u2014 \u05DC\u05D0 \u05E0\u05D1\u05D3\u05E7, \u05D4\u05EA\u05D9\u05D9\u05D7\u05E1 \u05D0\u05DC\u05D9\u05D5 \u05DB\u05E8\u05D2\u05D9\u05E9","its text could not be read (a scan, encryption or an unsupported font) \u2014 NOT checked, treat it as sensitive")}`,kind:"unreadable"}:{line:`${N(s)}: could not be checked`,kind:"unreadable"})}}return n}var Et=/(?:\.aws[\\/]+credentials|\.npmrc|\.yarnrc\.yml|\.pypirc|[._]netrc|\.git-credentials|\.pgpass|\.docker[\\/]+config\.json|\.kube[\\/]+config|gh[\\/]+hosts\.yml|\.supabase[\\/]+access-token|application_default_credentials\.json|gcloud[\\/]+(?:credentials|access_tokens)\.db|\.azure[\\/]+(?:msal_token_cache|accessTokens)|com\.vercel\.cli[\\/]+auth\.json|\.ssh[\\/]+id_(?:rsa|ed25519|ecdsa|dsa)(?![\w.]))/i,ze=/(?:TOKEN|SECRET|PASSW(?:OR)?D|API_?KEY|PRIVATE_?KEY|ACCESS_?KEY|CREDENTIAL|SERVICE_ROLE|_KEY$)/i,Wn="the vault's secrets, outside nodata_run's per-command approval",Di=/(?:^|[^\w.@-])(?:npx|pnpx|bunx|npm|pnpm|yarn|bun|node|nodejs|deno|nodata-mcp)(?:\.cmd|\.exe|\.ps1|\.js)?(?![\w-])[\s\S]*?(?<![\w-])secrets-(?:run|login|set|import|share)(?![\w-])/i;function Oi(e){return Di.test(e)}var Ni=[[/^(?:env|set|export\s+-p|declare\s+-x|get-childitem\s+env:\S*|gci\s+env:\S*|dir\s+env:\S*|ls\s+env:\S*)\s*$/i,"every environment variable"],[/^gh\s+auth\s+(?:token\b|status\b.*(?:\s-t\b|--show-token))/i,"the GitHub login token"],[/^gcloud\s+auth\s+(?:application-default\s+)?print-(?:access|identity)-token\b/i,"a Google Cloud access token"],[/^az\s+account\s+get-access-token\b/i,"an Azure access token"],[/^aws\s+(?:configure\s+(?:get\s+\S*(?:secret|token)\S*|export-credentials)|sts\s+get-session-token|ecr\s+get-login-password)\b/i,"AWS credentials"],[/^supabase\s+projects\s+api-keys\b/i,"the project's Supabase keys (incl. service_role)"],[/^heroku\s+auth:token\b/i,"the Heroku login token"],[/^op\s+(?:read|item\s+get)\b/i,"a 1Password secret"],[/^vault\s+(?:kv\s+get|read)\b/i,"a Vault secret"],[/^doppler\s+secrets\b/i,"Doppler secrets"],[/^security\s+find-(?:generic|internet)-password\b.*\s-w\b/i,"a keychain password"],[/^git\s+credential\s+fill\b/i,"a saved Git password"],[/^node\s+\S*nodata-pull\.mjs\b/i,Wn],[/^kubectl\s+get\s+secrets?\b.*\s-o\b/i,"Kubernetes secrets"]],Fi=/^(?:echo|printf|print|write-output|write-host|say)\b/i,Gn=/^(?:cat|type|get-content|gc|more|less|head|tail|bat|nl|strings|xxd|od|hexdump|grep|egrep|rg|select-string|sls|awk|sed|jq|yq|python\d*|py|node|ruby|perl)\b/i,Mi=/\$\{?env:([A-Za-z_][\w]*)|\$\{?([A-Za-z_][\w]*)|%([A-Za-z_][\w]*)%|GetEnvironmentVariable\(\s*['"]([^'"]+)['"]/g;function Hi(e,t,r){let n=e==="Read"&&typeof t.file_path=="string"?t.file_path:e==="Grep"&&typeof t.path=="string"?t.path:"";if(n&&Et.test((q(n)?n:C(r,n)).replace(/\\/g,"/")))return`a saved login (${It(n)})`;if(e!=="Bash"&&e!=="PowerShell"||typeof t.command!="string")return null;let s=t.command.split(/(\|\||&&|[;|\n])/);for(let i=0;i<s.length;i+=2){let o=s[i+1]==="|",a=s[i].trim().replace(/^(?:sudo\s+|cmd(?:\.exe)?\s+\/c\s+|powershell(?:\.exe)?\s+(?:-command\s+)?|pwsh\s+(?:-c(?:ommand)?\s+)?)+/i,"").replace(/^["']|["']$/g,"");if(Gn.test(a)&&Et.test(a))return"a saved login file";if(Oi(a))return Wn;for(let[c,u]of Ni)if(c.test(a))return u;let l=a.match(/^printenv(?:\s+(\S+))?\s*$/i);if(l&&(!l[1]||ze.test(l[1])))return l[1]?`the variable ${l[1]}`:"every environment variable";if(!o&&(Fi.test(a)||/GetEnvironmentVariable/i.test(a)))for(let c of a.matchAll(Mi)){let u=c[1]??c[2]??c[3]??c[4]??"";if(ze.test(u))return`the variable ${u}`}}return null}var Vn=/^(?:grep|egrep|fgrep|rg|ag|ack|git\s+grep|findstr|select-string|sls)\b/i,ji=/(?:^|\s)(?:-[a-zA-Z]*[rR][a-zA-Z]*|--recursive|--dereference-recursive|\/s|-recurse)(?=\s|$)/i,Ui=new Set(["node_modules",".git",".next","dist","build",".venv","venv","__pycache__",".cache"]),Fn=4e3,zi=5;function Bi(e){let t=0,r=0,n=(s,i)=>{if(i>zi||t>Fn)return;let o;try{o=mi(s,{withFileTypes:!0})}catch{return}for(let a of o){if(++t>Fn)return;let l=je(s,a.name);a.isDirectory()?Ui.has(a.name)||n(l,i+1):(K.test(a.name.toLowerCase())||Et.test(l.replace(/\\/g,"/"))||X(l))&&r++}};return n(e,0),r}var me=e=>{try{return At(e).isDirectory()}catch{return!1}};function Wi(e,t){let r=yi(C(t),C(e));return r===""||!r.startsWith("..")&&!q(r)}function Gi(e,t,r){let n=i=>C(r,i.replace(/^~(?=[\\/]|$)/,J())),s=[];if(e==="Grep"){let i=typeof t.path=="string"&&t.path?n(t.path):C(r);if(me(i)){let o=[t.pattern,t.glob,t.type].filter(a=>typeof a=="string").join(" ");s.push({roots:[i],bySecret:ze.test(o)||/\.env|env\b/i.test(String(t.glob??""))})}}else if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string")for(let i of t.command.split(/\|\||&&|[;|\n]/)){let o=i.trim().replace(/^(?:sudo\s+|xargs\s+(?:-\S+\s+)*)/i,"");if(!/^find\b.*-exec\s+(?:grep|egrep|rg|cat)\b/i.test(o)&&!(Vn.test(o)&&(ji.test(o)||/^(?:rg|ag|ack|git\s+grep)\b/i.test(o))))continue;let c=o.split(/\s+/).slice(1).map(u=>u.replace(/^['"]|['"]$/g,"")).filter(u=>u&&!u.startsWith("-")&&!/^\/[a-z]$/i.test(u)).map(n).filter(me);s.push({roots:c.length?c:[C(r)],bySecret:ze.test(o)||/\.env\b/i.test(o)})}for(let i of s)for(let o of i.roots){if(!i.bySecret&&Wi(o,r))continue;let a=Bi(o);if(a>0)return{why:i.bySecret?"by_name":"outside",root:o,keyFiles:a}}return null}var Kn=new Set(["Write","Edit","MultiEdit","NotebookEdit"]),St=e=>Kn.has(e)||Y(e)&&Be(e)==="write";function Vi(e,t,r){let n=s=>C(r,s.replace(/^~(?=[\\/]|$)/,J()));if(e==="Read"&&typeof t.file_path=="string")return{action:"read",paths:[n(t.file_path)],roots:[]};if(Kn.has(e)){let s=typeof t.file_path=="string"?t.file_path:typeof t.notebook_path=="string"?t.notebook_path:"";return s?{action:"write",paths:[n(s)],roots:[]}:null}if(e==="Grep"||e==="Glob"){let s=typeof t.path=="string"&&t.path?n(t.path):C(r);return{action:"search",paths:[s],roots:me(s)?[s]:[]}}if(Y(e)){let s=ge(t,r);if(!s.length)return null;let i=Be(e);return{action:i,paths:s,roots:i==="search"?s.filter(me):[]}}if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"){let s=t.command,o=[...[...s.matchAll(/"([^"]*)"/g)].map(c=>c[1]),...[...s.matchAll(/'([^']*)'/g)].map(c=>c[1]),...s.split(/[\s|;&<>(),=`]+/)].map(c=>c.trim()).filter(c=>c&&!c.startsWith("-")&&/[\\/.~]/.test(c)).map(n).filter(c=>Mn(c)),a=s.split(/\|\||&&|[;|\n]/).some(c=>Vn.test(c.trim())||/^find\b/i.test(c.trim())),l=o.filter(me);return{action:a?"search":Gn.test(s.trim())?"read":"run",paths:[C(r),...o],roots:a?l.length?l:[C(r)]:[]}}return null}function Ki(e,t,r,n=new Date,s){let i=Vi(e,t,r);if(!i)return null;let{rules:o,tampered:a}=Rn(),l=Ln();if(!o.length&&!l.length)return null;let c={allow:0,ask:1,clean_copy:2,deny:3},u=null;for(let p of i.paths){let f=xt(l,{action:i.action,path:p,now:n,who:s});f&&(!u||c[f.rule.effect]>c[u.rule.effect])&&(u={...f,org:!0})}for(let p of i.roots){let f=wt(l,p,i.action,n,s);f&&f.rule.effect!=="allow"&&(!u||c[f.rule.effect]>c[u.rule.effect])&&(u={...f,org:!0})}let d=Zi(o,a,i,n,c,s);return u&&(!d||c[u.rule.effect]>=c[d.rule.effect])?u:d}function Zi(e,t,r,n,s,i){if(!e.length)return null;if(t){for(let a of r.paths){let l=e.find(c=>z(c.path,a)||z(a,c.path));if(l)return{rule:{...l,effect:"deny",when:[]},n:e.indexOf(l)+1,touched:a,tampered:!0}}return null}let o=null;for(let a of r.paths){let l=xt(e,{action:r.action,path:a,now:n,who:i});l&&(!o||s[l.rule.effect]>s[o.rule.effect])&&(o=l)}for(let a of r.roots){let l=wt(e,a,r.action,n,i);l&&l.rule.effect!=="allow"&&(!o||s[l.rule.effect]>s[o.rule.effect])&&(o=l)}return o}function Xi(e){let t;try{t=typeof e=="string"?e:JSON.stringify(e??"")}catch{return{}}if(!t)return{};t=t.slice(0,2*1024*1024);let r={};for(let n of ee()){let s=new RegExp(n.pattern.source,n.pattern.flags.includes("g")?n.pattern.flags:n.pattern.flags+"g"),i=(t.match(s)??[]).length;i&&(r[n.id]=(r[n.id]??0)+i)}return r}function Ji(e){let t=Object.keys(e);if(t.length===0)return null;let r=t.reduce((s,i)=>s+e[i],0),n=[...new Set(t.map(s=>{let i=bt(s);return i.url?`${i.provider}: ${i.url}`:i.provider}))];return`NoData \xB7 A CREDENTIAL IS IN THIS OUTPUT (${r}: ${t.join(", ")}). It is now in this conversation and was sent to the AI model. Do not repeat, quote, shorten, mask-by-hand or reuse it \u2014 not in your answer, not in a command, not in a file. Tell the user in one line that a key was shown here and should be replaced at its provider (${n.join(" \xB7 ")}); nodata_scan_folder gives the full steps. Next time, run commands that need secrets through nodata_run: the output comes back with every value blanked.`+(Z()==="he"?" Answer the user in Hebrew.":"")}function qi(e,t,r){let n=(e==="Bash"||e==="PowerShell")&&typeof t.command=="string"?t.command:"",s=(e==="Grep"||e==="Glob")&&typeof t.path=="string"?t.path:e==="Read"&&typeof t.file_path=="string"?t.file_path:"";return n&&vi(n)||s&&X(q(s)?s:C(r,s))||Y(e)&&ge(t,r).some(X)||zn(e,t,r).some(X)?$("NoData \u05D7\u05E1\u05DD: \u05D6\u05D4 \u05E7\u05D5\u05D1\u05E5 \u05DE\u05E4\u05EA\u05D7 \u05E9\u05DC NoData (\u05DE\u05E4\u05EA\u05D7 \u05D4\u05DE\u05DB\u05E9\u05D9\u05E8, \u05D4\u05DB\u05E1\u05E4\u05EA \u05D0\u05D5 \u05D4\u05D0\u05E8\u05D2\u05D5\u05DF). \u05DE\u05D9 \u05E9\u05E7\u05D5\u05E8\u05D0 \u05D0\u05D5\u05EA\u05D5 \u05D9\u05DB\u05D5\u05DC \u05DC\u05E4\u05EA\u05D5\u05D7 \u05DB\u05DC \u05E7\u05D5\u05D1\u05E5 \u05E0\u05E2\u05D5\u05DC, \u05D5\u05DC\u05DB\u05DF \u05D0\u05E3 \u05E1\u05D5\u05DB\u05DF \u05DC\u05D0 \u05E7\u05D5\u05E8\u05D0 \u05D0\u05D5\u05EA\u05D5 \u2014 \u05D2\u05DD \u05DC\u05D0 \u05D1\u05D0\u05D9\u05E9\u05D5\u05E8. \u05DC-NoData \u05D0\u05D9\u05DF \u05E2\u05D5\u05EA\u05E7 \u05E9\u05DC \u05D4\u05DE\u05E4\u05EA\u05D7 \u05D5\u05D0\u05D9\u05DF \u05D3\u05E8\u05DA \u05DC\u05E9\u05D7\u05D6\u05E8 \u05D0\u05D5\u05EA\u05D5: \u05D4\u05D2\u05D9\u05D1\u05D5\u05D9 \u05E9\u05DC\u05DA \u05D4\u05D5\u05D0 \u05D4\u05D3\u05E8\u05DA \u05D4\u05D9\u05D7\u05D9\u05D3\u05D4. \u05DC\u05D2\u05D9\u05D1\u05D5\u05D9, \u05D1\u05D8\u05E8\u05DE\u05D9\u05E0\u05DC \u05D5\u05DC\u05D0 \u05D1\u05E6'\u05D0\u05D8: npx -y @nodatachat/mcp@latest key-backup E: (E: = \u05D4\u05D3\u05D9\u05E1\u05E7-\u05D0\u05D5\u05DF-\u05E7\u05D9).","NoData refused: this is one of NoData's own key files (the device key, the vault login or the org credential). Whoever reads it can open every sealed file, so no agent reads it \u2014 not even with approval. NoData holds no copy of this key and cannot recover it: your backup is the only recovery. To back it up, in a terminal (not the chat): npx -y @nodatachat/mcp@latest key-backup E: (E: = your USB drive). Do not suggest other recovery routes \u2014 there are none."):null}function Yi(e,t,r,n,s){if(jn(e))return{decision:"allow"};let i=qi(e,t,r);if(i)return{decision:"deny",reason:i,kind:"nodata_key"};let o=Hi(e,t,r);if(o){let f=$(`NoData: \u05D4\u05E4\u05E7\u05D5\u05D3\u05D4 \u05D4\u05D6\u05D5 \u05DE\u05E6\u05D9\u05D2\u05D4 ${o}. \u05DE\u05D4 \u05E9\u05D4\u05D9\u05D0 \u05DE\u05D3\u05E4\u05D9\u05E1\u05D4 \u05E0\u05DB\u05E0\u05E1 \u05DC\u05E9\u05D9\u05D7\u05D4 \u05D5\u05E0\u05E9\u05DC\u05D7 \u05DC\u05DE\u05D5\u05D3\u05DC \u05D4\u05D1\u05D9\u05E0\u05D4 \u05D4\u05DE\u05DC\u05D0\u05DB\u05D5\u05EA\u05D9\u05EA, \u05D5\u05DE\u05E4\u05EA\u05D7 \u05E9\u05E0\u05E8\u05D0\u05D4 \u05DB\u05D0\u05DF \u05E6\u05E8\u05D9\u05DA \u05DC\u05D4\u05D7\u05DC\u05D9\u05E3.
|
|
39
|
+
\u05D1\u05DE\u05E7\u05D5\u05DD \u05D6\u05D4: \u05DC\u05D4\u05E8\u05D9\u05E5 \u05D0\u05D5\u05EA\u05D4 \u05D1\u05E2\u05E6\u05DE\u05DA \u05D1\u05D8\u05E8\u05DE\u05D9\u05E0\u05DC (\u05DC\u05D0 \u05D1\u05E6'\u05D0\u05D8), \u05D0\u05D5 nodata_run \u2014 \u05E9\u05DE\u05E8\u05D9\u05E5 \u05E4\u05E7\u05D5\u05D3\u05D4 \u05E2\u05DD \u05D4\u05E1\u05D5\u05D3\u05D5\u05EA \u05D5\u05DE\u05D7\u05D6\u05D9\u05E8 \u05D0\u05EA \u05D4\u05E4\u05DC\u05D8 \u05DB\u05E9\u05DB\u05DC \u05E2\u05E8\u05DA \u05DE\u05D5\u05E1\u05EA\u05E8.`+(n?"":" \u05DC\u05D0\u05E9\u05E8 \u05D1\u05DB\u05DC \u05D6\u05D0\u05EA?"),`NoData: this shows ${o}. Whatever it prints enters the conversation and goes to the AI model, and a key seen there has to be replaced.
|
|
40
|
+
Instead: run it yourself in a terminal (not the chat), or nodata_run \u2014 it runs a command with the secrets and returns the output with every value blanked.`+(n?"":" Allow anyway?"));return{decision:n?"deny":"ask",reason:f,kind:"credential_print"}}if((St(e)||e==="Bash"||e==="PowerShell")&&$i(e,t,r))return{decision:"ask",kind:"gate_holder",reason:$("NoData: \u05D4\u05E4\u05E2\u05D5\u05DC\u05D4 \u05D4\u05D6\u05D5 \u05DE\u05E9\u05E0\u05D4 \u05D0\u05EA \u05DE\u05D4 \u05E9\u05DE\u05E4\u05E2\u05D9\u05DC \u05D0\u05EA \u05D4\u05E9\u05E2\u05E8 \u2014 \u05D4\u05D4\u05D2\u05D3\u05E8\u05D5\u05EA \u05E9\u05DC Claude Code \u05D0\u05D5 \u05D4\u05E7\u05D5\u05D3 \u05D4\u05DE\u05D5\u05EA\u05E7\u05DF \u05E9\u05DC NoData. \u05D0\u05D7\u05E8\u05D9 \u05E9\u05D9\u05E0\u05D5\u05D9 \u05DB\u05D6\u05D4 \u05D9\u05D9\u05EA\u05DB\u05DF \u05E9\u05D4\u05E9\u05E2\u05E8 \u05DC\u05D0 \u05D9\u05D1\u05D3\u05D5\u05E7 \u05D9\u05D5\u05EA\u05E8. \u05DC\u05D0\u05E9\u05E8 \u05E8\u05E7 \u05D0\u05DD \u05D0\u05EA\u05D4 \u05D1\u05D9\u05E7\u05E9\u05EA \u05D0\u05EA \u05D6\u05D4.","NoData: this changes what runs the gate \u2014 Claude Code's settings or NoData's installed code. After such a change the gate may stop checking. Approve only if you asked for it.")};if(St(e)){let f=typeof t.file_path=="string"?t.file_path:typeof t.notebook_path=="string"?t.notebook_path:"";if((Y(e)?ge(t,r):f?[q(f)?f:C(r,f)]:[]).some(X))return{decision:"deny",kind:"nodata_write",reason:$("NoData \u05D7\u05E1\u05DD: \u05D4\u05EA\u05D9\u05E7\u05D9\u05D9\u05D4 ~/.nodata \u05E1\u05D2\u05D5\u05E8\u05D4 \u05DC\u05E1\u05D5\u05DB\u05E0\u05D9\u05DD, \u05D2\u05DD \u05DC\u05DB\u05EA\u05D9\u05D1\u05D4 (\u05DB\u05DC\u05DC\u05D9\u05DD, \u05DE\u05E4\u05EA\u05D7\u05D5\u05EA, \u05D0\u05D9\u05E9\u05D5\u05E8\u05D9\u05DD).","NoData refused: ~/.nodata is closed to agents, writes included (rules, keys, approvals).")}}let a=Ki(e,t,r,new Date,s);if(a&&a.rule.effect!=="allow"){let f=Z()==="he",m=a.tampered?$("\u05E7\u05D5\u05D1\u05E5 \u05D4\u05DB\u05DC\u05DC\u05D9\u05DD \u05E9\u05D5\u05E0\u05D4 \u05E9\u05DC\u05D0 \u05D3\u05E8\u05DA nodata_rules, \u05D5\u05DC\u05DB\u05DF \u05DB\u05DC \u05E0\u05EA\u05D9\u05D1 \u05E9\u05D4\u05D5\u05D0 \u05DE\u05D6\u05DB\u05D9\u05E8 \u05E1\u05D2\u05D5\u05E8 \u05E2\u05D3 \u05E9\u05EA\u05E9\u05DE\u05D5\u05E8 \u05D0\u05EA \u05D4\u05DB\u05DC\u05DC\u05D9\u05DD \u05DE\u05D7\u05D3\u05E9.","the rules file was changed outside nodata_rules, so every path it names is closed until you save the rules again."):`${a.org?$("\u05DB\u05DC\u05DC \u05E9\u05DC \u05D4\u05D0\u05E8\u05D2\u05D5\u05DF","organisation rule"):$("\u05DB\u05DC\u05DC","rule")} ${a.n}: ${a.rule.path.startsWith("**/")?a.rule.path:N(a.rule.path)} \u2192 ${Pn(a.rule.effect,f)}${a.rule.note?` (${a.rule.note})`:""}`,h=a.rule.effect==="clean_copy"?$(`NoData: ${m}. \u05D4\u05E1\u05D5\u05DB\u05DF \u05E2\u05D5\u05D1\u05D3 \u05DB\u05D0\u05DF \u05E8\u05E7 \u05E2\u05DC \u05E2\u05D5\u05EA\u05E7 \u05E0\u05E7\u05D9: nodata_redact \u05D9\u05D5\u05E6\u05E8 \u05D0\u05D5\u05EA\u05D5 (\u05DE\u05D6\u05D4\u05D9\u05DD \u05DE\u05D5\u05D7\u05DC\u05E4\u05D9\u05DD, \u05E0\u05D1\u05D3\u05E7 \u05DC\u05E4\u05E0\u05D9 \u05E9\u05D9\u05DE\u05D5\u05E9).`,`NoData: ${m}. The agent works here on a clean copy only: nodata_redact makes one (identifiers replaced, checked before use).`):a.rule.effect==="ask"?$(`NoData: ${m}. \u05DC\u05D0\u05E9\u05E8?`,`NoData: ${m}. Allow?`):$(`NoData: ${m}. \u05D4\u05DB\u05DC\u05DC\u05D9\u05DD \u05E9\u05DC \u05D4\u05E7\u05D1\u05E6\u05D9\u05DD \u05D5\u05D4\u05EA\u05D9\u05E7\u05D9\u05D5\u05EA \u05E9\u05DC\u05DA: nodata_rules.`,`NoData: ${m}. Your file and folder rules: nodata_rules.`);return{decision:a.rule.effect==="ask"?"ask":"deny",reason:h,kind:"rule"}}if(St(e))return{decision:"allow"};let l=Gi(e,t,r);if(l){let f=N(l.root),m=$(`NoData: \u05D6\u05D4 ${l.why==="by_name"?"\u05D7\u05D9\u05E4\u05D5\u05E9 \u05E1\u05D5\u05D3 \u05DC\u05E4\u05D9 \u05E9\u05DD":"\u05D7\u05D9\u05E4\u05D5\u05E9 \u05DE\u05D7\u05D5\u05E5 \u05DC\u05E4\u05E8\u05D5\u05D9\u05E7\u05D8"}, \u05D1\u05EA\u05D5\u05DA ${f}, \u05E9\u05D9\u05E9 \u05D1\u05D4 ${l.keyFiles} \u05E7\u05D1\u05E6\u05D9 \u05DE\u05E4\u05EA\u05D7\u05D5\u05EA (.env, \u05D4\u05EA\u05D7\u05D1\u05E8\u05D5\u05D9\u05D5\u05EA). \u05DE\u05D4 \u05E9\u05D4\u05D7\u05D9\u05E4\u05D5\u05E9 \u05D9\u05DE\u05E6\u05D0 \u05E0\u05DB\u05E0\u05E1 \u05DC\u05E9\u05D9\u05D7\u05D4, \u05D5\u05DE\u05E4\u05EA\u05D7 \u05E9\u05E0\u05DE\u05E6\u05D0 \u05DB\u05DA \u05D9\u05DB\u05D5\u05DC \u05DC\u05E9\u05DE\u05E9 \u05D0\u05EA \u05D4\u05E1\u05D5\u05DB\u05DF \u2014 \u05D2\u05DD \u05DC\u05E4\u05E2\u05D5\u05DC\u05D5\u05EA \u05E9\u05E2\u05D5\u05DC\u05D5\u05EA \u05DB\u05E1\u05E3 \u2014 \u05D1\u05DC\u05D9 \u05E9\u05D0\u05D9\u05E9\u05E8\u05EA \u05D0\u05D5\u05EA\u05D5.
|
|
41
|
+
\u05D1\u05DE\u05E7\u05D5\u05DD \u05D6\u05D4: \u05DC\u05D7\u05E4\u05E9 \u05D1\u05EA\u05D5\u05DA \u05D4\u05E4\u05E8\u05D5\u05D9\u05E7\u05D8, \u05D0\u05D5 nodata_run \u05E2\u05DD \u05D4\u05DE\u05E4\u05EA\u05D7\u05D5\u05EA \u05DE\u05D4\u05DB\u05E1\u05E4\u05EA (\u05DB\u05DC \u05E4\u05E7\u05D5\u05D3\u05D4 \u05DE\u05D0\u05D5\u05E9\u05E8\u05EA \u05DB\u05DE\u05D5 \u05E9\u05D4\u05D9\u05D0).`+(n?"":" \u05DC\u05D0\u05E9\u05E8 \u05D1\u05DB\u05DC \u05D6\u05D0\u05EA?"),`NoData: this is ${l.why==="by_name"?"a search for a secret by name":"a search outside this project"}, over ${f}, where ${l.keyFiles} key file(s) (.env, logins) are. Whatever it finds enters the conversation, and a key found this way can be used by the agent \u2014 for paid calls too \u2014 without you approving it.
|
|
42
|
+
Instead: search inside the project, or nodata_run with the keys from the vault (each command approved as written).`+(n?"":" Allow anyway?"));return{decision:n?"deny":"ask",reason:m,kind:"secret_search"}}if(a?.rule.effect==="allow")return{decision:"allow"};let c=Bn(e,t,r);if(c.length===0)return{decision:"allow"};let u=c.map(f=>f.line),d=$(`NoData \u05E1\u05E8\u05E7 \u05D0\u05EA \u05D4\u05E7\u05D5\u05D1\u05E5 \u05D1\u05DE\u05D7\u05E9\u05D1 \u05E9\u05DC\u05DA \u2014 \u05E9\u05D5\u05DD \u05D3\u05D1\u05E8 \u05DC\u05D0 \u05D9\u05E6\u05D0:
|
|
43
|
+
${u.join(`
|
|
44
44
|
`)}
|
|
45
45
|
`+(n?"\u05D4\u05E7\u05E8\u05D9\u05D0\u05D4 \u05E0\u05D7\u05E1\u05DE\u05D4: Claude \u05DC\u05D0 \u05D9\u05E7\u05E8\u05D0 \u05D0\u05EA \u05D4\u05DE\u05E7\u05D5\u05E8. \u05D1\u05DE\u05E7\u05D5\u05DD \u05D6\u05D4: nodata_redact (\u05E2\u05D5\u05EA\u05E7 \u05E0\u05E7\u05D9 \u05DC\u05E2\u05D1\u05D5\u05D3\u05D4) \u05D0\u05D5 nodata_protect (\u05E0\u05E2\u05D9\u05DC\u05D4).":"\u05D0\u05DD \u05EA\u05D0\u05E9\u05E8, Claude \u05D9\u05E7\u05E8\u05D0 \u05D0\u05EA \u05D4\u05E7\u05D5\u05D1\u05E5 \u05E2\u05E6\u05DE\u05D5 \u05D5\u05D4\u05EA\u05D5\u05DB\u05DF \u05D9\u05D9\u05E9\u05DC\u05D7 \u05DC\u05DE\u05D5\u05D3\u05DC \u05D4\u05D1\u05D9\u05E0\u05D4 \u05D4\u05DE\u05DC\u05D0\u05DB\u05D5\u05EA\u05D9\u05EA. \u05D1\u05DE\u05E7\u05D5\u05DD \u05D6\u05D4: nodata_redact (\u05E2\u05D5\u05EA\u05E7 \u05E0\u05E7\u05D9 \u05DC\u05E2\u05D1\u05D5\u05D3\u05D4) \u05D0\u05D5 nodata_protect (\u05E0\u05E2\u05D9\u05DC\u05D4). \u05DC\u05D0\u05E9\u05E8 \u05D1\u05DB\u05DC \u05D6\u05D0\u05EA?"),`NoData scanned this file on your machine \u2014 nothing left it:
|
|
46
|
-
${
|
|
46
|
+
${u.join(`
|
|
47
47
|
`)}
|
|
48
|
-
`+(n?"Read refused: Claude will not read the original. Instead: nodata_redact (a clean copy to work on) or nodata_protect (lock it).":"If you allow it, Claude reads the file itself and its content goes to the AI model. Instead: nodata_redact (a clean copy to work on) or nodata_protect (lock it). Allow anyway?"));return{decision:n?"deny":"ask",reason:
|
|
48
|
+
`+(n?"Read refused: Claude will not read the original. Instead: nodata_redact (a clean copy to work on) or nodata_protect (lock it).":"If you allow it, Claude reads the file itself and its content goes to the AI model. Instead: nodata_redact (a clean copy to work on) or nodata_protect (lock it). Allow anyway?")),p=[...new Set(c.map(f=>f.kind))];return{decision:n?"deny":"ask",reason:d,kind:p[0],...p.length>1?{kinds:p}:{}}}function Qi(e,t,r){let n=Bn(e,t,r).map(s=>s.line);return n.length===0?null:`NoData \xB7 ON SCREEN rule. What you just read holds personal data:
|
|
49
49
|
${n.join(`
|
|
50
50
|
`)}
|
|
51
|
-
The user's screen is not private \u2014 someone may be beside them. Answer with totals, counts, groupings and trends. Do not print names, ID / policy / account numbers, addresses, phones, or amounts tied to a person \u2014 not in a table, not as an "example" \u2014 unless the user explicitly asks to see those values. For a clean, anonymised or shareable version use nodata_redact \u2014 never your own script: it verifies the copy and records a proof.`+(
|
|
52
|
-
`,{mode:384})}catch{}}async function
|
|
51
|
+
The user's screen is not private \u2014 someone may be beside them. Answer with totals, counts, groupings and trends. Do not print names, ID / policy / account numbers, addresses, phones, or amounts tied to a person \u2014 not in a table, not as an "example" \u2014 unless the user explicitly asks to see those values. For a clean, anonymised or shareable version use nodata_redact \u2014 never your own script: it verifies the copy and records a proof.`+(Z()==="he"?" Answer the user in Hebrew.":"")}function Zn(e){try{let t=je(J(),".nodata");hi(t,{recursive:!0}),fi(je(t,"gate.log"),JSON.stringify({at:new Date().toISOString(),...e})+`
|
|
52
|
+
`,{mode:384})}catch{}}function eo(e,t){Zn({tool:e,decision:t.decision,...t.kind?{kind:t.kind}:{},...t.kinds?.length?{kinds:t.kinds}:{}})}function to(e,t){let r=typeof e=="string"&&e.trim()?e.trim().toLowerCase():void 0,n=typeof t.agent_type=="string"&&t.agent_type.trim()?t.agent_type.trim().toLowerCase():r==="claude-code"?"main":void 0;return{host:r,type:n}}async function Xn(e){let t=e.includes("--block"),r=e.includes("--post"),n=e.indexOf("--host"),s=n>=0&&e[n+1]&&!e[n+1].startsWith("--")?e[n+1]:void 0,i="";for await(let c of process.stdin)i+=c;let o;try{o=JSON.parse(i)}catch{return}let a=o.tool_name??"";if(jn(a))return;if(r){let c=Xi(o.tool_response);Object.keys(c).length&&Zn({tool:a,leaked:Object.values(c).reduce((d,p)=>d+p,0)});let u=[Ji(c),Qi(a,o.tool_input??{},o.cwd??process.cwd())].filter(Boolean).join(`
|
|
53
53
|
|
|
54
|
-
`);l&&process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PostToolUse",additionalContext:l}}));return}let o=Oi(i,s.tool_input??{},s.cwd??process.cwd(),t);o.decision!=="allow"&&(In({tool:i,decision:o.decision}),process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:o.decision,permissionDecisionReason:o.reason}})))}var Fi=[{type:"id_number",patterns:[/\b\d{9}\b/g,/ת\.?ז\.?\s*:?\s*(\d{9})/g,/זהות\s*:?\s*(\d{9})/g],confidence:.9,replacement:()=>"[\u05EA.\u05D6. \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"phone",patterns:[/\b0[2-9]\d[\s\-]?\d{7}\b/g,/\b05[0-9][\s\-]?\d{7}\b/g,/\+972[\s\-]?[2-9]\d[\s\-]?\d{7}\b/g],confidence:.95,replacement:()=>"[\u05D8\u05DC\u05E4\u05D5\u05DF \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"email",patterns:[/[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}/g],confidence:.99,replacement:e=>{let[,t]=e.split("@");return`[\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC: ***@${t}]`}},{type:"full_name",patterns:[/(?:לקוח|מטופל|מועמד|שם|נהג|מבוטח|תובע|נתבע|שוכר|מחזיק)[:\s]+([א-ת][א-ת"'\-\s]{2,30}?)(?=[,\n\d]|ת\.ז)/g,/(?:עו"ד|ד"ר|פרופ'|מר|גברת)\s+([א-ת][א-ת"'\-\s]{2,25}?)(?=[,\n])/g],confidence:.75,replacement:()=>"[\u05E9\u05DD \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"bank_account",patterns:[/\b\d{2}[\-]\d{5,9}[\-]\d{2,3}\b/g,/(?:חשבון|ח-ן)\s*:?\s*(\d[\d\-]{8,15})/g],confidence:.88,replacement:()=>"[\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"medical",patterns:[/(?<![א-ת])[בהוכלמש]{0,2}(?:סוכרת|יתר לחץ דם|אסתמה|דיכאון|חרדה|סרטן|אי ספיקת לב|אפילפסיה)(?![א-ת])/g,/\b(?:Metformin|Lisinopril|Atorvastatin|Amlodipine|Sertraline|Fluoxetine|Omeprazole|Warfarin|Aspirin|Insulin)\b/gi,/\bHbA1c\s*:?\s*[\d.]+%?/g,/\bBMI\s*:?\s*[\d.]+/g,/(?<![א-ת])[בהוכלמש]{0,2}אבחנ[הות]\s*:?\s*[^,\n.]{2,40}/g],confidence:.85,replacement:()=>"[\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"financial_amount",patterns:[/[\d,]+(?:\.\d{2})?\s*(?:₪|ש"ח|NIS|שקל(?:ים)?)/g,/(?:₪|NIS)\s*[\d,]+(?:\.\d{2})?/g],confidence:.92,replacement:()=>"[\u05E1\u05DB\u05D5\u05DD \u05DB\u05E1\u05E4\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"birth_date",patterns:[/(?:תאריך לידה|נולד|נולדה|ד\.ל\.)\s*:?\s*\d{1,2}[\/\.\-]\d{1,2}[\/\.\-]\d{2,4}/g,/(?<![א-ת])[בהוכלמש]{0,2}גיל\s*:?\s*\d{1,3}\b/g],confidence:.88,replacement:()=>"[\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"address",patterns:[/רחוב\s+[א-ת][א-ת\s"'\-]{2,30}\s+\d{1,5}/g,/(?:רח'|רח\.)\s+[א-ת][א-ת\s"'\-]{2,30}\d{1,5}/g],confidence:.72,replacement:()=>"[\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D5\u05E1\u05EA\u05E8\u05EA]"},{type:"license_plate",patterns:[/\b\d{2,3}[\-]\d{2,3}[\-]\d{2,3}\b/g],confidence:.8,replacement:()=>"[\u05DC\u05D5\u05D7\u05D9\u05EA \u05E8\u05D9\u05E9\u05D5\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8\u05EA]"}];function Hi(e){if(e.length!==9)return!1;let t=e.split("").map(Number),r=0;for(let n=0;n<9;n++){let s=t[n]*(n%2===0?1:2);s>9&&(s-=9),r+=s}return r%10===0}var Ue=class{constructor(t){this.enabledTypes=new Set(t)}detect(t){let r=[],n=new Set;for(let i of Fi)if(this.enabledTypes.has(i.type))for(let o of i.patterns){let a=new RegExp(o.source,o.flags),l;for(;(l=a.exec(t))!==null;){let c=l[0],u=`${i.type}:${l.index}`;if(!n.has(u)){if(n.add(u),i.type==="id_number"){let d=c.replace(/\D/g,"");if(/^\d{9}$/.test(c)&&d.length===9&&!Hi(d))continue}r.push({type:i.type,value:c,startIndex:l.index,endIndex:l.index+c.length,confidence:i.confidence,replacement:i.replacement(c,i.type)})}}}r.sort((i,o)=>i.startIndex-o.startIndex||o.confidence-i.confidence);let s=[];for(let i of r)s.some(a=>i.startIndex<a.endIndex&&i.endIndex>a.startIndex)||s.push(i);return s}};var Mi=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם_אדם|שם הלקוח|שם_הלקוח|שם בן זוג|שם בן_זוג|שם המבוטח|שם_המבוטח|שם המוטב|שם_המוטב|שם מבוטח|שם_מבוטח|שם מוטב|שם_מוטב|שם הילד|שם_הילד|שם הקטין|שם_הקטין|firstname_he|lastname_he|shem|shem_mishpacha|shem_prati)$/i,type:"name",label:"Person name (Hebrew)",labelHe:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מספר_זהות|מס' זהות|מס_זהות|מס' ת"ז|teudat_zehut|tz|t_z|israeli_id|il_id)$/i,type:"id",label:"Israeli ID",labelHe:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|מס דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה|מס רישיון|דרכון_מספר)$/i,type:"id",label:"Passport / DL (Hebrew)",labelHe:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|דואר_אלקטרוני|אימייל|כתובת מייל|כתובת_מייל|כתובת דואר|כתובת_דואר)$/i,type:"email",label:"Email (Hebrew)",labelHe:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|מספר_טלפון|טלפון נייד|טלפון_נייד|מס נייד|מס_נייד|מס' טל)$/i,type:"phone",label:"Phone (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|כתובת_מגורים|רחוב|מס בית|מספר בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|כתובת_מלאה|מען)$/i,type:"address",label:"Address (Hebrew)",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|תאריך_לידה|ת לידה|תאריך הולדת|תאריך_הולדת|יום הולדת|יום_הולדת|גיל)$/i,type:"dob",label:"Date of birth (Hebrew)",labelHe:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|חשבון_בנק|מספר חשבון|מספר_חשבון|מס חשבון|מס' חשבון|בנק|סניף|מס סניף|iban|iban_il)$/i,type:"financial",label:"Bank account (Hebrew)",labelHe:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|כרטיס_אשראי|מספר אשראי|מס אשראי|מס' אשראי|cvv|אשראי|מס כרטיס|מס_כרטיס)$/i,type:"financial",label:"Credit card (Hebrew)",labelHe:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר_ברוטו|שכר נטו|שכר_נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"Salary / income (Hebrew)",labelHe:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|בדיקה_רפואית|מצב רפואי|מצב_רפואי|חיסון|תוצאת בדיקה|תוצאת_בדיקה|רופא|רגישות|אלרגיה|סוג דם|סוג_דם)$/i,type:"medical",label:"Medical (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מספר_פוליסה|מס פוליסה|מס' פוליסה|פוליסה|מספר חבר|מספר_חבר|מס חבר|מספר ביטוח|מספר_ביטוח|policy_?number|policy_?no|policy_?id)$/i,type:"policy",label:"Insurance policy number (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"},{pattern:/^(?:מספר סוכן|מספר_סוכן|מס סוכן|מס' סוכן|מס_סוכן|קוד סוכן|קוד_סוכן|מספר משווק|מספר_משווק|מספר יצרן|סוכן ביטוח|agent_?number|agent_?no|agent_?id|agent_?code|broker_?id|broker_?number)$/i,type:"agent_id",label:"Insurance agent / broker number (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF"},{pattern:/^(?:שם הילד|שם_הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|מספר_ילדים|תעודת לידה|ת לידה ילד)$/i,type:"minor_data",label:"Minor data (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|נטייה_מינית|השקפה פוליטית|השקפה_פוליטית|מצב משפחתי|מצב_משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"Sensitive personal (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מספר_רכב|מס רכב|מס' רכב|לוחית רישוי|לוחית_רישוי|מספר רישוי|מספר_רישוי)$/i,type:"tracking",label:"Vehicle ID (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}];function wt(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let r=t.padStart(9,"0"),n=0;for(let s=0;s<9;s++){let i=parseInt(r[s]??"0",10)*(s%2+1);i>9&&(i-=9),n+=i}return n%10===0&&parseInt(r,10)>0}var ze=/(?:\+972[\s-]?|0)(?:5[0-9]|[2-4]|[89])(?:[\s-]?\d){7}/g,Be=/[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}/gi,We=/\bIL\d{2}\s?(?:\d{4}\s?){4}\d{3}\b/g;function Nn(e){let t=String(e??"").replace(/\D/g,"");if(t.length<13||t.length>19)return!1;let r=0,n=!1;for(let s=t.length-1;s>=0;s--){let i=t.charCodeAt(s)-48;if(i<0||i>9)return!1;n&&(i*=2,i>9&&(i-=9)),r+=i,n=!n}return r%10===0}function Fn(e){if(!e)return null;let t=e.trim();for(let r of Mi)if(r.pattern.test(t))return{type:r.type,label:r.label,labelHe:r.labelHe};return null}var ji=[{type:"biometric",tokens:["biometric","fingerprint","\u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9"],phrases:["face id","\u05D8\u05D1\u05D9\u05E2\u05EA \u05D0\u05E6\u05D1\u05E2"]},{type:"medical",tokens:["diagnosis","medical","disease","medication","prescription","allergy","vaccine","\u05D0\u05D1\u05D7\u05D5\u05DF","\u05D0\u05D1\u05D7\u05E0\u05D4","\u05DE\u05D7\u05DC\u05D4","\u05EA\u05E8\u05D5\u05E4\u05D4","\u05DE\u05E8\u05E9\u05DD","\u05D7\u05D9\u05E1\u05D5\u05DF","\u05D0\u05DC\u05E8\u05D2\u05D9\u05D4"],phrases:["medical record","blood type","\u05DE\u05E6\u05D1 \u05E8\u05E4\u05D5\u05D0\u05D9","\u05E1\u05D5\u05D2 \u05D3\u05DD"]},{type:"sensitive_personal",tokens:["religion","ethnicity","nationality","\u05D3\u05EA","\u05DC\u05D0\u05D5\u05DD","\u05E2\u05D3\u05D4","\u05DE\u05D5\u05E6\u05D0"],phrases:["sexual orientation","marital status","\u05DE\u05E6\u05D1 \u05DE\u05E9\u05E4\u05D7\u05EA\u05D9","\u05E0\u05D8\u05D9\u05D9\u05D4 \u05DE\u05D9\u05E0\u05D9\u05EA"]},{type:"minor_data",tokens:["minor","\u05E7\u05D8\u05D9\u05DF"],phrases:["child name","\u05E9\u05DD \u05D4\u05D9\u05DC\u05D3","\u05E9\u05DD \u05D4\u05E7\u05D8\u05D9\u05DF"]},{type:"id",tokens:["ssn","passport","\u05D6\u05D4\u05D5\u05EA","\u05D3\u05E8\u05DB\u05D5\u05DF"],phrases:["national id","id number","identity number","social security","driver license","driving license","drivers license","passport number","tax id","\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA","\u05DE\u05E1\u05E4\u05E8 \u05D6\u05D4\u05D5\u05EA","\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4"]},{type:"financial",tokens:["iban","swift","bic","salary","income","wage","\u05D0\u05E9\u05E8\u05D0\u05D9","\u05E9\u05DB\u05E8","\u05DE\u05E9\u05DB\u05D5\u05E8\u05EA","\u05D4\u05DB\u05E0\u05E1\u05D4"],phrases:["bank account","account number","credit card","card number","routing number","sort code","\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7","\u05DE\u05E1\u05E4\u05E8 \u05D7\u05E9\u05D1\u05D5\u05DF","\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"]},{type:"policy",tokens:["policy","\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"],phrases:["policy number","member number","\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"]},{type:"agent_id",tokens:["\u05DE\u05E9\u05D5\u05D5\u05E7"],phrases:["agent number","agent code","broker id","\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF"]},{type:"dob",tokens:["dob","birthdate","birthday","\u05DC\u05D9\u05D3\u05D4","\u05D4\u05D5\u05DC\u05D3\u05EA","\u05D2\u05D9\u05DC"],phrases:["date of birth","birth date","\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"]},{type:"phone",tokens:["phone","tel","mobile","cell","fax","\u05D8\u05DC\u05E4\u05D5\u05DF","\u05E0\u05D9\u05D9\u05D3","\u05E4\u05DC\u05D0\u05E4\u05D5\u05DF","\u05E1\u05DC\u05D5\u05DC\u05E8\u05D9"],phrases:["phone number","mobile number","cell phone","\u05D8\u05DC\u05E4\u05D5\u05DF \u05E0\u05D9\u05D9\u05D3"]},{type:"email",tokens:["email","mail","\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC","\u05DE\u05D9\u05D9\u05DC","\u05D3\u05D5\u05D0\u05DC"],phrases:["email address","e mail","\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D9\u05D9\u05DC"]},{type:"address",tokens:["address","street","city","zipcode","zip","postcode","\u05DB\u05EA\u05D5\u05D1\u05EA","\u05E8\u05D7\u05D5\u05D1","\u05E2\u05D9\u05E8","\u05D9\u05E9\u05D5\u05D1","\u05D9\u05D9\u05E9\u05D5\u05D1","\u05DE\u05D9\u05E7\u05D5\u05D3","\u05DE\u05E2\u05DF"],phrases:["home address","postal code","street address","zip code","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D2\u05D5\u05E8\u05D9\u05DD"]},{type:"location",tokens:["gps","latitude","longitude","geolocation","\u05DE\u05D9\u05E7\u05D5\u05DD"],phrases:["gps coordinates"]},{type:"tracking",tokens:["plate","vehicle","\u05E8\u05DB\u05D1","\u05E8\u05D9\u05E9\u05D5\u05D9"],phrases:["license plate","vehicle number","plate number","\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"]},{type:"name",tokens:["name","\u05E9\u05DD"],phrases:["first name","last name","full name","family name","given name","surname","\u05E9\u05DD \u05E4\u05E8\u05D8\u05D9","\u05E9\u05DD \u05DE\u05E9\u05E4\u05D7\u05D4","\u05E9\u05DD \u05DE\u05DC\u05D0"]}];function Ge(e){if(!e)return null;let t=e.trim().toLowerCase().replace(/["'`׳״]/g,"").replace(/[_\-.]+/g," ").replace(/\s+/g," ").trim();if(!t)return null;let r=new Set(t.match(/[\p{L}\p{N}]+/gu)??[]);for(let n of ji)if(n.phrases?.some(i=>t.includes(i))||n.tokens?.some(i=>r.has(i)))return{type:n.type,label:n.type,labelHe:Ve(n.type)};return null}function Ve(e){return{id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",name:"\u05E9\u05DD \u05D0\u05D3\u05DD",email:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9",phone:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",financial:"\u05E4\u05E8\u05D8\u05D9\u05DD \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9\u05D9\u05DD",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",minor_data:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF",sensitive_personal:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9",biometric:"\u05DE\u05D9\u05D3\u05E2 \u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9",auth:"\u05E1\u05D9\u05E1\u05DE\u05D0\u05D5\u05EA/\u05E1\u05D5\u05D3\u05D5\u05EA",tracking:"\u05DE\u05D6\u05D4\u05D9 \u05DE\u05E2\u05E7\u05D1",location:"\u05DE\u05D9\u05E7\u05D5\u05DD"}[e]??"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9"}function Hn(e){let t=0,r=0,n=0,s=0,i=0;for(let a of e)typeof a=="string"&&(wt(a)&&t++,ze.lastIndex=0,ze.test(a)&&r++,Be.lastIndex=0,Be.test(a)&&n++,We.lastIndex=0,We.test(a)&&s++,Nn(a)&&i++);let o=e.length||1;return t/o>=.3?{type:"id",label:"Israeli ID (sniffed)",matchedSample:t}:s/o>=.3?{type:"financial",label:"IBAN-IL (sniffed)",matchedSample:s}:r/o>=.3?{type:"phone",label:"IL phone (sniffed)",matchedSample:r}:n/o>=.3?{type:"email",label:"Email (sniffed)",matchedSample:n}:i/o>=.3?{type:"financial",label:"Credit card (sniffed)",matchedSample:i}:null}var Mn={_comment:"CANONICAL secret ruleset \u2014 the SINGLE SOURCE OF TRUTH for hardcoded-secret detection, loaded by BOTH the web scanner (lib/soc/exposure-map.ts) and the installed Capsule agent (apps/desktop/src-tauri/src/scanner.rs, via include_str!). Patterns are written in the regex subset both JavaScript and the Rust `regex` crate accept (no lookaround, no backreferences). A connection string counts only WITH credentials (user:pass@). Edit here once and both engines stay aligned.",rules:[{id:"aws-access-key",subkind:"aws_access_key",name:"AWS Access Key",severity:"critical",pattern:"(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)",hint:"AWS access key id detected. Rotate via IAM and move to an environment variable."},{id:"aws-secret-key",subkind:"aws_secret_key",name:"AWS Secret Key",severity:"critical",pattern:`(?:aws_secret_access_key|aws_secret_key|secret_access_key)\\s*[=:]\\s*['"]?[A-Za-z0-9/+=]{40}['"]?`,hint:"AWS secret access key detected. Rotate immediately."},{id:"gcp-api-key",subkind:"gcp_api_key",name:"GCP API Key",severity:"critical",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Google API key detected. Restrict or rotate it in the Google Cloud console."},{id:"gcp-service-account",subkind:"gcp_service_account",name:"GCP Service Account",severity:"critical",pattern:'"type"\\s*:\\s*"service_account"',hint:"GCP service-account JSON detected. Move it out of the repo and rotate the key."},{id:"github-token",subkind:"github_token",name:"GitHub Token",severity:"critical",pattern:"gh[pousr]_[0-9a-zA-Z]{36,}",hint:"GitHub token detected. Revoke at https://github.com/settings/tokens."},{id:"github-fine-grained",subkind:"github_fine_grained_token",name:"GitHub Fine-Grained Token",severity:"critical",pattern:"github_pat_[0-9a-zA-Z_]{22,}",hint:"GitHub fine-grained token detected. Revoke it in GitHub settings."},{id:"gitlab-token",subkind:"gitlab_token",name:"GitLab Token",severity:"critical",pattern:"glpat-[0-9a-zA-Z_-]{20,}",hint:"GitLab token detected. Revoke it in GitLab access tokens."},{id:"stripe-secret",subkind:"stripe_key",name:"Stripe Secret Key",severity:"critical",pattern:"sk_live_[0-9a-zA-Z]{24,}",hint:"Stripe live secret key detected. Roll it in the Stripe dashboard."},{id:"stripe-restricted",subkind:"stripe_restricted_key",name:"Stripe Restricted Key",severity:"critical",pattern:"rk_live_[0-9a-zA-Z]{24,}",hint:"Stripe restricted key detected. Roll it in the Stripe dashboard."},{id:"slack-token",subkind:"slack_token",name:"Slack Token",severity:"high",pattern:"xox[baprs]-[0-9a-zA-Z-]{10,}",hint:"Slack token detected. Revoke it in the Slack app settings."},{id:"slack-webhook",subkind:"slack_webhook",name:"Slack Webhook",severity:"high",pattern:"hooks\\.slack\\.com/services/T[0-9A-Z]{8,}/B[0-9A-Z]{8,}/[0-9a-zA-Z]{24}",hint:"Slack incoming-webhook URL detected. Regenerate it."},{id:"twilio-api-key",subkind:"twilio_api_key",name:"Twilio API Key",severity:"high",pattern:"SK[0-9a-fA-F]{32}",hint:"Twilio API key detected. Rotate it in the Twilio console."},{id:"sendgrid-api-key",subkind:"sendgrid_api_key",name:"SendGrid API Key",severity:"critical",pattern:"SG\\.[0-9a-zA-Z_-]{22}\\.[0-9a-zA-Z_-]{43}",hint:"SendGrid API key detected. Rotate it in the SendGrid console."},{id:"postgres-uri",subkind:"postgres_uri",name:"PostgreSQL Connection String",severity:"critical",pattern:`postgres(?:ql)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"PostgreSQL connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"mongodb-uri",subkind:"mongodb_uri",name:"MongoDB Connection String",severity:"critical",pattern:`mongodb(?:\\+srv)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"MongoDB connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"redis-uri",subkind:"redis_uri",name:"Redis Connection String",severity:"high",pattern:`redis(?:s)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"Redis connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"openai-key",subkind:"openai_key",name:"OpenAI API Key",severity:"critical",pattern:"sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}",hint:"OpenAI API key detected. Rotate at https://platform.openai.com/api-keys."},{id:"anthropic-key",subkind:"anthropic_key",name:"Anthropic API Key",severity:"critical",pattern:"sk-ant-[0-9a-zA-Z_-]{40,}",hint:"Anthropic API key detected. Rotate at https://console.anthropic.com/."},{id:"firebase-key",subkind:"firebase_key",name:"Firebase API Key",severity:"high",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Firebase API key detected. Restrict it in the Firebase console."},{id:"supabase-key",subkind:"supabase_key",name:"Supabase Service Key",severity:"critical",pattern:"eyJ[0-9a-zA-Z_-]{100,}",hint:"Long JWT (possible Supabase service key) detected. Rotate it and keep it server-side only."},{id:"private-key",subkind:"private_key",name:"Private Key",severity:"critical",pattern:"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",hint:"Private key material in plaintext. Rotate immediately and move to a key manager (KMS/Vault).",skipPlaceholder:!0},{id:"jwt-secret",subkind:"jwt_secret",name:"JWT/Generic Secret",severity:"high",pattern:`(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded signing/API secret detected. Move it to an environment variable and rotate it."},{id:"password-in-code",subkind:"password_in_code",name:"Password in Code",severity:"high",pattern:`(?:password|passwd|pwd)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded password detected. Move it to a secret manager and rotate it."},{id:"bearer-token",subkind:"bearer_token",name:"Bearer Token in Code",severity:"high",pattern:`['"]Bearer\\s+[0-9a-zA-Z._-]{20,}['"]`,hint:"Hardcoded bearer token detected. Move it to a secret manager and rotate it."},{id:"hex-secret-32",subkind:"hex_secret",name:"Hardcoded 32+ Hex Secret",severity:"medium",pattern:`['"][0-9a-f]{32,}['"]`,hint:"Long hex string that looks like a secret/hash. Confirm it is not a live credential."},{id:"base64-secret",subkind:"base64_secret",name:"Hardcoded Base64 Secret (long)",severity:"medium",pattern:`['"][A-Za-z0-9+/]{64,}={0,2}['"]`,hint:"Long base64 blob that looks like an embedded secret. Confirm it is not a live credential."}]};var Bi=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name",labelHe:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA \u05D0\u05D9\u05DE\u05D9\u05D9\u05DC"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05DE\u05D6\u05D4\u05D4"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth",labelHe:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account",labelHe:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card",labelHe:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Financial data",labelHe:"\u05E0\u05EA\u05D5\u05DF \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication)$/i,type:"medical",label:"Medical data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(ip_?address)$/i,type:"tracking",label:"IP address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA IP"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D3\u05E8\u05DB\u05D5\u05DF"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license",labelHe:"\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4"},{pattern:/^(iban|swift_?code|bic)$/i,type:"financial",label:"Banking code",labelHe:"\u05E7\u05D5\u05D3 \u05D1\u05E0\u05E7\u05D0\u05D9"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05DE\u05E1"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Member ID",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D1\u05D9\u05D8\u05D5\u05D7/\u05D7\u05D1\u05E8"},{pattern:/^(blood_?type|allergy|allergies|prescription)$/i,type:"medical",label:"Medical data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation",labelHe:"\u05DE\u05D9\u05E7\u05D5\u05DD \u05D2\u05D9\u05D0\u05D5\u05D2\u05E8\u05E4\u05D9"},{pattern:/^(mac_?address|device_?fingerprint|imei|serial_?number)$/i,type:"tracking",label:"Device identifier",labelHe:"\u05DE\u05D6\u05D4\u05D4 \u05DE\u05DB\u05E9\u05D9\u05E8"},{pattern:/^(ethnicity|race|religion|political_?affiliation|sexual_?orientation)$/i,type:"sensitive_personal",label:"Sensitive personal",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(minor|child_?name|child_?age|dependent)$/i,type:"minor_data",label:"Minor data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05E0\u05D9\u05DD"},{pattern:/^(signature|digital_?signature)$/i,type:"id",label:"Signature",labelHe:"\u05D7\u05EA\u05D9\u05DE\u05D4"},{pattern:/^(vehicle_?number|license_?plate|plate_?number)$/i,type:"tracking",label:"Vehicle ID",labelHe:"\u05DE\u05D6\u05D4\u05D4 \u05E8\u05DB\u05D1"}],Wi=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|sort_?order|position|enabled|active|public|version|metadata|config|settings|options|data|content|body|raw|json|text|note|comment|label|color|icon|image|avatar|logo|thumbnail|preview|template|schema|format|mode|level|priority|severity|source|target|parent|child|owner|creator|modifier|assignee|project|workspace|organization|team|group|channel|thread|room|session|device|platform|browser|locale|timezone|currency|country|region|city|zip|postal|state|province|name|display_?name|user_?agent|password_?hash|secret|token|private_?key|auth_?token|constraint|index|sequence|trigger|function|procedure|database|namespace|migration|revision)$/i,Gi=/^(beacon_?registr|device_?config|hardware|sensor|firmware|telemetry|metric|analytic|log_?event|audit_?log|system_?config|cache|queue|job|migration|schema_?version|spatial_?ref)/i,Vi=/^(minor|major|uuid|rssi|tx_?power|beacon_?id|device_?type|firmware_?version|batch_?id|zone_?id)$/i;function jn(e,t){if(Wi.test(e)||/^name$/i.test(e)||t&&Gi.test(t)||Vi.test(e))return null;for(let n of Bi)if(n.pattern.test(e))return n.type;let r=Fn(e);return r?r.type:null}var Vc=Mn.rules.map(e=>({id:e.id,name:e.name,pattern:new RegExp(e.pattern),severity:e.severity}));var Zc=512*1024,Kc=50*1024*1024;var Zi={id:"high",agent_id:"high",policy:"high",financial:"high",medical:"critical",sensitive_personal:"critical",minor_data:"critical",biometric:"critical",auth:"critical",name:"medium",email:"high",phone:"high",address:"high",dob:"high",location:"high",tracking:"low"};function Ki(e){return Zi[e]??"low"}function zn(e,t){let r=[];for(let n of t){let s=n.rows.length;for(let i=0;i<n.headers.length;i++){let o=n.headers[i]??"",a=o?jn(o.trim().replace(/["'`׳״:]/g,"").replace(/\s+/g,"_"),n.name)??Ge(o)?.type??null:null,l=[];for(let u of n.rows){let d=u[i];typeof d=="string"&&d.length>0&&l.push(d)}let c=l.length>0?Hn(l):null;c?r.push(Un(e,n.name,o,c.type,c.label,"value",c.matchedSample,s)):a&&r.push(Un(e,n.name,o,a,Ve(a),"header",0,s))}}return r}function Un(e,t,r,n,s,i,o,a){return{file:e,location:t,column:r,type:n,label:s,category:Ve(n),severity:Ki(n),matchKind:i,hits:o,sampleSize:a}}var Bn={_comment:"CANONICAL secret ruleset \u2014 the SINGLE SOURCE OF TRUTH for hardcoded-secret detection, loaded by BOTH the web scanner (lib/soc/exposure-map.ts) and the installed Capsule agent (apps/desktop/src-tauri/src/scanner.rs, via include_str!). Patterns are written in the regex subset both JavaScript and the Rust `regex` crate accept (no lookaround, no backreferences). A connection string counts only WITH credentials (user:pass@). Edit here once and both engines stay aligned.",rules:[{id:"aws-access-key",subkind:"aws_access_key",name:"AWS Access Key",severity:"critical",pattern:"(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)",hint:"AWS access key id detected. Rotate via IAM and move to an environment variable."},{id:"aws-secret-key",subkind:"aws_secret_key",name:"AWS Secret Key",severity:"critical",pattern:`(?:aws_secret_access_key|aws_secret_key|secret_access_key)\\s*[=:]\\s*['"]?[A-Za-z0-9/+=]{40}['"]?`,hint:"AWS secret access key detected. Rotate immediately."},{id:"gcp-api-key",subkind:"gcp_api_key",name:"GCP API Key",severity:"critical",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Google API key detected. Restrict or rotate it in the Google Cloud console."},{id:"gcp-service-account",subkind:"gcp_service_account",name:"GCP Service Account",severity:"critical",pattern:'"type"\\s*:\\s*"service_account"',hint:"GCP service-account JSON detected. Move it out of the repo and rotate the key."},{id:"github-token",subkind:"github_token",name:"GitHub Token",severity:"critical",pattern:"gh[pousr]_[0-9a-zA-Z]{36,}",hint:"GitHub token detected. Revoke at https://github.com/settings/tokens."},{id:"github-fine-grained",subkind:"github_fine_grained_token",name:"GitHub Fine-Grained Token",severity:"critical",pattern:"github_pat_[0-9a-zA-Z_]{22,}",hint:"GitHub fine-grained token detected. Revoke it in GitHub settings."},{id:"gitlab-token",subkind:"gitlab_token",name:"GitLab Token",severity:"critical",pattern:"glpat-[0-9a-zA-Z_-]{20,}",hint:"GitLab token detected. Revoke it in GitLab access tokens."},{id:"stripe-secret",subkind:"stripe_key",name:"Stripe Secret Key",severity:"critical",pattern:"sk_live_[0-9a-zA-Z]{24,}",hint:"Stripe live secret key detected. Roll it in the Stripe dashboard."},{id:"stripe-restricted",subkind:"stripe_restricted_key",name:"Stripe Restricted Key",severity:"critical",pattern:"rk_live_[0-9a-zA-Z]{24,}",hint:"Stripe restricted key detected. Roll it in the Stripe dashboard."},{id:"slack-token",subkind:"slack_token",name:"Slack Token",severity:"high",pattern:"xox[baprs]-[0-9a-zA-Z-]{10,}",hint:"Slack token detected. Revoke it in the Slack app settings."},{id:"slack-webhook",subkind:"slack_webhook",name:"Slack Webhook",severity:"high",pattern:"hooks\\.slack\\.com/services/T[0-9A-Z]{8,}/B[0-9A-Z]{8,}/[0-9a-zA-Z]{24}",hint:"Slack incoming-webhook URL detected. Regenerate it."},{id:"twilio-api-key",subkind:"twilio_api_key",name:"Twilio API Key",severity:"high",pattern:"SK[0-9a-fA-F]{32}",hint:"Twilio API key detected. Rotate it in the Twilio console."},{id:"sendgrid-api-key",subkind:"sendgrid_api_key",name:"SendGrid API Key",severity:"critical",pattern:"SG\\.[0-9a-zA-Z_-]{22}\\.[0-9a-zA-Z_-]{43}",hint:"SendGrid API key detected. Rotate it in the SendGrid console."},{id:"postgres-uri",subkind:"postgres_uri",name:"PostgreSQL Connection String",severity:"critical",pattern:`postgres(?:ql)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"PostgreSQL connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"mongodb-uri",subkind:"mongodb_uri",name:"MongoDB Connection String",severity:"critical",pattern:`mongodb(?:\\+srv)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"MongoDB connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"redis-uri",subkind:"redis_uri",name:"Redis Connection String",severity:"high",pattern:`redis(?:s)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"Redis connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"openai-key",subkind:"openai_key",name:"OpenAI API Key",severity:"critical",pattern:"sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}",hint:"OpenAI API key detected. Rotate at https://platform.openai.com/api-keys."},{id:"anthropic-key",subkind:"anthropic_key",name:"Anthropic API Key",severity:"critical",pattern:"sk-ant-[0-9a-zA-Z_-]{40,}",hint:"Anthropic API key detected. Rotate at https://console.anthropic.com/."},{id:"firebase-key",subkind:"firebase_key",name:"Firebase API Key",severity:"high",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Firebase API key detected. Restrict it in the Firebase console."},{id:"supabase-key",subkind:"supabase_key",name:"Supabase Service Key",severity:"critical",pattern:"eyJ[0-9a-zA-Z_-]{100,}",hint:"Long JWT (possible Supabase service key) detected. Rotate it and keep it server-side only."},{id:"private-key",subkind:"private_key",name:"Private Key",severity:"critical",pattern:"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",hint:"Private key material in plaintext. Rotate immediately and move to a key manager (KMS/Vault).",skipPlaceholder:!0},{id:"jwt-secret",subkind:"jwt_secret",name:"JWT/Generic Secret",severity:"high",pattern:`(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded signing/API secret detected. Move it to an environment variable and rotate it."},{id:"password-in-code",subkind:"password_in_code",name:"Password in Code",severity:"high",pattern:`(?:password|passwd|pwd)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded password detected. Move it to a secret manager and rotate it."},{id:"bearer-token",subkind:"bearer_token",name:"Bearer Token in Code",severity:"high",pattern:`['"]Bearer\\s+[0-9a-zA-Z._-]{20,}['"]`,hint:"Hardcoded bearer token detected. Move it to a secret manager and rotate it."},{id:"hex-secret-32",subkind:"hex_secret",name:"Hardcoded 32+ Hex Secret",severity:"medium",pattern:`['"][0-9a-f]{32,}['"]`,hint:"Long hex string that looks like a secret/hash. Confirm it is not a live credential."},{id:"base64-secret",subkind:"base64_secret",name:"Hardcoded Base64 Secret (long)",severity:"medium",pattern:`['"][A-Za-z0-9+/]{64,}={0,2}['"]`,hint:"Long base64 blob that looks like an embedded secret. Confirm it is not a live credential."}]};var Ji=[{type:"full_name",kind:"name",severity:"medium",hint:`A person's name in free text (after a role word such as \u05DC\u05E7\u05D5\u05D7 / \u05DE\u05E8 / \u05E2\u05D5"\u05D3).`},{type:"bank_account",kind:"bank_account",severity:"high",hint:"An Israeli bank account number (branch-account-check form) in plaintext."},{type:"medical",kind:"medical",severity:"high",hint:"Medical information (diagnosis, medication, lab value) in plaintext."},{type:"birth_date",kind:"dob",severity:"medium",hint:"A date of birth in plaintext."},{type:"address",kind:"address",severity:"medium",hint:"A street address in plaintext."},{type:"license_plate",kind:"plate",severity:"low",hint:"A vehicle licence plate in plaintext."}],qi=/^(?:לקוח|מטופל|מועמד|שם|נהג|מבוטח|תובע|נתבע|שוכר|מחזיק|עו"ד|ד"ר|פרופ'|מר|גברת|חשבון|ח-ן|[בהוכלמש]{0,2}אבחנ[הות]|תאריך לידה|נולד|נולדה|ד\.ל\.|[בהוכלמש]{0,2}גיל)\s*:?\s*/;function Yi(e,t,r,n){if(n==="address")return{start:t,end:r};let s=qi.exec(e.slice(t,r));return s&&t+s[0].length<r?{start:t+s[0].length,end:r}:{start:t,end:r}}var Qi=new Set(["hex-secret-32","base64-secret"]),Wn=!1;function Gn(){if(Wn)return;Wn=!0;let e=Ji.map(({type:r,kind:n,severity:s,hint:i})=>{let o=new Ue([r]);return{kind:n,severity:s,hint:i,find:a=>o.detect(a).map(l=>Yi(a,l.startIndex,l.endIndex,n))}}),t=Bn.rules.filter(r=>!Qi.has(r.id)).map(r=>({id:r.id,name:r.name,severity:r.severity,pattern:new RegExp(r.pattern)}));Ze({text:e,header:r=>{let n=Ge(r);return n?{type:n.type,label:n.labelHe||n.label}:null},secrets:t,table:r=>zn("",[r]).filter(n=>n.column).map(n=>({column:n.column,type:n.type,category:n.category,severity:n.severity,hits:n.hits,how:n.matchKind==="value"?"value":"header"}))})}Gn();On(process.argv.slice(2)).catch(()=>{process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"ask",permissionDecisionReason:"NoData could not check this file before it is read. Allow anyway?"}}))});
|
|
54
|
+
`);u&&process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PostToolUse",additionalContext:u}}));return}let l=Yi(a,o.tool_input??{},o.cwd??process.cwd(),t,to(s,o));l.decision!=="allow"&&(eo(a,l),process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:l.decision,permissionDecisionReason:l.reason}})))}var no="claude-code",al=` --host ${no}`;var ro=[{type:"id_number",patterns:[/\b\d{9}\b/g,/ת\.?ז\.?\s*:?\s*(\d{9})/g,/זהות\s*:?\s*(\d{9})/g],confidence:.9,replacement:()=>"[\u05EA.\u05D6. \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"phone",patterns:[/\b0[2-9]\d[\s\-]?\d{7}\b/g,/\b05[0-9][\s\-]?\d{7}\b/g,/\+972[\s\-]?[2-9]\d[\s\-]?\d{7}\b/g],confidence:.95,replacement:()=>"[\u05D8\u05DC\u05E4\u05D5\u05DF \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"email",patterns:[/[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}/g],confidence:.99,replacement:e=>{let[,t]=e.split("@");return`[\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC: ***@${t}]`}},{type:"full_name",patterns:[/(?:לקוח|מטופל|מועמד|שם|נהג|מבוטח|תובע|נתבע|שוכר|מחזיק)[:\s]+([א-ת][א-ת"'\-\s]{2,30}?)(?=[,\n\d]|ת\.ז)/g,/(?:עו"ד|ד"ר|פרופ'|מר|גברת)\s+([א-ת][א-ת"'\-\s]{2,25}?)(?=[,\n])/g],confidence:.75,replacement:()=>"[\u05E9\u05DD \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"bank_account",patterns:[/\b\d{2}[\-]\d{5,9}[\-]\d{2,3}\b/g,/(?:חשבון|ח-ן)\s*:?\s*(\d[\d\-]{8,15})/g],confidence:.88,replacement:()=>"[\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"medical",patterns:[/(?<![א-ת])[בהוכלמש]{0,2}(?:סוכרת|יתר לחץ דם|אסתמה|דיכאון|חרדה|סרטן|אי ספיקת לב|אפילפסיה)(?![א-ת])/g,/\b(?:Metformin|Lisinopril|Atorvastatin|Amlodipine|Sertraline|Fluoxetine|Omeprazole|Warfarin|Aspirin|Insulin)\b/gi,/\bHbA1c\s*:?\s*[\d.]+%?/g,/\bBMI\s*:?\s*[\d.]+/g,/(?<![א-ת])[בהוכלמש]{0,2}אבחנ[הות]\s*:?\s*[^,\n.]{2,40}/g],confidence:.85,replacement:()=>"[\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"financial_amount",patterns:[/[\d,]+(?:\.\d{2})?\s*(?:₪|ש"ח|NIS|שקל(?:ים)?)/g,/(?:₪|NIS)\s*[\d,]+(?:\.\d{2})?/g],confidence:.92,replacement:()=>"[\u05E1\u05DB\u05D5\u05DD \u05DB\u05E1\u05E4\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"birth_date",patterns:[/(?:תאריך לידה|נולד|נולדה|ד\.ל\.)\s*:?\s*\d{1,2}[\/\.\-]\d{1,2}[\/\.\-]\d{2,4}/g,/(?<![א-ת])[בהוכלמש]{0,2}גיל\s*:?\s*\d{1,3}\b/g],confidence:.88,replacement:()=>"[\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"address",patterns:[/רחוב\s+[א-ת][א-ת\s"'\-]{2,30}\s+\d{1,5}/g,/(?:רח'|רח\.)\s+[א-ת][א-ת\s"'\-]{2,30}\d{1,5}/g],confidence:.72,replacement:()=>"[\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D5\u05E1\u05EA\u05E8\u05EA]"},{type:"license_plate",patterns:[/\b\d{2,3}[\-]\d{2,3}[\-]\d{2,3}\b/g],confidence:.8,replacement:()=>"[\u05DC\u05D5\u05D7\u05D9\u05EA \u05E8\u05D9\u05E9\u05D5\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8\u05EA]"}];function so(e){if(e.length!==9)return!1;let t=e.split("").map(Number),r=0;for(let n=0;n<9;n++){let s=t[n]*(n%2===0?1:2);s>9&&(s-=9),r+=s}return r%10===0}var We=class{constructor(t){this.enabledTypes=new Set(t)}detect(t){let r=[],n=new Set;for(let i of ro)if(this.enabledTypes.has(i.type))for(let o of i.patterns){let a=new RegExp(o.source,o.flags),l;for(;(l=a.exec(t))!==null;){let c=l[0],u=`${i.type}:${l.index}`;if(!n.has(u)){if(n.add(u),i.type==="id_number"){let d=c.replace(/\D/g,"");if(/^\d{9}$/.test(c)&&d.length===9&&!so(d))continue}r.push({type:i.type,value:c,startIndex:l.index,endIndex:l.index+c.length,confidence:i.confidence,replacement:i.replacement(c,i.type)})}}}r.sort((i,o)=>i.startIndex-o.startIndex||o.confidence-i.confidence);let s=[];for(let i of r)s.some(a=>i.startIndex<a.endIndex&&i.endIndex>a.startIndex)||s.push(i);return s}};var io=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם_אדם|שם הלקוח|שם_הלקוח|שם בן זוג|שם בן_זוג|שם המבוטח|שם_המבוטח|שם המוטב|שם_המוטב|שם מבוטח|שם_מבוטח|שם מוטב|שם_מוטב|שם הילד|שם_הילד|שם הקטין|שם_הקטין|firstname_he|lastname_he|shem|shem_mishpacha|shem_prati)$/i,type:"name",label:"Person name (Hebrew)",labelHe:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מספר_זהות|מס' זהות|מס_זהות|מס' ת"ז|teudat_zehut|tz|t_z|israeli_id|il_id)$/i,type:"id",label:"Israeli ID",labelHe:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|מס דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה|מס רישיון|דרכון_מספר)$/i,type:"id",label:"Passport / DL (Hebrew)",labelHe:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|דואר_אלקטרוני|אימייל|כתובת מייל|כתובת_מייל|כתובת דואר|כתובת_דואר)$/i,type:"email",label:"Email (Hebrew)",labelHe:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|מספר_טלפון|טלפון נייד|טלפון_נייד|מס נייד|מס_נייד|מס' טל)$/i,type:"phone",label:"Phone (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|כתובת_מגורים|רחוב|מס בית|מספר בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|כתובת_מלאה|מען)$/i,type:"address",label:"Address (Hebrew)",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|תאריך_לידה|ת לידה|תאריך הולדת|תאריך_הולדת|יום הולדת|יום_הולדת|גיל)$/i,type:"dob",label:"Date of birth (Hebrew)",labelHe:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|חשבון_בנק|מספר חשבון|מספר_חשבון|מס חשבון|מס' חשבון|בנק|סניף|מס סניף|iban|iban_il)$/i,type:"financial",label:"Bank account (Hebrew)",labelHe:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|כרטיס_אשראי|מספר אשראי|מס אשראי|מס' אשראי|cvv|אשראי|מס כרטיס|מס_כרטיס)$/i,type:"financial",label:"Credit card (Hebrew)",labelHe:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר_ברוטו|שכר נטו|שכר_נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"Salary / income (Hebrew)",labelHe:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|בדיקה_רפואית|מצב רפואי|מצב_רפואי|חיסון|תוצאת בדיקה|תוצאת_בדיקה|רופא|רגישות|אלרגיה|סוג דם|סוג_דם)$/i,type:"medical",label:"Medical (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מספר_פוליסה|מס פוליסה|מס' פוליסה|פוליסה|מספר חבר|מספר_חבר|מס חבר|מספר ביטוח|מספר_ביטוח|policy_?number|policy_?no|policy_?id)$/i,type:"policy",label:"Insurance policy number (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"},{pattern:/^(?:מספר סוכן|מספר_סוכן|מס סוכן|מס' סוכן|מס_סוכן|קוד סוכן|קוד_סוכן|מספר משווק|מספר_משווק|מספר יצרן|סוכן ביטוח|agent_?number|agent_?no|agent_?id|agent_?code|broker_?id|broker_?number)$/i,type:"agent_id",label:"Insurance agent / broker number (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF"},{pattern:/^(?:שם הילד|שם_הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|מספר_ילדים|תעודת לידה|ת לידה ילד)$/i,type:"minor_data",label:"Minor data (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|נטייה_מינית|השקפה פוליטית|השקפה_פוליטית|מצב משפחתי|מצב_משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"Sensitive personal (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מספר_רכב|מס רכב|מס' רכב|לוחית רישוי|לוחית_רישוי|מספר רישוי|מספר_רישוי)$/i,type:"tracking",label:"Vehicle ID (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}];function Tt(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let r=t.padStart(9,"0"),n=0;for(let s=0;s<9;s++){let i=parseInt(r[s]??"0",10)*(s%2+1);i>9&&(i-=9),n+=i}return n%10===0&&parseInt(r,10)>0}var Ge=/(?:\+972[\s-]?|0)(?:5[0-9]|[2-4]|[89])(?:[\s-]?\d){7}/g,Ve=/[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}/gi,Ke=/\bIL\d{2}\s?(?:\d{4}\s?){4}\d{3}\b/g;function Jn(e){let t=String(e??"").replace(/\D/g,"");if(t.length<13||t.length>19)return!1;let r=0,n=!1;for(let s=t.length-1;s>=0;s--){let i=t.charCodeAt(s)-48;if(i<0||i>9)return!1;n&&(i*=2,i>9&&(i-=9)),r+=i,n=!n}return r%10===0}function qn(e){if(!e)return null;let t=e.trim();for(let r of io)if(r.pattern.test(t))return{type:r.type,label:r.label,labelHe:r.labelHe};return null}var oo=[{type:"biometric",tokens:["biometric","fingerprint","\u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9"],phrases:["face id","\u05D8\u05D1\u05D9\u05E2\u05EA \u05D0\u05E6\u05D1\u05E2"]},{type:"medical",tokens:["diagnosis","medical","disease","medication","prescription","allergy","vaccine","\u05D0\u05D1\u05D7\u05D5\u05DF","\u05D0\u05D1\u05D7\u05E0\u05D4","\u05DE\u05D7\u05DC\u05D4","\u05EA\u05E8\u05D5\u05E4\u05D4","\u05DE\u05E8\u05E9\u05DD","\u05D7\u05D9\u05E1\u05D5\u05DF","\u05D0\u05DC\u05E8\u05D2\u05D9\u05D4"],phrases:["medical record","blood type","\u05DE\u05E6\u05D1 \u05E8\u05E4\u05D5\u05D0\u05D9","\u05E1\u05D5\u05D2 \u05D3\u05DD"]},{type:"sensitive_personal",tokens:["religion","ethnicity","nationality","\u05D3\u05EA","\u05DC\u05D0\u05D5\u05DD","\u05E2\u05D3\u05D4","\u05DE\u05D5\u05E6\u05D0"],phrases:["sexual orientation","marital status","\u05DE\u05E6\u05D1 \u05DE\u05E9\u05E4\u05D7\u05EA\u05D9","\u05E0\u05D8\u05D9\u05D9\u05D4 \u05DE\u05D9\u05E0\u05D9\u05EA"]},{type:"minor_data",tokens:["minor","\u05E7\u05D8\u05D9\u05DF"],phrases:["child name","\u05E9\u05DD \u05D4\u05D9\u05DC\u05D3","\u05E9\u05DD \u05D4\u05E7\u05D8\u05D9\u05DF"]},{type:"id",tokens:["ssn","passport","\u05D6\u05D4\u05D5\u05EA","\u05D3\u05E8\u05DB\u05D5\u05DF"],phrases:["national id","id number","identity number","social security","driver license","driving license","drivers license","passport number","tax id","\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA","\u05DE\u05E1\u05E4\u05E8 \u05D6\u05D4\u05D5\u05EA","\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4"]},{type:"financial",tokens:["iban","swift","bic","salary","income","wage","\u05D0\u05E9\u05E8\u05D0\u05D9","\u05E9\u05DB\u05E8","\u05DE\u05E9\u05DB\u05D5\u05E8\u05EA","\u05D4\u05DB\u05E0\u05E1\u05D4"],phrases:["bank account","account number","credit card","card number","routing number","sort code","\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7","\u05DE\u05E1\u05E4\u05E8 \u05D7\u05E9\u05D1\u05D5\u05DF","\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"]},{type:"policy",tokens:["policy","\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"],phrases:["policy number","member number","\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"]},{type:"agent_id",tokens:["\u05DE\u05E9\u05D5\u05D5\u05E7"],phrases:["agent number","agent code","broker id","\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF"]},{type:"dob",tokens:["dob","birthdate","birthday","\u05DC\u05D9\u05D3\u05D4","\u05D4\u05D5\u05DC\u05D3\u05EA","\u05D2\u05D9\u05DC"],phrases:["date of birth","birth date","\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"]},{type:"phone",tokens:["phone","tel","mobile","cell","fax","\u05D8\u05DC\u05E4\u05D5\u05DF","\u05E0\u05D9\u05D9\u05D3","\u05E4\u05DC\u05D0\u05E4\u05D5\u05DF","\u05E1\u05DC\u05D5\u05DC\u05E8\u05D9"],phrases:["phone number","mobile number","cell phone","\u05D8\u05DC\u05E4\u05D5\u05DF \u05E0\u05D9\u05D9\u05D3"]},{type:"email",tokens:["email","mail","\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC","\u05DE\u05D9\u05D9\u05DC","\u05D3\u05D5\u05D0\u05DC"],phrases:["email address","e mail","\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D9\u05D9\u05DC"]},{type:"address",tokens:["address","street","city","zipcode","zip","postcode","\u05DB\u05EA\u05D5\u05D1\u05EA","\u05E8\u05D7\u05D5\u05D1","\u05E2\u05D9\u05E8","\u05D9\u05E9\u05D5\u05D1","\u05D9\u05D9\u05E9\u05D5\u05D1","\u05DE\u05D9\u05E7\u05D5\u05D3","\u05DE\u05E2\u05DF"],phrases:["home address","postal code","street address","zip code","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D2\u05D5\u05E8\u05D9\u05DD"]},{type:"location",tokens:["gps","latitude","longitude","geolocation","\u05DE\u05D9\u05E7\u05D5\u05DD"],phrases:["gps coordinates"]},{type:"tracking",tokens:["plate","vehicle","\u05E8\u05DB\u05D1","\u05E8\u05D9\u05E9\u05D5\u05D9"],phrases:["license plate","vehicle number","plate number","\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"]},{type:"name",tokens:["name","\u05E9\u05DD"],phrases:["first name","last name","full name","family name","given name","surname","\u05E9\u05DD \u05E4\u05E8\u05D8\u05D9","\u05E9\u05DD \u05DE\u05E9\u05E4\u05D7\u05D4","\u05E9\u05DD \u05DE\u05DC\u05D0"]}];function Ze(e){if(!e)return null;let t=e.trim().toLowerCase().replace(/["'`׳״]/g,"").replace(/[_\-.]+/g," ").replace(/\s+/g," ").trim();if(!t)return null;let r=new Set(t.match(/[\p{L}\p{N}]+/gu)??[]);for(let n of oo)if(n.phrases?.some(i=>t.includes(i))||n.tokens?.some(i=>r.has(i)))return{type:n.type,label:n.type,labelHe:Xe(n.type)};return null}function Xe(e){return{id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",name:"\u05E9\u05DD \u05D0\u05D3\u05DD",email:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9",phone:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",financial:"\u05E4\u05E8\u05D8\u05D9\u05DD \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9\u05D9\u05DD",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",minor_data:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF",sensitive_personal:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9",biometric:"\u05DE\u05D9\u05D3\u05E2 \u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9",auth:"\u05E1\u05D9\u05E1\u05DE\u05D0\u05D5\u05EA/\u05E1\u05D5\u05D3\u05D5\u05EA",tracking:"\u05DE\u05D6\u05D4\u05D9 \u05DE\u05E2\u05E7\u05D1",location:"\u05DE\u05D9\u05E7\u05D5\u05DD"}[e]??"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9"}function Yn(e){let t=0,r=0,n=0,s=0,i=0;for(let a of e)typeof a=="string"&&(Tt(a)&&t++,Ge.lastIndex=0,Ge.test(a)&&r++,Ve.lastIndex=0,Ve.test(a)&&n++,Ke.lastIndex=0,Ke.test(a)&&s++,Jn(a)&&i++);let o=e.length||1;return t/o>=.3?{type:"id",label:"Israeli ID (sniffed)",matchedSample:t}:s/o>=.3?{type:"financial",label:"IBAN-IL (sniffed)",matchedSample:s}:r/o>=.3?{type:"phone",label:"IL phone (sniffed)",matchedSample:r}:n/o>=.3?{type:"email",label:"Email (sniffed)",matchedSample:n}:i/o>=.3?{type:"financial",label:"Credit card (sniffed)",matchedSample:i}:null}var Qn={_comment:"CANONICAL secret ruleset \u2014 the SINGLE SOURCE OF TRUTH for hardcoded-secret detection, loaded by BOTH the web scanner (lib/soc/exposure-map.ts) and the installed Capsule agent (apps/desktop/src-tauri/src/scanner.rs, via include_str!). Patterns are written in the regex subset both JavaScript and the Rust `regex` crate accept (no lookaround, no backreferences). A connection string counts only WITH credentials (user:pass@). Edit here once and both engines stay aligned.",rules:[{id:"aws-access-key",subkind:"aws_access_key",name:"AWS Access Key",severity:"critical",pattern:"(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)",hint:"AWS access key id detected. Rotate via IAM and move to an environment variable."},{id:"aws-secret-key",subkind:"aws_secret_key",name:"AWS Secret Key",severity:"critical",pattern:`(?:aws_secret_access_key|aws_secret_key|secret_access_key)\\s*[=:]\\s*['"]?[A-Za-z0-9/+=]{40}['"]?`,hint:"AWS secret access key detected. Rotate immediately."},{id:"gcp-api-key",subkind:"gcp_api_key",name:"GCP API Key",severity:"critical",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Google API key detected. Restrict or rotate it in the Google Cloud console."},{id:"gcp-service-account",subkind:"gcp_service_account",name:"GCP Service Account",severity:"critical",pattern:'"type"\\s*:\\s*"service_account"',hint:"GCP service-account JSON detected. Move it out of the repo and rotate the key."},{id:"github-token",subkind:"github_token",name:"GitHub Token",severity:"critical",pattern:"gh[pousr]_[0-9a-zA-Z]{36,}",hint:"GitHub token detected. Revoke at https://github.com/settings/tokens."},{id:"github-fine-grained",subkind:"github_fine_grained_token",name:"GitHub Fine-Grained Token",severity:"critical",pattern:"github_pat_[0-9a-zA-Z_]{22,}",hint:"GitHub fine-grained token detected. Revoke it in GitHub settings."},{id:"gitlab-token",subkind:"gitlab_token",name:"GitLab Token",severity:"critical",pattern:"glpat-[0-9a-zA-Z_-]{20,}",hint:"GitLab token detected. Revoke it in GitLab access tokens."},{id:"stripe-secret",subkind:"stripe_key",name:"Stripe Secret Key",severity:"critical",pattern:"sk_live_[0-9a-zA-Z]{24,}",hint:"Stripe live secret key detected. Roll it in the Stripe dashboard."},{id:"stripe-restricted",subkind:"stripe_restricted_key",name:"Stripe Restricted Key",severity:"critical",pattern:"rk_live_[0-9a-zA-Z]{24,}",hint:"Stripe restricted key detected. Roll it in the Stripe dashboard."},{id:"slack-token",subkind:"slack_token",name:"Slack Token",severity:"high",pattern:"xox[baprs]-[0-9a-zA-Z-]{10,}",hint:"Slack token detected. Revoke it in the Slack app settings."},{id:"slack-webhook",subkind:"slack_webhook",name:"Slack Webhook",severity:"high",pattern:"hooks\\.slack\\.com/services/T[0-9A-Z]{8,}/B[0-9A-Z]{8,}/[0-9a-zA-Z]{24}",hint:"Slack incoming-webhook URL detected. Regenerate it."},{id:"twilio-api-key",subkind:"twilio_api_key",name:"Twilio API Key",severity:"high",pattern:"SK[0-9a-fA-F]{32}",hint:"Twilio API key detected. Rotate it in the Twilio console."},{id:"sendgrid-api-key",subkind:"sendgrid_api_key",name:"SendGrid API Key",severity:"critical",pattern:"SG\\.[0-9a-zA-Z_-]{22}\\.[0-9a-zA-Z_-]{43}",hint:"SendGrid API key detected. Rotate it in the SendGrid console."},{id:"postgres-uri",subkind:"postgres_uri",name:"PostgreSQL Connection String",severity:"critical",pattern:`postgres(?:ql)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"PostgreSQL connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"mongodb-uri",subkind:"mongodb_uri",name:"MongoDB Connection String",severity:"critical",pattern:`mongodb(?:\\+srv)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"MongoDB connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"redis-uri",subkind:"redis_uri",name:"Redis Connection String",severity:"high",pattern:`redis(?:s)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"Redis connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"openai-key",subkind:"openai_key",name:"OpenAI API Key",severity:"critical",pattern:"sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}",hint:"OpenAI API key detected. Rotate at https://platform.openai.com/api-keys."},{id:"anthropic-key",subkind:"anthropic_key",name:"Anthropic API Key",severity:"critical",pattern:"sk-ant-[0-9a-zA-Z_-]{40,}",hint:"Anthropic API key detected. Rotate at https://console.anthropic.com/."},{id:"firebase-key",subkind:"firebase_key",name:"Firebase API Key",severity:"high",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Firebase API key detected. Restrict it in the Firebase console."},{id:"supabase-key",subkind:"supabase_key",name:"Supabase Service Key",severity:"critical",pattern:"eyJ[0-9a-zA-Z_-]{100,}",hint:"Long JWT (possible Supabase service key) detected. Rotate it and keep it server-side only."},{id:"private-key",subkind:"private_key",name:"Private Key",severity:"critical",pattern:"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",hint:"Private key material in plaintext. Rotate immediately and move to a key manager (KMS/Vault).",skipPlaceholder:!0},{id:"jwt-secret",subkind:"jwt_secret",name:"JWT/Generic Secret",severity:"high",pattern:`(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded signing/API secret detected. Move it to an environment variable and rotate it."},{id:"password-in-code",subkind:"password_in_code",name:"Password in Code",severity:"high",pattern:`(?:password|passwd|pwd)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded password detected. Move it to a secret manager and rotate it."},{id:"bearer-token",subkind:"bearer_token",name:"Bearer Token in Code",severity:"high",pattern:`['"]Bearer\\s+[0-9a-zA-Z._-]{20,}['"]`,hint:"Hardcoded bearer token detected. Move it to a secret manager and rotate it."},{id:"hex-secret-32",subkind:"hex_secret",name:"Hardcoded 32+ Hex Secret",severity:"medium",pattern:`['"][0-9a-f]{32,}['"]`,hint:"Long hex string that looks like a secret/hash. Confirm it is not a live credential."},{id:"base64-secret",subkind:"base64_secret",name:"Hardcoded Base64 Secret (long)",severity:"medium",pattern:`['"][A-Za-z0-9+/]{64,}={0,2}['"]`,hint:"Long base64 blob that looks like an embedded secret. Confirm it is not a live credential."}]};var lo=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name",labelHe:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA \u05D0\u05D9\u05DE\u05D9\u05D9\u05DC"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05DE\u05D6\u05D4\u05D4"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth",labelHe:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account",labelHe:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card",labelHe:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Financial data",labelHe:"\u05E0\u05EA\u05D5\u05DF \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication)$/i,type:"medical",label:"Medical data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(ip_?address)$/i,type:"tracking",label:"IP address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA IP"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D3\u05E8\u05DB\u05D5\u05DF"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license",labelHe:"\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4"},{pattern:/^(iban|swift_?code|bic)$/i,type:"financial",label:"Banking code",labelHe:"\u05E7\u05D5\u05D3 \u05D1\u05E0\u05E7\u05D0\u05D9"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05DE\u05E1"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Member ID",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D1\u05D9\u05D8\u05D5\u05D7/\u05D7\u05D1\u05E8"},{pattern:/^(blood_?type|allergy|allergies|prescription)$/i,type:"medical",label:"Medical data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation",labelHe:"\u05DE\u05D9\u05E7\u05D5\u05DD \u05D2\u05D9\u05D0\u05D5\u05D2\u05E8\u05E4\u05D9"},{pattern:/^(mac_?address|device_?fingerprint|imei|serial_?number)$/i,type:"tracking",label:"Device identifier",labelHe:"\u05DE\u05D6\u05D4\u05D4 \u05DE\u05DB\u05E9\u05D9\u05E8"},{pattern:/^(ethnicity|race|religion|political_?affiliation|sexual_?orientation)$/i,type:"sensitive_personal",label:"Sensitive personal",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(minor|child_?name|child_?age|dependent)$/i,type:"minor_data",label:"Minor data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05E0\u05D9\u05DD"},{pattern:/^(signature|digital_?signature)$/i,type:"id",label:"Signature",labelHe:"\u05D7\u05EA\u05D9\u05DE\u05D4"},{pattern:/^(vehicle_?number|license_?plate|plate_?number)$/i,type:"tracking",label:"Vehicle ID",labelHe:"\u05DE\u05D6\u05D4\u05D4 \u05E8\u05DB\u05D1"}],uo=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|sort_?order|position|enabled|active|public|version|metadata|config|settings|options|data|content|body|raw|json|text|note|comment|label|color|icon|image|avatar|logo|thumbnail|preview|template|schema|format|mode|level|priority|severity|source|target|parent|child|owner|creator|modifier|assignee|project|workspace|organization|team|group|channel|thread|room|session|device|platform|browser|locale|timezone|currency|country|region|city|zip|postal|state|province|name|display_?name|user_?agent|password_?hash|secret|token|private_?key|auth_?token|constraint|index|sequence|trigger|function|procedure|database|namespace|migration|revision)$/i,po=/^(beacon_?registr|device_?config|hardware|sensor|firmware|telemetry|metric|analytic|log_?event|audit_?log|system_?config|cache|queue|job|migration|schema_?version|spatial_?ref)/i,fo=/^(minor|major|uuid|rssi|tx_?power|beacon_?id|device_?type|firmware_?version|batch_?id|zone_?id)$/i;function er(e,t){if(uo.test(e)||/^name$/i.test(e)||t&&po.test(t)||fo.test(e))return null;for(let n of lo)if(n.pattern.test(e))return n.type;let r=qn(e);return r?r.type:null}var hl=Qn.rules.map(e=>({id:e.id,name:e.name,pattern:new RegExp(e.pattern),severity:e.severity}));var ml=512*1024,gl=50*1024*1024;var ho={id:"high",agent_id:"high",policy:"high",financial:"high",medical:"critical",sensitive_personal:"critical",minor_data:"critical",biometric:"critical",auth:"critical",name:"medium",email:"high",phone:"high",address:"high",dob:"high",location:"high",tracking:"low"};function mo(e){return ho[e]??"low"}function nr(e,t){let r=[];for(let n of t){let s=n.rows.length;for(let i=0;i<n.headers.length;i++){let o=n.headers[i]??"",a=o?er(o.trim().replace(/["'`׳״:]/g,"").replace(/\s+/g,"_"),n.name)??Ze(o)?.type??null:null,l=[];for(let u of n.rows){let d=u[i];typeof d=="string"&&d.length>0&&l.push(d)}let c=l.length>0?Yn(l):null;c?r.push(tr(e,n.name,o,c.type,c.label,"value",c.matchedSample,s)):a&&r.push(tr(e,n.name,o,a,Xe(a),"header",0,s))}}return r}function tr(e,t,r,n,s,i,o,a){return{file:e,location:t,column:r,type:n,label:s,category:Xe(n),severity:mo(n),matchKind:i,hits:o,sampleSize:a}}var rr={_comment:"CANONICAL secret ruleset \u2014 the SINGLE SOURCE OF TRUTH for hardcoded-secret detection, loaded by BOTH the web scanner (lib/soc/exposure-map.ts) and the installed Capsule agent (apps/desktop/src-tauri/src/scanner.rs, via include_str!). Patterns are written in the regex subset both JavaScript and the Rust `regex` crate accept (no lookaround, no backreferences). A connection string counts only WITH credentials (user:pass@). Edit here once and both engines stay aligned.",rules:[{id:"aws-access-key",subkind:"aws_access_key",name:"AWS Access Key",severity:"critical",pattern:"(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)",hint:"AWS access key id detected. Rotate via IAM and move to an environment variable."},{id:"aws-secret-key",subkind:"aws_secret_key",name:"AWS Secret Key",severity:"critical",pattern:`(?:aws_secret_access_key|aws_secret_key|secret_access_key)\\s*[=:]\\s*['"]?[A-Za-z0-9/+=]{40}['"]?`,hint:"AWS secret access key detected. Rotate immediately."},{id:"gcp-api-key",subkind:"gcp_api_key",name:"GCP API Key",severity:"critical",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Google API key detected. Restrict or rotate it in the Google Cloud console."},{id:"gcp-service-account",subkind:"gcp_service_account",name:"GCP Service Account",severity:"critical",pattern:'"type"\\s*:\\s*"service_account"',hint:"GCP service-account JSON detected. Move it out of the repo and rotate the key."},{id:"github-token",subkind:"github_token",name:"GitHub Token",severity:"critical",pattern:"gh[pousr]_[0-9a-zA-Z]{36,}",hint:"GitHub token detected. Revoke at https://github.com/settings/tokens."},{id:"github-fine-grained",subkind:"github_fine_grained_token",name:"GitHub Fine-Grained Token",severity:"critical",pattern:"github_pat_[0-9a-zA-Z_]{22,}",hint:"GitHub fine-grained token detected. Revoke it in GitHub settings."},{id:"gitlab-token",subkind:"gitlab_token",name:"GitLab Token",severity:"critical",pattern:"glpat-[0-9a-zA-Z_-]{20,}",hint:"GitLab token detected. Revoke it in GitLab access tokens."},{id:"stripe-secret",subkind:"stripe_key",name:"Stripe Secret Key",severity:"critical",pattern:"sk_live_[0-9a-zA-Z]{24,}",hint:"Stripe live secret key detected. Roll it in the Stripe dashboard."},{id:"stripe-restricted",subkind:"stripe_restricted_key",name:"Stripe Restricted Key",severity:"critical",pattern:"rk_live_[0-9a-zA-Z]{24,}",hint:"Stripe restricted key detected. Roll it in the Stripe dashboard."},{id:"slack-token",subkind:"slack_token",name:"Slack Token",severity:"high",pattern:"xox[baprs]-[0-9a-zA-Z-]{10,}",hint:"Slack token detected. Revoke it in the Slack app settings."},{id:"slack-webhook",subkind:"slack_webhook",name:"Slack Webhook",severity:"high",pattern:"hooks\\.slack\\.com/services/T[0-9A-Z]{8,}/B[0-9A-Z]{8,}/[0-9a-zA-Z]{24}",hint:"Slack incoming-webhook URL detected. Regenerate it."},{id:"twilio-api-key",subkind:"twilio_api_key",name:"Twilio API Key",severity:"high",pattern:"SK[0-9a-fA-F]{32}",hint:"Twilio API key detected. Rotate it in the Twilio console."},{id:"sendgrid-api-key",subkind:"sendgrid_api_key",name:"SendGrid API Key",severity:"critical",pattern:"SG\\.[0-9a-zA-Z_-]{22}\\.[0-9a-zA-Z_-]{43}",hint:"SendGrid API key detected. Rotate it in the SendGrid console."},{id:"postgres-uri",subkind:"postgres_uri",name:"PostgreSQL Connection String",severity:"critical",pattern:`postgres(?:ql)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"PostgreSQL connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"mongodb-uri",subkind:"mongodb_uri",name:"MongoDB Connection String",severity:"critical",pattern:`mongodb(?:\\+srv)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"MongoDB connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"redis-uri",subkind:"redis_uri",name:"Redis Connection String",severity:"high",pattern:`redis(?:s)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"Redis connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"openai-key",subkind:"openai_key",name:"OpenAI API Key",severity:"critical",pattern:"sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}",hint:"OpenAI API key detected. Rotate at https://platform.openai.com/api-keys."},{id:"anthropic-key",subkind:"anthropic_key",name:"Anthropic API Key",severity:"critical",pattern:"sk-ant-[0-9a-zA-Z_-]{40,}",hint:"Anthropic API key detected. Rotate at https://console.anthropic.com/."},{id:"firebase-key",subkind:"firebase_key",name:"Firebase API Key",severity:"high",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Firebase API key detected. Restrict it in the Firebase console."},{id:"supabase-key",subkind:"supabase_key",name:"Supabase Service Key",severity:"critical",pattern:"eyJ[0-9a-zA-Z_-]{100,}",hint:"Long JWT (possible Supabase service key) detected. Rotate it and keep it server-side only."},{id:"private-key",subkind:"private_key",name:"Private Key",severity:"critical",pattern:"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",hint:"Private key material in plaintext. Rotate immediately and move to a key manager (KMS/Vault).",skipPlaceholder:!0},{id:"jwt-secret",subkind:"jwt_secret",name:"JWT/Generic Secret",severity:"high",pattern:`(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded signing/API secret detected. Move it to an environment variable and rotate it."},{id:"password-in-code",subkind:"password_in_code",name:"Password in Code",severity:"high",pattern:`(?:password|passwd|pwd)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded password detected. Move it to a secret manager and rotate it."},{id:"bearer-token",subkind:"bearer_token",name:"Bearer Token in Code",severity:"high",pattern:`['"]Bearer\\s+[0-9a-zA-Z._-]{20,}['"]`,hint:"Hardcoded bearer token detected. Move it to a secret manager and rotate it."},{id:"hex-secret-32",subkind:"hex_secret",name:"Hardcoded 32+ Hex Secret",severity:"medium",pattern:`['"][0-9a-f]{32,}['"]`,hint:"Long hex string that looks like a secret/hash. Confirm it is not a live credential."},{id:"base64-secret",subkind:"base64_secret",name:"Hardcoded Base64 Secret (long)",severity:"medium",pattern:`['"][A-Za-z0-9+/]{64,}={0,2}['"]`,hint:"Long base64 blob that looks like an embedded secret. Confirm it is not a live credential."}]};var yo=[{type:"full_name",kind:"name",severity:"medium",hint:`A person's name in free text (after a role word such as \u05DC\u05E7\u05D5\u05D7 / \u05DE\u05E8 / \u05E2\u05D5"\u05D3).`},{type:"bank_account",kind:"bank_account",severity:"high",hint:"An Israeli bank account number (branch-account-check form) in plaintext."},{type:"medical",kind:"medical",severity:"high",hint:"Medical information (diagnosis, medication, lab value) in plaintext."},{type:"birth_date",kind:"dob",severity:"medium",hint:"A date of birth in plaintext."},{type:"address",kind:"address",severity:"medium",hint:"A street address in plaintext."},{type:"license_plate",kind:"plate",severity:"low",hint:"A vehicle licence plate in plaintext."}],bo=/^(?:לקוח|מטופל|מועמד|שם|נהג|מבוטח|תובע|נתבע|שוכר|מחזיק|עו"ד|ד"ר|פרופ'|מר|גברת|חשבון|ח-ן|[בהוכלמש]{0,2}אבחנ[הות]|תאריך לידה|נולד|נולדה|ד\.ל\.|[בהוכלמש]{0,2}גיל)\s*:?\s*/;function _o(e,t,r,n){if(n==="address")return{start:t,end:r};let s=bo.exec(e.slice(t,r));return s&&t+s[0].length<r?{start:t+s[0].length,end:r}:{start:t,end:r}}var ko=new Set(["hex-secret-32","base64-secret"]),sr=!1;function ir(){if(sr)return;sr=!0;let e=yo.map(({type:r,kind:n,severity:s,hint:i})=>{let o=new We([r]);return{kind:n,severity:s,hint:i,find:a=>o.detect(a).map(l=>_o(a,l.startIndex,l.endIndex,n))}}),t=rr.rules.filter(r=>!ko.has(r.id)).map(r=>({id:r.id,name:r.name,severity:r.severity,pattern:new RegExp(r.pattern)}));Je({text:e,header:r=>{let n=Ze(r);return n?{type:n.type,label:n.labelHe||n.label}:null},secrets:t,table:r=>nr("",[r]).filter(n=>n.column).map(n=>({column:n.column,type:n.type,category:n.category,severity:n.severity,hits:n.hits,how:n.matchKind==="value"?"value":"header"}))})}ir();Xn(process.argv.slice(2)).catch(()=>{process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"ask",permissionDecisionReason:"NoData could not check this file before it is read. Allow anyway?"}}))});
|