@nodatachat/mcp 1.3.8 → 1.3.12

package/README.md

@@ -168,6 +168,20 @@ npx @nodatachat/mcp secrets-logout
 
 **Honest limit:** a command that holds a secret can also leak it, for example by sending it out or printing it in an unknown form. Blanking protects the chat, not a hostile command, and that is why each command is approved as written.
 
+## Language — עברית or English, all the way
+
+Choose once; NoData keeps it everywhere it speaks. That covers the read gate's question, the
+status line and the reminder after a read. It also covers an instruction every agent on this
+machine receives to answer you in that language for the whole session. Until you choose, the
+machine's own locale decides.
+
+```bash
+npx @nodatachat/mcp lang he     # עברית
+npx @nodatachat/mcp lang en     # English
+```
+
+The agent also asks once, when you accept the terms (`nodata_terms`).
+
 ## The read gate — a scan before the assistant reads
 
 The MCP tools keep values out of the model only when the model uses them; Claude Code can also
@@ -183,8 +197,13 @@ Before Claude Code reads a data file (csv, xlsx, docx, pdf, .env …), the gate
 machine with the same detectors as `nodata_scan_folder`. Findings → you are asked (or the read is
 refused), with the counts and the safer step: `nodata_redact` for a clean copy, `nodata_protect`
 to lock it. Clean copies, sealed files and source code pass without a question. The gate catches
-a Read, a Grep on a file, and a Bash command that names the file; a program that builds the path
-at run time is not caught — `nodata_protect` (ciphertext at rest) is what makes a file unreadable.
+a Read, a Grep on a file, and a Bash or PowerShell command that names the file — also inside the
+script it runs (`python -c "…load_workbook('x.xlsx')…"`); a program that builds the path at run
+time is not caught — `nodata_protect` (ciphertext at rest) is what makes a file unreadable.
+
+After you approve a read, a second hook reminds the assistant, right before it answers, that the
+file holds personal data and your screen is not private: totals and counts, no names or numbers
+unless you ask for them.
 
 ## Available tools
 

package/dist/gate.js

@@ -1,18 +1,24 @@
-/*! @nodatachat/mcp 1.3.8 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
-import{appendFileSync as ht,copyFileSync as Hn,existsSync as gt,mkdirSync as yt,readFileSync as bt,statSync as ve,writeFileSync as zn}from"node:fs";import{homedir as Se}from"node:os";import{basename as _t,extname as we,isAbsolute as xt,join as ke,resolve as kt}from"node:path";var k={text:[],header:[],secrets:[]};function N(t){for(let e of t.text??[])k.text.some(n=>n.kind===e.kind)||k.text.push(e);t.header&&!k.header.includes(t.header)&&k.header.push(t.header);for(let e of t.secrets??[])k.secrets.some(n=>n.id===e.id)||k.secrets.push(e)}function U(){return k.text}function te(){return k.header}var ne=[{id:"aws-access-key",name:"AWS Access Key",pattern:/(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)/,severity:"critical"},{id:"aws-secret-key",name:"AWS Secret Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/,severity:"critical"},{id:"gcp-api-key",name:"GCP API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"critical"},{id:"gcp-service-account",name:"GCP Service Account",pattern:/"type"\s*:\s*"service_account"/,severity:"critical"},{id:"github-token",name:"GitHub Token",pattern:/gh[pousr]_[0-9a-zA-Z]{36,}/,severity:"critical"},{id:"github-fine-grained",name:"GitHub Fine-Grained Token",pattern:/github_pat_[0-9a-zA-Z_]{22,}/,severity:"critical"},{id:"gitlab-token",name:"GitLab Token",pattern:/glpat-[0-9a-zA-Z_-]{20,}/,severity:"critical"},{id:"stripe-secret",name:"Stripe Secret Key",pattern:/sk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"stripe-restricted",name:"Stripe Restricted Key",pattern:/rk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"slack-token",name:"Slack Token",pattern:/xox[baprs]-[0-9a-zA-Z-]{10,}/,severity:"high"},{id:"slack-webhook",name:"Slack Webhook",pattern:/hooks\.slack\.com\/services\/T[0-9A-Z]{8,}\/B[0-9A-Z]{8,}\/[0-9a-zA-Z]{24}/,severity:"high"},{id:"twilio-api-key",name:"Twilio API Key",pattern:/SK[0-9a-fA-F]{32}/,severity:"high"},{id:"sendgrid-api-key",name:"SendGrid API Key",pattern:/SG\.[0-9a-zA-Z_-]{22}\.[0-9a-zA-Z_-]{43}/,severity:"critical"},{id:"postgres-uri",name:"PostgreSQL Connection String",pattern:/postgres(?:ql)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"mongodb-uri",name:"MongoDB Connection String",pattern:/mongodb(?:\+srv)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"redis-uri",name:"Redis Connection String",pattern:/redis(?:s)?:\/\/[^\s'"]{10,}/,severity:"high"},{id:"openai-key",name:"OpenAI API Key",pattern:/sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}/,severity:"critical"},{id:"anthropic-key",name:"Anthropic API Key",pattern:/sk-ant-[0-9a-zA-Z_-]{40,}/,severity:"critical"},{id:"firebase-key",name:"Firebase API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"high"},{id:"supabase-key",name:"Supabase Service Key",pattern:/eyJ[0-9a-zA-Z_-]{100,}/,severity:"critical"},{id:"private-key",name:"Private Key",pattern:/-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,severity:"critical"},{id:"jwt-secret",name:"JWT/Generic Secret",pattern:/(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"password-in-code",name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"bearer-token",name:"Bearer Token in Code",pattern:/['"]Bearer\s+[0-9a-zA-Z._-]{20,}['"]/,severity:"high"}];var Le=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Salary / income"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication|prescription)$/i,type:"medical",label:"Medical"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Policy"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation"}],De=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם הלקוח|שם בן זוג|שם המבוטח|שם המוטב|שם הילד|שם הקטין)$/i,type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מס' זהות|teudat_zehut|tz|israeli_id|il_id)$/i,type:"id",label:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה)$/i,type:"id",label:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|אימייל|כתובת מייל)$/i,type:"email",label:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|טלפון נייד)$/i,type:"phone",label:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|רחוב|מס בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|מען)$/i,type:"address",label:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|ת לידה|תאריך הולדת|יום הולדת|גיל)$/i,type:"dob",label:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|מספר חשבון|מס חשבון|סניף|iban|iban_il)$/i,type:"financial",label:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|מספר אשראי|cvv|אשראי)$/i,type:"financial",label:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|מצב רפואי|חיסון|רגישות|אלרגיה|סוג דם)$/i,type:"medical",label:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מס פוליסה|פוליסה|מספר חבר|מספר ביטוח)$/i,type:"id",label:"\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4/\u05D7\u05D1\u05E8\u05D5\u05EA"},{pattern:/^(?:שם הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|תעודת לידה)$/i,type:"minor_data",label:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|השקפה פוליטית|מצב משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מס רכב|לוחית רישוי|מספר רישוי)$/i,type:"tracking",label:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}],Fe=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|enabled|active|public|version|metadata|config|settings|data|content|note|comment|label|color|icon)$/i,He=/^שם[ _](?:ה)?(?:קובץ|מוצר|פריט|חברה|ארגון|עסק|פרויקט|גיליון|טבלה|שדה|קטגוריה|סניף|בנק|עיר|רחוב|ישוב|יישוב|מסמך|תוכנית|חבילה|קורס|מחלקה|אתר|דומיין|מותג|ספק|שירות|תפקיד)$|^(file|product|item|company|org|organization|project|sheet|table|field|category|branch|bank|city|street|document|plan|course|department|site|domain|brand|vendor|service|role)[ _-]?name$/i;function T(t){if(!t)return null;let e=t.trim();if(Fe.test(e)||/^name$/i.test(e))return null;let n=e.replace(/[\s-]+/g,"_");for(let i of[...De,...Le])if(i.pattern.test(e)||i.pattern.test(n))return{type:i.type,label:i.label};if(He.test(e))return null;if(/^שם[ _][\u0590-\u05FF"'׳ ]{2,20}$/.test(e))return{type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"};if(/^(customer|client|employee|inspector|supervisor|contact|person|patient|user|owner|manager|agent|member|driver|tenant|student|parent|beneficiary|insured)_?(full_?)?name$/i.test(n))return{type:"name",label:"Person name"};for(let i of te()){let r=i(e);if(r)return{type:r.type,label:r.label}}return null}function ie(t){let e=String(t??"").replace(/\D/g,"");if(e.length===0||e.length>9)return!1;let n=e.padStart(9,"0"),i=0;for(let r=0;r<9;r++){let s=parseInt(n[r]??"0",10)*(r%2+1);s>9&&(s-=9),i+=s}return i%10===0&&parseInt(n,10)>0}function ze(t){let e=String(t??"").replace(/\D/g,"");if(e.length<12||e.length>19)return!1;let n=0,i=!1;for(let r=e.length-1;r>=0;r-=1){let s=parseInt(e[r]??"0",10);i&&(s*=2,s>9&&(s-=9)),n+=s,i=!i}return n%10===0}function Ne(t){let e=String(t??"").replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(e))return!1;let n=e.slice(4)+e.slice(0,4),i=0;for(let r of n){let s=r>="A"&&r<="Z"?String(r.charCodeAt(0)-55):r;for(let a of s)i=(i*10+Number(a))%97}return i===1}var B="(?<!\\d)(?<!\\d[.,])",O="(?!\\d)(?![.,]\\d)",re=[{subkind:"israeli_id",severity:"high",pattern:new RegExp(`${B}\\d{9}${O}`,"g"),validate:ie,hint:"Israeli national ID (check digit verified) in plaintext. Encrypt the column or mask it at rest."},{subkind:"credit_card",severity:"critical",pattern:new RegExp(`${B}[2-6][ -]?(?:\\d[ -]?){11,17}\\d${O}`,"g"),validate:ze,hint:"Payment card number (Luhn verified) in plaintext. This is PCI scope."},{subkind:"iban",severity:"high",pattern:/\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b/g,validate:Ne,hint:"Bank account in IBAN form (mod-97 verified) in plaintext."},{subkind:"israeli_phone",severity:"medium",pattern:new RegExp(`${B}(?:\\+972[- ]?|0)(?:[57]\\d|[2-489])[- ]?\\d{3}[- ]?\\d{4}${O}`,"g"),validate:t=>{let e=t.replace(/\D/g,"").replace(/^972/,"0");return/^0[57]\d{8}$/.test(e)?!0:/^0[2-489]\d{7}$/.test(e)&&(/[- ]/.test(t)||t.startsWith("+972"))},hint:"Israeli phone number in plaintext."}];function R(t,e){let n=[],i="",r=!1;for(let s=0;s<t.length;s++){let a=t[s];r?a==='"'&&t[s+1]==='"'?(i+='"',s++):a==='"'?r=!1:i+=a:a==='"'?r=!0:a===e?(n.push(i),i=""):i+=a}return n.push(i),n}import{inflateRawSync as Ve}from"node:zlib";import{inflateSync as Ue}from"node:zlib";var j=new Set([".pdf"]),se=8*1024*1024;function Be(t){let e=t.toString("latin1"),n=new Map,i=/(\d+)\s+(\d+)\s+obj\b/g,r;for(;(r=i.exec(e))!==null;){let s=Number(r[1]),a=i.lastIndex,o=e.indexOf("endobj",a);if(o<0)continue;let c=e.indexOf("stream",a),l,p=null;if(c>=0&&c<o){l=e.slice(a,c);let u=c+6;e[u]==="\r"&&(u+=1),e[u]===`
-`&&(u+=1);let f=e.indexOf("endstream",u);f>u&&(p=t.subarray(u,f))}else l=e.slice(a,o);n.set(s,{num:s,dict:l,stream:p})}return n}function Oe(t){let e=t.toString("latin1").replace(/\s/g,"");e.startsWith("<~")&&(e=e.slice(2));let n=e.indexOf("~>");n>=0&&(e=e.slice(0,n));let i=[],r=0,s=0;for(let a of e){if(a==="z"&&s===0){i.push(0,0,0,0);continue}let o=a.charCodeAt(0)-33;if(o<0||o>84)return null;r=r*85+o,s+=1,s===5&&(i.push(r>>>24&255,r>>>16&255,r>>>8&255,r&255),r=0,s=0)}if(s>0){for(let o=s;o<5;o+=1)r=r*85+84;let a=[r>>>24&255,r>>>16&255,r>>>8&255,r&255];for(let o=0;o<s-1;o+=1)i.push(a[o]??0)}return Buffer.from(i)}function je(t){let e=t.toString("latin1").replace(/\s/g,"").split(">")[0]??"",n=e.length%2?e+"0":e;return/^[0-9A-Fa-f]*$/.test(n)?Buffer.from(n,"hex"):null}function Ze(t){let e=/\/Filter\s*(\[[^\]]*\]|\/\w+)/.exec(t);return!e||!e[1]?[]:[...e[1].matchAll(/\/(\w+)/g)].map(n=>n[1]??"")}function oe(t){if(!t.stream)return null;let e=t.stream;for(let n of Ze(t.dict)){let i=null;if(n==="FlateDecode")try{i=Ue(e)}catch{return null}else if(n==="ASCII85Decode")i=Oe(e);else if(n==="ASCIIHexDecode")i=je(e);else return null;if(i===null)return null;e=i}return e.toString("latin1")}function Me(t){let e=new Map,n=1,i=/begincodespacerange([\s\S]*?)endcodespacerange/.exec(t);if(i&&i[1]){let c=/<([0-9A-Fa-f]+)>/.exec(i[1]);c&&c[1]&&c[1].length>=4&&(n=2)}let r=c=>{let l="";for(let p=0;p+3<c.length+1;p+=4){let u=parseInt(c.slice(p,p+4),16);Number.isFinite(u)&&u>0&&(l+=String.fromCharCode(u))}return l},s=/beginbfchar([\s\S]*?)endbfchar/g,a;for(;(a=s.exec(t))!==null;){let c=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,l;for(;(l=c.exec(a[1]??""))!==null;)e.set(parseInt(l[1]??"0",16),r(l[2]??""))}let o=/beginbfrange([\s\S]*?)endbfrange/g;for(;(a=o.exec(t))!==null;){let c=a[1]??"",l=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,p;for(;(p=l.exec(c))!==null;){let u=parseInt(p[1]??"0",16),f=parseInt(p[2]??"0",16),d=parseInt((p[3]??"0").slice(0,4)||"0",16);if(!(f-u>65535))for(let m=u;m<=f;m+=1)e.set(m,String.fromCharCode(d+(m-u)))}}return{map:e,bytes:n}}function Ge(t){let e=new Map,n=new Map,i=[];for(let r of t.values()){let s=/\/Font\s*<<([\s\S]*?)>>/.exec(r.dict);s?.[1]&&i.push(s[1]);let a=/\/Font\s+(\d+)\s+\d+\s+R/.exec(r.dict);if(a){let o=t.get(Number(a[1]));o&&i.push(o.dict)}}for(let r of i){let s=/\/([^\s/<>[\]()]+)\s+(\d+)\s+\d+\s+R/g,a;for(;(a=s.exec(r))!==null;)n.set(a[1]??"",Number(a[2]))}for(let[r,s]of n){let a=t.get(s);if(!a)continue;let o=/\/ToUnicode\s+(\d+)\s+\d+\s+R/.exec(a.dict);if(!o)continue;let c=t.get(Number(o[1]));if(!c)continue;let l=oe(c);l&&e.set(r,Me(l))}return e}function ce(t){let e=[];for(let n=0;n<t.length;n+=1){let i=t[n];if(i!=="\\"){e.push(i.charCodeAt(0)&255);continue}let r=t[n+1];if(r===void 0)break;if(r>="0"&&r<="7"){let a="",o=n+1;for(;o<t.length&&a.length<3&&t[o]>="0"&&t[o]<="7";)a+=t[o],o+=1;e.push(parseInt(a,8)&255),n=o-1;continue}let s={n:10,r:13,t:9,b:8,f:12};e.push(s[r]??r.charCodeAt(0)&255),n+=1}return e}function le(t){if(t.length<2||t[0]!==254||t[1]!==255)return null;let e="";for(let n=2;n+1<t.length;n+=2)e+=String.fromCharCode((t[n]??0)<<8|(t[n+1]??0));return e}function ae(t,e){let n=le(t);if(n!==null)return n;if(!e)return t.map(r=>String.fromCharCode(r)).join("");let i="";if(e.bytes===2)for(let r=0;r+1<t.length;r+=2){let s=(t[r]??0)<<8|(t[r+1]??0);i+=e.map.get(s)??""}else for(let r of t)i+=e.map.get(r)??String.fromCharCode(r);return i}function Ke(t,e){let n="",i,r=/\/([^\s/<>[\]()]+)\s+[\d.]+\s+Tf|\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>|TJ|Tj|'|"/g,s,a="";for(;(s=r.exec(t))!==null;){let o=s[0];if(o.endsWith("Tf")){i=e.get(s[1]??"");continue}if(o==="TJ"||o==="Tj"||o==="'"||o==='"'){a&&(n+=a+`
-`,a="");continue}if(o.startsWith("("))a+=ae(ce(o.slice(1,-1)),i);else if(o.startsWith("<")){let c=o.slice(1,-1).replace(/\s+/g,""),l=[];for(let p=0;p+1<c.length;p+=2)l.push(parseInt(c.slice(p,p+2),16));a+=ae(l,i)}}return a&&(n+=a+`
-`),n}function We(t,e){let n=t.toString("latin1"),i=/\/Info\s+(\d+)\s+\d+\s+R/.exec(n),r=i?e.get(Number(i[1]))?.dict:void 0;if(!r)return"";let s=[],a=/\/(Author|Title|Subject|Keywords|Creator|Producer)\s*(\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>)/g,o;for(;(o=a.exec(r))!==null;){let c=o[2]??"";if(c.startsWith("(")){let l=ce(c.slice(1,-1));s.push(le(l)??l.map(p=>String.fromCharCode(p)).join(""))}else{let l=c.slice(1,-1).replace(/\s+/g,""),p="";if(l.toUpperCase().startsWith("FEFF"))for(let u=4;u+3<l.length+1;u+=4)p+=String.fromCharCode(parseInt(l.slice(u,u+4),16));else for(let u=0;u+1<l.length;u+=2)p+=String.fromCharCode(parseInt(l.slice(u,u+2),16));s.push(p)}}return s.join(`
-`)}function de(t){if(!t.subarray(0,8).toString("latin1").startsWith("%PDF-")||t.toString("latin1",0,Math.min(t.length,4096)).includes("/Encrypt"))return null;let n=Be(t);if(n.size===0)return null;let i=Ge(n),r=[];r.push(We(t,n));let s=0,a=0,o=!1;for(let c of n.values()){if(!c.stream||/\/Subtype|\/Type\s*\/(XObject|Font|Metadata)|\/FontFile/.test(c.dict))continue;let l=oe(c);if(l===null||!/(TJ|Tj)\b/.test(l))continue;let p=Ke(l,i);if(p.trim().length!==0){if(a+=1,s+p.length>se){r.push(p.slice(0,Math.max(0,se-s))),o=!0;break}r.push(p),s+=p.length}}return a===0?null:{text:r.join(`
-`),truncated:o,streams:a}}var pe=new Set([".xlsx",".xlsm",".docx",".pptx"]),Z=8*1024*1024,Xe=101010256,Je=33639248,Ye=67324752;function M(t){let e=Math.min(t.length,67584),n=-1;for(let a=t.length-22;a>=t.length-e&&a>=0;a-=1)if(t.readUInt32LE(a)===Xe){n=a;break}if(n<0)return null;let i=t.readUInt16LE(n+10),r=t.readUInt32LE(n+16);if(r>=t.length)return null;let s=[];for(let a=0;a<i&&!(r+46>t.length||t.readUInt32LE(r)!==Je);a+=1){let o=t.readUInt16LE(r+10),c=t.readUInt32LE(r+20),l=t.readUInt32LE(r+24),p=t.readUInt16LE(r+28),u=t.readUInt16LE(r+30),f=t.readUInt16LE(r+32),d=t.readUInt32LE(r+42),m=t.subarray(r+46,r+46+p).toString("utf8");s.push({name:m,method:o,compSize:c,uncompSize:l,localHeaderOffset:d}),r+=46+p+u+f}return s}function G(t,e){let n=e.localHeaderOffset;if(n+30>t.length||t.readUInt32LE(n)!==Ye)return null;let i=t.readUInt16LE(n+26),r=t.readUInt16LE(n+28),s=n+30+i+r,a=s+e.compSize;if(a>t.length)return null;let o=t.subarray(s,a);try{if(e.method===0)return Buffer.from(o);if(e.method===8)return Ve(o)}catch{return null}return null}function qe(t,e){return G(t,e)?.toString("utf8")??null}var Qe={"&amp;":"&","&lt;":"<","&gt;":">","&quot;":'"',"&apos;":"'"};function w(t){return t.replace(/&(amp|lt|gt|quot|apos);/g,e=>Qe[e]??e).replace(/&#(\d+);/g,(e,n)=>{let i=Number(n);return i>0&&i<1114112?String.fromCodePoint(i):""}).replace(/&#x([0-9a-fA-F]+);/g,(e,n)=>{let i=parseInt(n,16);return i>0&&i<1114112?String.fromCodePoint(i):""})}function et(t){return w(t.replace(/<[^>]*>/g,`
+/*! @nodatachat/mcp 1.3.12 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
+import{appendFileSync as Yt,copyFileSync as Ui,existsSync as Qt,mkdirSync as en,readFileSync as tn,statSync as ze,writeFileSync as Zi}from"node:fs";import{homedir as Me}from"node:os";import{basename as nn,extname as Oe,isAbsolute as rn,join as Ne,resolve as sn}from"node:path";var v={text:[],header:[],secrets:[],table:null};function Y(e){e.table&&(v.table=e.table);for(let t of e.text??[])v.text.some(n=>n.kind===t.kind)||v.text.push(t);e.header&&!v.header.includes(e.header)&&v.header.push(e.header);for(let t of e.secrets??[])v.secrets.some(n=>n.id===t.id)||v.secrets.push(t)}function Q(){return v.text}function ue(){return v.header}function A(){return v.table}var fe=[{id:"aws-access-key",name:"AWS Access Key",pattern:/(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)/,severity:"critical"},{id:"aws-secret-key",name:"AWS Secret Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/,severity:"critical"},{id:"gcp-api-key",name:"GCP API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"critical"},{id:"gcp-service-account",name:"GCP Service Account",pattern:/"type"\s*:\s*"service_account"/,severity:"critical"},{id:"github-token",name:"GitHub Token",pattern:/gh[pousr]_[0-9a-zA-Z]{36,}/,severity:"critical"},{id:"github-fine-grained",name:"GitHub Fine-Grained Token",pattern:/github_pat_[0-9a-zA-Z_]{22,}/,severity:"critical"},{id:"gitlab-token",name:"GitLab Token",pattern:/glpat-[0-9a-zA-Z_-]{20,}/,severity:"critical"},{id:"stripe-secret",name:"Stripe Secret Key",pattern:/sk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"stripe-restricted",name:"Stripe Restricted Key",pattern:/rk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"slack-token",name:"Slack Token",pattern:/xox[baprs]-[0-9a-zA-Z-]{10,}/,severity:"high"},{id:"slack-webhook",name:"Slack Webhook",pattern:/hooks\.slack\.com\/services\/T[0-9A-Z]{8,}\/B[0-9A-Z]{8,}\/[0-9a-zA-Z]{24}/,severity:"high"},{id:"twilio-api-key",name:"Twilio API Key",pattern:/SK[0-9a-fA-F]{32}/,severity:"high"},{id:"sendgrid-api-key",name:"SendGrid API Key",pattern:/SG\.[0-9a-zA-Z_-]{22}\.[0-9a-zA-Z_-]{43}/,severity:"critical"},{id:"postgres-uri",name:"PostgreSQL Connection String",pattern:/postgres(?:ql)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"mongodb-uri",name:"MongoDB Connection String",pattern:/mongodb(?:\+srv)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"redis-uri",name:"Redis Connection String",pattern:/redis(?:s)?:\/\/[^\s'"]{10,}/,severity:"high"},{id:"openai-key",name:"OpenAI API Key",pattern:/sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}/,severity:"critical"},{id:"anthropic-key",name:"Anthropic API Key",pattern:/sk-ant-[0-9a-zA-Z_-]{40,}/,severity:"critical"},{id:"firebase-key",name:"Firebase API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"high"},{id:"supabase-key",name:"Supabase Service Key",pattern:/eyJ[0-9a-zA-Z_-]{100,}/,severity:"critical"},{id:"private-key",name:"Private Key",pattern:/-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,severity:"critical"},{id:"jwt-secret",name:"JWT/Generic Secret",pattern:/(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"password-in-code",name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"bearer-token",name:"Bearer Token in Code",pattern:/['"]Bearer\s+[0-9a-zA-Z._-]{20,}['"]/,severity:"high"}];var nt=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Salary / income"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication|prescription)$/i,type:"medical",label:"Medical"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Policy"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation"}],it=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם הלקוח|שם בן זוג|שם המבוטח|שם המוטב|שם הילד|שם הקטין)$/i,type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מס' זהות|teudat_zehut|tz|israeli_id|il_id)$/i,type:"id",label:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה)$/i,type:"id",label:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|אימייל|כתובת מייל)$/i,type:"email",label:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|טלפון נייד)$/i,type:"phone",label:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|רחוב|מס בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|מען)$/i,type:"address",label:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|ת לידה|תאריך הולדת|יום הולדת|גיל)$/i,type:"dob",label:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|מספר חשבון|מס חשבון|סניף|iban|iban_il)$/i,type:"financial",label:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|מספר אשראי|cvv|אשראי)$/i,type:"financial",label:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|מצב רפואי|חיסון|רגישות|אלרגיה|סוג דם)$/i,type:"medical",label:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מס פוליסה|פוליסה|מספר חבר|מספר ביטוח)$/i,type:"id",label:"\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4/\u05D7\u05D1\u05E8\u05D5\u05EA"},{pattern:/^(?:שם הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|תעודת לידה)$/i,type:"minor_data",label:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|השקפה פוליטית|מצב משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מס רכב|לוחית רישוי|מספר רישוי)$/i,type:"tracking",label:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}],rt=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|enabled|active|public|version|metadata|config|settings|data|content|note|comment|label|color|icon)$/i,st=/^שם[ _](?:ה)?(?:קובץ|מוצר|פריט|חברה|ארגון|עסק|פרויקט|גיליון|טבלה|שדה|קטגוריה|סניף|בנק|עיר|רחוב|ישוב|יישוב|מסמך|תוכנית|חבילה|קורס|מחלקה|אתר|דומיין|מותג|ספק|שירות|תפקיד)$|^(file|product|item|company|org|organization|project|sheet|table|field|category|branch|bank|city|street|document|plan|course|department|site|domain|brand|vendor|service|role)[ _-]?name$/i;function $(e){if(!e)return null;let t=e.trim();if(rt.test(t)||/^name$/i.test(t))return null;let n=t.replace(/[\s-]+/g,"_");for(let i of[...it,...nt])if(i.pattern.test(t)||i.pattern.test(n))return{type:i.type,label:i.label};if(st.test(t))return null;if(/^שם[ _][\u0590-\u05FF"'׳ ]{2,20}$/.test(t))return{type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"};if(/^(customer|client|employee|inspector|supervisor|contact|person|patient|user|owner|manager|agent|member|driver|tenant|student|parent|beneficiary|insured)_?(full_?)?name$/i.test(n))return{type:"name",label:"Person name"};for(let i of ue()){let r=i(t);if(r)return{type:r.type,label:r.label}}return null}function he(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let n=t.padStart(9,"0"),i=0;for(let r=0;r<9;r++){let s=parseInt(n[r]??"0",10)*(r%2+1);s>9&&(s-=9),i+=s}return i%10===0&&parseInt(n,10)>0}function ot(e){let t=String(e??"").replace(/\D/g,"");if(t.length<12||t.length>19)return!1;let n=0,i=!1;for(let r=t.length-1;r>=0;r-=1){let s=parseInt(t[r]??"0",10);i&&(s*=2,s>9&&(s-=9)),n+=s,i=!i}return n%10===0}function at(e){let t=String(e??"").replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let n=t.slice(4)+t.slice(0,4),i=0;for(let r of n){let s=r>="A"&&r<="Z"?String(r.charCodeAt(0)-55):r;for(let o of s)i=(i*10+Number(o))%97}return i===1}var ee="(?<!\\d)(?<!\\d[.,])",te="(?!\\d)(?![.,]\\d)",me=[{subkind:"israeli_id",severity:"high",pattern:new RegExp(`${ee}\\d{9}${te}`,"g"),validate:he,hint:"Israeli national ID (check digit verified) in plaintext. Encrypt the column or mask it at rest."},{subkind:"credit_card",severity:"critical",pattern:new RegExp(`${ee}[2-6][ -]?(?:\\d[ -]?){11,17}\\d${te}`,"g"),validate:ot,hint:"Payment card number (Luhn verified) in plaintext. This is PCI scope."},{subkind:"iban",severity:"high",pattern:/\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b/g,validate:at,hint:"Bank account in IBAN form (mod-97 verified) in plaintext."},{subkind:"israeli_phone",severity:"medium",pattern:new RegExp(`${ee}(?:\\+972[- ]?|0)(?:[57]\\d|[2-489])[- ]?\\d{3}[- ]?\\d{4}${te}`,"g"),validate:e=>{let t=e.replace(/\D/g,"").replace(/^972/,"0");return/^0[57]\d{8}$/.test(t)?!0:/^0[2-489]\d{7}$/.test(t)&&(/[- ]/.test(e)||e.startsWith("+972"))},hint:"Israeli phone number in plaintext."}];function P(e,t){let n=[],i="",r=!1;for(let s=0;s<e.length;s++){let o=e[s];r?o==='"'&&e[s+1]==='"'?(i+='"',s++):o==='"'?r=!1:i+=o:o==='"'?r=!0:o===t?(n.push(i),i=""):i+=o}return n.push(i),n}import{inflateRawSync as yt}from"node:zlib";import{inflateSync as ct}from"node:zlib";var ne=new Set([".pdf"]),ge=8*1024*1024;function lt(e){let t=e.toString("latin1"),n=new Map,i=/(\d+)\s+(\d+)\s+obj\b/g,r;for(;(r=i.exec(t))!==null;){let s=Number(r[1]),o=i.lastIndex,a=t.indexOf("endobj",o);if(a<0)continue;let l=t.indexOf("stream",o),c,p=null;if(l>=0&&l<a){c=t.slice(o,l);let d=l+6;t[d]==="\r"&&(d+=1),t[d]===`
+`&&(d+=1);let f=t.indexOf("endstream",d);f>d&&(p=e.subarray(d,f))}else c=t.slice(o,a);n.set(s,{num:s,dict:c,stream:p})}return n}function dt(e){let t=e.toString("latin1").replace(/\s/g,"");t.startsWith("<~")&&(t=t.slice(2));let n=t.indexOf("~>");n>=0&&(t=t.slice(0,n));let i=[],r=0,s=0;for(let o of t){if(o==="z"&&s===0){i.push(0,0,0,0);continue}let a=o.charCodeAt(0)-33;if(a<0||a>84)return null;r=r*85+a,s+=1,s===5&&(i.push(r>>>24&255,r>>>16&255,r>>>8&255,r&255),r=0,s=0)}if(s>0){for(let a=s;a<5;a+=1)r=r*85+84;let o=[r>>>24&255,r>>>16&255,r>>>8&255,r&255];for(let a=0;a<s-1;a+=1)i.push(o[a]??0)}return Buffer.from(i)}function pt(e){let t=e.toString("latin1").replace(/\s/g,"").split(">")[0]??"",n=t.length%2?t+"0":t;return/^[0-9A-Fa-f]*$/.test(n)?Buffer.from(n,"hex"):null}function ut(e){let t=/\/Filter\s*(\[[^\]]*\]|\/\w+)/.exec(e);return!t||!t[1]?[]:[...t[1].matchAll(/\/(\w+)/g)].map(n=>n[1]??"")}function be(e){if(!e.stream)return null;let t=e.stream;for(let n of ut(e.dict)){let i=null;if(n==="FlateDecode")try{i=ct(t)}catch{return null}else if(n==="ASCII85Decode")i=dt(t);else if(n==="ASCIIHexDecode")i=pt(t);else return null;if(i===null)return null;t=i}return t.toString("latin1")}function ft(e){let t=new Map,n=1,i=/begincodespacerange([\s\S]*?)endcodespacerange/.exec(e);if(i&&i[1]){let l=/<([0-9A-Fa-f]+)>/.exec(i[1]);l&&l[1]&&l[1].length>=4&&(n=2)}let r=l=>{let c="";for(let p=0;p+3<l.length+1;p+=4){let d=parseInt(l.slice(p,p+4),16);Number.isFinite(d)&&d>0&&(c+=String.fromCharCode(d))}return c},s=/beginbfchar([\s\S]*?)endbfchar/g,o;for(;(o=s.exec(e))!==null;){let l=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,c;for(;(c=l.exec(o[1]??""))!==null;)t.set(parseInt(c[1]??"0",16),r(c[2]??""))}let a=/beginbfrange([\s\S]*?)endbfrange/g;for(;(o=a.exec(e))!==null;){let l=o[1]??"",c=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,p;for(;(p=c.exec(l))!==null;){let d=parseInt(p[1]??"0",16),f=parseInt(p[2]??"0",16),h=parseInt((p[3]??"0").slice(0,4)||"0",16);if(!(f-d>65535))for(let m=d;m<=f;m+=1)t.set(m,String.fromCharCode(h+(m-d)))}}return{map:t,bytes:n}}function ht(e){let t=new Map,n=new Map,i=[];for(let r of e.values()){let s=/\/Font\s*<<([\s\S]*?)>>/.exec(r.dict);s?.[1]&&i.push(s[1]);let o=/\/Font\s+(\d+)\s+\d+\s+R/.exec(r.dict);if(o){let a=e.get(Number(o[1]));a&&i.push(a.dict)}}for(let r of i){let s=/\/([^\s/<>[\]()]+)\s+(\d+)\s+\d+\s+R/g,o;for(;(o=s.exec(r))!==null;)n.set(o[1]??"",Number(o[2]))}for(let[r,s]of n){let o=e.get(s);if(!o)continue;let a=/\/ToUnicode\s+(\d+)\s+\d+\s+R/.exec(o.dict);if(!a)continue;let l=e.get(Number(a[1]));if(!l)continue;let c=be(l);c&&t.set(r,ft(c))}return t}function _e(e){let t=[];for(let n=0;n<e.length;n+=1){let i=e[n];if(i!=="\\"){t.push(i.charCodeAt(0)&255);continue}let r=e[n+1];if(r===void 0)break;if(r>="0"&&r<="7"){let o="",a=n+1;for(;a<e.length&&o.length<3&&e[a]>="0"&&e[a]<="7";)o+=e[a],a+=1;t.push(parseInt(o,8)&255),n=a-1;continue}let s={n:10,r:13,t:9,b:8,f:12};t.push(s[r]??r.charCodeAt(0)&255),n+=1}return t}function ve(e){if(e.length<2||e[0]!==254||e[1]!==255)return null;let t="";for(let n=2;n+1<e.length;n+=2)t+=String.fromCharCode((e[n]??0)<<8|(e[n+1]??0));return t}function ye(e,t){let n=ve(e);if(n!==null)return n;if(!t)return e.map(r=>String.fromCharCode(r)).join("");let i="";if(t.bytes===2)for(let r=0;r+1<e.length;r+=2){let s=(e[r]??0)<<8|(e[r+1]??0);i+=t.map.get(s)??""}else for(let r of e)i+=t.map.get(r)??String.fromCharCode(r);return i}function mt(e,t){let n="",i,r=/\/([^\s/<>[\]()]+)\s+[\d.]+\s+Tf|\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>|TJ|Tj|'|"/g,s,o="";for(;(s=r.exec(e))!==null;){let a=s[0];if(a.endsWith("Tf")){i=t.get(s[1]??"");continue}if(a==="TJ"||a==="Tj"||a==="'"||a==='"'){o&&(n+=o+`
+`,o="");continue}if(a.startsWith("("))o+=ye(_e(a.slice(1,-1)),i);else if(a.startsWith("<")){let l=a.slice(1,-1).replace(/\s+/g,""),c=[];for(let p=0;p+1<l.length;p+=2)c.push(parseInt(l.slice(p,p+2),16));o+=ye(c,i)}}return o&&(n+=o+`
+`),n}function gt(e,t){let n=e.toString("latin1"),i=/\/Info\s+(\d+)\s+\d+\s+R/.exec(n),r=i?t.get(Number(i[1]))?.dict:void 0;if(!r)return"";let s=[],o=/\/(Author|Title|Subject|Keywords|Creator|Producer)\s*(\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>)/g,a;for(;(a=o.exec(r))!==null;){let l=a[2]??"";if(l.startsWith("(")){let c=_e(l.slice(1,-1));s.push(ve(c)??c.map(p=>String.fromCharCode(p)).join(""))}else{let c=l.slice(1,-1).replace(/\s+/g,""),p="";if(c.toUpperCase().startsWith("FEFF"))for(let d=4;d+3<c.length+1;d+=4)p+=String.fromCharCode(parseInt(c.slice(d,d+4),16));else for(let d=0;d+1<c.length;d+=2)p+=String.fromCharCode(parseInt(c.slice(d,d+2),16));s.push(p)}}return s.join(`
+`)}function ke(e){if(!e.subarray(0,8).toString("latin1").startsWith("%PDF-")||e.toString("latin1",0,Math.min(e.length,4096)).includes("/Encrypt"))return null;let n=lt(e);if(n.size===0)return null;let i=ht(n),r=[];r.push(gt(e,n));let s=0,o=0,a=!1;for(let l of n.values()){if(!l.stream||/\/Subtype|\/Type\s*\/(XObject|Font|Metadata)|\/FontFile/.test(l.dict))continue;let c=be(l);if(c===null||!/(TJ|Tj)\b/.test(c))continue;let p=mt(c,i);if(p.trim().length!==0){if(o+=1,s+p.length>ge){r.push(p.slice(0,Math.max(0,ge-s))),a=!0;break}r.push(p),s+=p.length}}return o===0?null:{text:r.join(`
+`),truncated:a,streams:o}}var xe=new Set([".xlsx",".xlsm",".docx",".pptx"]),ie=8*1024*1024,bt=101010256,_t=33639248,vt=67324752;function L(e){let t=Math.min(e.length,67584),n=-1;for(let o=e.length-22;o>=e.length-t&&o>=0;o-=1)if(e.readUInt32LE(o)===bt){n=o;break}if(n<0)return null;let i=e.readUInt16LE(n+10),r=e.readUInt32LE(n+16);if(r>=e.length)return null;let s=[];for(let o=0;o<i&&!(r+46>e.length||e.readUInt32LE(r)!==_t);o+=1){let a=e.readUInt16LE(r+10),l=e.readUInt32LE(r+20),c=e.readUInt32LE(r+24),p=e.readUInt16LE(r+28),d=e.readUInt16LE(r+30),f=e.readUInt16LE(r+32),h=e.readUInt32LE(r+42),m=e.subarray(r+46,r+46+p).toString("utf8");s.push({name:m,method:a,compSize:l,uncompSize:c,localHeaderOffset:h}),r+=46+p+d+f}return s}function F(e,t){let n=t.localHeaderOffset;if(n+30>e.length||e.readUInt32LE(n)!==vt)return null;let i=e.readUInt16LE(n+26),r=e.readUInt16LE(n+28),s=n+30+i+r,o=s+t.compSize;if(o>e.length)return null;let a=e.subarray(s,o);try{if(t.method===0)return Buffer.from(a);if(t.method===8)return yt(a)}catch{return null}return null}function kt(e,t){return F(e,t)?.toString("utf8")??null}var xt={"&amp;":"&","&lt;":"<","&gt;":">","&quot;":'"',"&apos;":"'"};function x(e){return e.replace(/&(amp|lt|gt|quot|apos);/g,t=>xt[t]??t).replace(/&#(\d+);/g,(t,n)=>{let i=Number(n);return i>0&&i<1114112?String.fromCodePoint(i):""}).replace(/&#x([0-9a-fA-F]+);/g,(t,n)=>{let i=parseInt(n,16);return i>0&&i<1114112?String.fromCodePoint(i):""})}function St(e){return x(e.replace(/<[^>]*>/g,`
 `)).replace(/\n{2,}/g,`
-`)}function tt(t,e,n){let i=new RegExp(`<${e}\\b[^>]*\\b${n}="([^"]*)"`,"g"),r=[],s;for(;(s=i.exec(t))!==null;)s[1]&&r.push(w(s[1]));return r}function nt(t,e){let n=[];for(let i of e)(i==="docProps/core.xml"||i==="docProps/app.xml")&&n.push(i);if(t===".xlsx"||t===".xlsm")for(let i of e)(i==="xl/sharedStrings.xml"||i==="xl/workbook.xml"||/^xl\/worksheets\/sheet\d+\.xml$/.test(i)||/^xl\/comments\d*\.xml$/.test(i))&&n.push(i);else if(t===".docx")for(let i of e)(i==="word/document.xml"||/^word\/(header|footer|footnotes|endnotes|comments)\d*\.xml$/.test(i))&&n.push(i);else if(t===".pptx")for(let i of e)/^ppt\/(slides|notesSlides)\/(slide|notesSlide)\d+\.xml$/.test(i)&&n.push(i);return n}function it(t,e){let n=M(t);if(!n||n.length===0)return null;let i=new Map(n.map(l=>[l.name,l])),r=nt(e,n.map(l=>l.name));if(r.length===0)return null;let s=[],a=[],o=0,c=!1;for(let l of r){if(o>=Z){c=!0;break}let p=i.get(l);if(!p)continue;let u=qe(t,p);if(u===null)continue;let f=et(u);if(l==="xl/workbook.xml"){let d=tt(u,"sheet","name");d.length&&(f+=`
-`+d.join(`
-`))}o+f.length>Z&&(f=f.slice(0,Math.max(0,Z-o)),c=!0),f.trim().length!==0&&(s.push(f),a.push(l),o+=f.length)}return s.length===0?null:{text:s.join(`
-`),truncated:c,parts:a}}function K(t,e){if(pe.has(e))return it(t,e);if(j.has(e)){let n=de(t);return n?{text:n.text,truncated:n.truncated,parts:[`pdf:${n.streams}-streams`]}:null}return null}var rt=new Set([...pe,...j]);var sn=64*1024*1024,an=32*1024;var ue={israeli_id:"[ID]",credit_card:"[CARD]",iban:"[IBAN]",israeli_phone:"[PHONE]",email:"[EMAIL]"},st=/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g,at=[...re].sort((t,e)=>+(e.subkind==="iban")-+(t.subkind==="iban"));function P(t,e,n=1){t[e]=(t[e]??0)+n}function x(t,e={}){let n=t;for(let i of at)i.pattern.lastIndex=0,n=n.replace(i.pattern,r=>i.validate(r)?(P(e,i.subkind),ue[i.subkind]??`[${i.subkind.toUpperCase()}]`):r);n=n.replace(st,()=>(P(e,"email"),ue.email));for(let i of U()){let r=i.find(n).sort((s,a)=>a.start-s.start);for(let s of r)n=n.slice(0,s.start)+`[${i.kind.toUpperCase()}]`+n.slice(s.end),P(e,i.kind)}return{text:n,counts:e,columnsHidden:[]}}function W(){let t=new Map,e={};return(n,i)=>{let r=`${n}\0${i.trim()}`,s=t.get(r);return s===void 0&&(s=e[n]=(e[n]??0)+1,t.set(r,s)),`[${n.toUpperCase()}-${s}]`}}var me=/^\s*-?\d+(?:\.\d+)?\s*$/;function V(t){let e=new Set;for(let[n,i]of t){let r=i.filter(a=>me.test(a));if(r.length<3)continue;r.filter(a=>x(a).text!==a).length/r.length<.5&&e.add(n)}return e}function fe(t,e){return t.includes(e)||t.includes('"')||t.includes(`
-`)?`"${t.replace(/"/g,'""')}"`:t}function ot(t){let e=(t.match(/\t/g)??[]).length,n=(t.match(/;/g)??[]).length,i=(t.match(/,/g)??[]).length;return e>i&&e>=n?"	":n>i?";":","}function X(t,e){let n=t.split(/\r?\n/),i=e??ot(n[0]??""),r=R(n[0]??"",i),s=r.map(f=>T(f)),a={},o=W(),c=n.slice(1).map(f=>f===""?null:R(f,i)),l=new Map;for(let f of c)f?.forEach((d,m)=>l.set(m,[...l.get(m)??[],d]));let p=V(l),u=[r.map(f=>fe(f,i)).join(i)];for(let f of c){if(f===null){u.push("");continue}let d=f.map((m,y)=>{let v=s[y];return v&&m.trim()!==""?(P(a,`column:${v.type}`),o(v.type,m)):p.has(y)&&me.test(m)?m:x(m,a).text});u.push(d.map(m=>fe(m,i)).join(i))}return{text:u.join(`
-`),counts:a,columnsHidden:r.filter((f,d)=>s[d])}}import{deflateRawSync as ct}from"node:zlib";var lt=/^xl\/(pivotCache|charts|externalLinks)\//,dt=10;function pt(t,e,n=1){t[e]=(t[e]??0)+n}function ye(t){return t.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}function be(t){let e=t.replace(/<rPh\b[\s\S]*?<\/rPh>/g,""),n="";for(let i of e.matchAll(/<t(?:\s[^>]*)?>([\s\S]*?)<\/t>/g))n+=i[1];return w(n)}function ut(t){return t?[...t.matchAll(/<si\b[^>]*>([\s\S]*?)<\/si>|<si\b[^>]*\/>/g)].map(e=>be(e[1]??"")):[]}var he=/<c\b([^>]*?)(?:\/>|>([\s\S]*?)<\/c>)/g;function L(t,e){let n=new RegExp(`\\b${e}="([^"]*)"`).exec(t);return n?n[1]:null}function J(t,e){if(t.type==="s"){let i=/<v>([^<]*)<\/v>/.exec(t.inner);return i?e[Number(i[1])]??null:null}if(t.type==="inlineStr"){let i=/<is>([\s\S]*?)<\/is>/.exec(t.inner);return i?be(i[1]):null}if(t.type==="b"||t.type==="e")return null;let n=/<v>([^<]*)<\/v>/.exec(t.inner);return n?w(n[1]):null}function ge(t,e){return`<c${t.replace(/\s*\bt="[^"]*"/,"")} t="inlineStr"><is><t xml:space="preserve">${ye(e)}</t></is></c>`}var ft=(()=>{let t=new Uint32Array(256);for(let e=0;e<256;e+=1){let n=e;for(let i=0;i<8;i+=1)n=n&1?3988292384^n>>>1:n>>>1;t[e]=n>>>0}return t})();function mt(t){let e=4294967295;for(let n=0;n<t.length;n+=1)e=ft[(e^t[n])&255]^e>>>8;return(e^4294967295)>>>0}function _e(t){let e=[],n=[],i=0;for(let a of t){let o=Buffer.from(a.name,"utf8"),c=a.name.endsWith("/"),l=c?Buffer.alloc(0):ct(a.data),p=c?0:8,u=c?0:mt(a.data),f=Buffer.alloc(30);f.writeUInt32LE(67324752,0),f.writeUInt16LE(20,4),f.writeUInt16LE(2048,6),f.writeUInt16LE(p,8),f.writeUInt32LE(u,14),f.writeUInt32LE(l.length,18),f.writeUInt32LE(a.data.length,22),f.writeUInt16LE(o.length,26),e.push(f,o,l);let d=Buffer.alloc(46);d.writeUInt32LE(33639248,0),d.writeUInt16LE(20,4),d.writeUInt16LE(20,6),d.writeUInt16LE(2048,8),d.writeUInt16LE(p,10),d.writeUInt32LE(u,16),d.writeUInt32LE(l.length,20),d.writeUInt32LE(a.data.length,24),d.writeUInt16LE(o.length,28),d.writeUInt32LE(i,42),n.push(d,o),i+=f.length+o.length+l.length}let r=Buffer.concat(n),s=Buffer.alloc(22);return s.writeUInt32LE(101010256,0),s.writeUInt16LE(t.length,8),s.writeUInt16LE(t.length,10),s.writeUInt32LE(r.length,12),s.writeUInt32LE(i,16),Buffer.concat([...e,r,s])}function Y(t){let e=M(t);if(!e||e.length===0||e.some(d=>lt.test(d.name)))return null;let n=new Map;for(let d of e){if(d.name.endsWith("/")){n.set(d.name,Buffer.alloc(0));continue}let m=G(t,d);if(!m)return null;n.set(d.name,m)}let i=[...n.keys()].filter(d=>/^xl\/worksheets\/sheet\d+\.xml$/.test(d));if(i.length===0)return null;let r=n.get("xl/sharedStrings.xml")?.toString("utf8")??null,s=ut(r),a=new Set,o={},c=new Set,l=W();for(let d of i){let m=n.get(d).toString("utf8"),y=[];for(let h of m.matchAll(he)){let g=L(h[1],"r"),b=g?/^([A-Z]+)(\d+)$/.exec(g):null;if(!b)return null;y.push({full:h[0],attrs:h[1],inner:h[2]??"",col:b[1],row:Number(b[2]),type:L(h[1],"t")??"n"})}let v=[...new Set(y.map(h=>h.row))].sort((h,g)=>h-g).slice(0,dt),I=-1,C=new Map;for(let h of v){let g=new Map;for(let b of y.filter(_=>_.row===h)){let _=J(b,s),S=_?T(_):null;S&&(g.set(b.col,S.type),c.add(_.trim()))}if(g.size>0){I=h;for(let[b,_]of g)C.set(b,_);break}}let E=new Map;for(let h of y){if(h.type!=="n"||h.row<=I)continue;let g=J(h,s);g!==null&&E.set(h.col,[...E.get(h.col)??[],g])}let F=V(E),Re=m.replace(he,(h,g,b)=>{let _=L(g,"r"),[,S,Pe]=/^([A-Z]+)(\d+)$/.exec(_),A={full:h,attrs:g,inner:b??"",col:S,row:Number(Pe),type:L(g,"t")??"n"},$=J(A,s),H=()=>{if(A.type==="s"){let ee=/<v>([^<]*)<\/v>/.exec(A.inner);ee&&a.add(Number(ee[1]))}return h};if($===null||$.trim()==="")return H();let z=C.get(S);if(z&&A.row>I)return pt(o,`column:${z}`),ge(g,l(z,$));if(A.type==="n"&&F.has(S))return H();let Q=x($,o);return Q.text===$?H():ge(g,Q.text)});n.set(d,Buffer.from(Re,"utf8"))}if(r){let d=-1,m=r.replace(/<si\b[^>]*>[\s\S]*?<\/si>|<si\b[^>]*\/>/g,y=>(d+=1,a.has(d)?y:"<si><t></t></si>"));n.set("xl/sharedStrings.xml",Buffer.from(m,"utf8"))}for(let d of[...n.keys()].filter(m=>/^xl\/comments\d*\.xml$/.test(m))){let y=n.get(d).toString("utf8").replace(/(<t(?:\s[^>]*)?>)([\s\S]*?)(<\/t>)/g,(v,I,C,E)=>{let F=x(w(C),o);return`${I}${ye(F.text)}${E}`});n.set(d,Buffer.from(y,"utf8"))}let p=n.get("docProps/core.xml");if(p){let d=p.toString("utf8").replace(/(<dc:creator>)[\s\S]*?(<\/dc:creator>)/,"$1$2").replace(/(<cp:lastModifiedBy>)[\s\S]*?(<\/cp:lastModifiedBy>)/,"$1$2");n.set("docProps/core.xml",Buffer.from(d,"utf8"))}let u=n.has("xl/calcChain.xml"),f=e.map(d=>d.name).filter(d=>!(u&&d==="xl/calcChain.xml"));if(u)for(let d of["[Content_Types].xml","xl/_rels/workbook.xml.rels"]){let m=n.get(d);m&&n.set(d,Buffer.from(m.toString("utf8").replace(/<(Override|Relationship)\b[^>]*calcChain[^>]*\/>/g,""),"utf8"))}return{bytes:_e(f.map(d=>({name:d,data:n.get(d)}))),counts:o,columnsHidden:[...c]}}function xe(t){return/\.ndc$/i.test(t)||/\.clean\.[A-Za-z0-9]+$/.test(t)}var vt=new Set([".csv",".tsv",".txt",".md",".json",".log",".xml",".sql",".yaml",".yml",".xlsx",".xlsm",".docx",".pptx",".pdf"]),St=50*1024*1024,wt=8,It={israeli_id:"Israeli ID",credit_card:"card",iban:"IBAN",israeli_phone:"phone",email:"email",secret:"secret"};function Ie(t){let e=_t(t).toLowerCase();return vt.has(we(e))||e===".env"||e.startsWith(".env.")}function Et(t){let e=we(t).toLowerCase(),n=bt(t),i,r;if(e===".csv"||e===".tsv")r=n.toString("utf8"),i=X(r,e===".tsv"?"	":void 0).counts;else if(e===".xlsx"||e===".xlsm"||e===".docx"||e===".pptx"||e===".pdf"){let a=e===".xlsx"||e===".xlsm"?Y(n):null;r=K(n,e)?.text??"",i=a?a.counts:x(r).counts}else r=n.toString("utf8"),i=x(r).counts;let s=ne.filter(a=>a.pattern.test(r)).length;return s&&(i.secret=(i.secret??0)+s),i}function At(t){return Object.entries(t).sort((e,n)=>n[1]-e[1]).map(([e,n])=>`${n} ${e.startsWith("column:")?`${e.slice(7)} (column)`:It[e]??e}`).join(", ")}function $t(t,e,n){let i=s=>xt(s)?s:kt(n,s),r=s=>{try{return ve(s).isFile()}catch{return!1}};if(t==="Read"&&typeof e.file_path=="string")return[i(e.file_path)];if(t==="Grep"&&typeof e.path=="string"&&r(i(e.path)))return[i(e.path)];if(t==="Bash"&&typeof e.command=="string"){let s=e.command.match(/"[^"]*"|'[^']*'|[^\s|;&<>()]+/g)??[],a=[];for(let o of s){let c=i(o.replace(/^['"]|['"]$/g,"").replace(/^~(?=\/)/,Se()));if(Ie(c)&&r(c)&&!a.includes(c)&&a.push(c),a.length>=wt)break}return a}return[]}function q(t){return t.replace(/\\+/g,"/")}function Tt(t,e,n,i){let r=[];for(let a of $t(t,e,n)){if(!Ie(a)||xe(a)||!gt(a))continue;let o;try{if(ve(a).size>St)o=`${q(a)}: too large to check here (over 50 MB)`;else{let c=Et(a);if(Object.keys(c).length===0)continue;o=`${q(a)}: ${At(c)}`}}catch{o=`${q(a)}: could not be checked`}r.push(o)}if(r.length===0)return{decision:"allow"};let s=`NoData scanned this on your machine before the assistant reads it:
+`)}function wt(e,t,n){let i=new RegExp(`<${t}\\b[^>]*\\b${n}="([^"]*)"`,"g"),r=[],s;for(;(s=i.exec(e))!==null;)s[1]&&r.push(x(s[1]));return r}function It(e,t){let n=[];for(let i of t)(i==="docProps/core.xml"||i==="docProps/app.xml")&&n.push(i);if(e===".xlsx"||e===".xlsm")for(let i of t)(i==="xl/sharedStrings.xml"||i==="xl/workbook.xml"||/^xl\/worksheets\/sheet\d+\.xml$/.test(i)||/^xl\/comments\d*\.xml$/.test(i))&&n.push(i);else if(e===".docx")for(let i of t)(i==="word/document.xml"||/^word\/(header|footer|footnotes|endnotes|comments)\d*\.xml$/.test(i))&&n.push(i);else if(e===".pptx")for(let i of t)/^ppt\/(slides|notesSlides)\/(slide|notesSlide)\d+\.xml$/.test(i)&&n.push(i);return n}function Et(e,t){let n=L(e);if(!n||n.length===0)return null;let i=new Map(n.map(c=>[c.name,c])),r=It(t,n.map(c=>c.name));if(r.length===0)return null;let s=[],o=[],a=0,l=!1;for(let c of r){if(a>=ie){l=!0;break}let p=i.get(c);if(!p)continue;let d=kt(e,p);if(d===null)continue;let f=St(d);if(c==="xl/workbook.xml"){let h=wt(d,"sheet","name");h.length&&(f+=`
+`+h.join(`
+`))}a+f.length>ie&&(f=f.slice(0,Math.max(0,ie-a)),l=!0),f.trim().length!==0&&(s.push(f),o.push(c),a+=f.length)}return s.length===0?null:{text:s.join(`
+`),truncated:l,parts:o}}function H(e,t){if(xe.has(t))return Et(e,t);if(ne.has(t)){let n=ke(e);return n?{text:n.text,truncated:n.truncated,parts:[`pdf:${n.streams}-streams`]}:null}return null}var At=new Set([...xe,...ne]);import{deflateRawSync as Rt}from"node:zlib";var Se={israeli_id:"[ID]",credit_card:"[CARD]",iban:"[IBAN]",israeli_phone:"[PHONE]",email:"[EMAIL]"},$t=/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g,Tt=[...me].sort((e,t)=>+(t.subkind==="iban")-+(e.subkind==="iban"));function D(e,t,n=1){e[t]=(e[t]??0)+n}var we=null,N=e=>{let t=e.trim();we&&t&&we.add(t)};function k(e,t={}){let n=e;for(let i of Tt)i.pattern.lastIndex=0,n=n.replace(i.pattern,r=>i.validate(r)?(D(t,i.subkind),N(r),Se[i.subkind]??`[${i.subkind.toUpperCase()}]`):r);n=n.replace($t,i=>(D(t,"email"),N(i),Se.email));for(let i of Q()){let r=i.find(n).sort((s,o)=>o.start-s.start);for(let s of r)N(n.slice(s.start,s.end)),n=n.slice(0,s.start)+`[${i.kind.toUpperCase()}]`+n.slice(s.end),D(t,i.kind)}return{text:n,counts:t,columnsHidden:[]}}function re(){let e=new Map,t={};return(n,i)=>{N(i);let r=`${n}\0${i.trim()}`,s=e.get(r);return s===void 0&&(s=t[n]=(t[n]??0)+1,e.set(r,s)),`[${n.toUpperCase()}-${s}]`}}var Ee=/^\s*-?\d+(?:\.\d+)?\s*$/;function se(e){let t=new Set;for(let[n,i]of e){let r=i.filter(o=>Ee.test(o));if(r.length<3)continue;r.filter(o=>k(o).text!==o).length/r.length<.5&&t.add(n)}return t}function Ie(e,t){return e.includes(t)||e.includes('"')||e.includes(`
+`)?`"${e.replace(/"/g,'""')}"`:e}function Ct(e){let t=(e.match(/\t/g)??[]).length,n=(e.match(/;/g)??[]).length,i=(e.match(/,/g)??[]).length;return t>i&&t>=n?"	":n>i?";":","}function oe(e,t){let n=e.split(/\r?\n/),i=t??Ct(n[0]??""),r=P(n[0]??"",i),s=r.map(h=>$(h)),o={},a=re(),l=n.slice(1).map(h=>h===""?null:P(h,i)),c=new Map;for(let h of l)h?.forEach((m,u)=>c.set(u,[...c.get(u)??[],m]));let p=se(c),d=A();if(d){let h=l.filter(m=>m!==null).slice(0,200);for(let m of d({name:"table",headers:r,rows:h})){let u=r.indexOf(m.column);u>=0&&!(m.how==="header"&&p.has(u))&&(s[u]={type:m.type,label:m.category})}}let f=[r.map(h=>Ie(h,i)).join(i)];for(let h of l){if(h===null){f.push("");continue}let m=h.map((u,g)=>{let y=s[g];return y&&u.trim()!==""?(D(o,`column:${y.type}`),a(y.type,u)):p.has(g)&&Ee.test(u)?u:k(u,o).text});f.push(m.map(u=>Ie(u,i)).join(i))}return{text:f.join(`
+`),counts:o,columnsHidden:r.filter((h,m)=>s[m])}}var Pt=/^xl\/(pivotCache|charts|externalLinks)\//,Te=10;function Lt(e,t,n=1){e[t]=(e[t]??0)+n}function Ce(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}function Re(e){let t=e.replace(/<rPh\b[\s\S]*?<\/rPh>/g,""),n="";for(let i of t.matchAll(/<t(?:\s[^>]*)?>([\s\S]*?)<\/t>/g))n+=i[1];return x(n)}function Ft(e){return e?[...e.matchAll(/<si\b[^>]*>([\s\S]*?)<\/si>|<si\b[^>]*\/>/g)].map(t=>Re(t[1]??"")):[]}var Pe=/<c\b([^>]*?)(?:\/>|>([\s\S]*?)<\/c>)/g;function z(e,t){let n=new RegExp(`\\b${t}="([^"]*)"`).exec(e);return n?n[1]:null}function S(e,t){if(e.type==="s"){let i=/<v>([^<]*)<\/v>/.exec(e.inner);return i?t[Number(i[1])]??null:null}if(e.type==="inlineStr"){let i=/<is>([\s\S]*?)<\/is>/.exec(e.inner);return i?Re(i[1]):null}if(e.type==="b"||e.type==="e")return null;let n=/<v>([^<]*)<\/v>/.exec(e.inner);return n?x(n[1]):null}function Ht(e){let t=[];for(let n of e.matchAll(Pe)){let i=z(n[1],"r"),r=i?/^([A-Z]+)(\d+)$/.exec(i):null;if(!r)return null;t.push({full:n[0],attrs:n[1],inner:n[2]??"",col:r[1],row:Number(r[2]),type:z(n[1],"t")??"n"})}return t}function Dt(e,t){let n=[...new Set(e.map(i=>i.row))].sort((i,r)=>i-r).slice(0,Te);for(let i of n){let r=new Map;for(let s of e.filter(o=>o.row===i)){let o=S(s,t),a=o?$(o):null;a&&r.set(s.col,{type:a.type,header:o.trim()})}if(r.size>0)return{row:i,cols:r}}return{row:-1,cols:new Map}}var Nt=/^xl\/worksheets\/sheet\d+\.xml$/,zt=200;function Mt(e){let t=e.trim();return/^[\d.,\-+/:%$₪€\s]+$/.test(t)||t.length>60}function Ot(e,t){let n=[...new Set(e.map(s=>s.row))].sort((s,o)=>s-o).slice(0,Te),i=-1,r=-1/0;for(let s of n){let o=e.filter(c=>c.row===s).map(c=>(S(c,t)??"").trim()).filter(Boolean);if(o.length<2)continue;let a=o.filter(c=>!Mt(c)).length,l=a*2-(o.length-a);l>r&&(r=l,i=s)}return i}function jt(e,t,n){let i=Dt(t,n),r=A();if(!r)return i;let s=i.row>=0?i.row:Ot(t,n);if(s<0)return i;let o=t.filter(d=>d.row===s).map(d=>({col:d.col,text:(S(d,n)??"").trim()})).filter(d=>d.text),a=new Map(o.map((d,f)=>[d.col,f])),l=new Map;for(let d of t){if(d.row<=s)continue;let f=a.get(d.col);if(f!==void 0){if(!l.has(d.row)){if(l.size>=zt)continue;l.set(d.row,o.map(()=>""))}l.get(d.row)[f]=S(d,n)??""}}let c=new Map(s===i.row?i.cols:[]),p=o.map(d=>d.text);for(let d of r({name:e,headers:p,rows:[...l.values()]})){let f=p.indexOf(d.column);f<0||c.set(o[f].col,{type:d.type,header:d.column,category:d.category,severity:d.severity,how:d.how})}return{row:s,cols:c}}function Ae(e,t){return`<c${e.replace(/\s*\bt="[^"]*"/,"")} t="inlineStr"><is><t xml:space="preserve">${Ce(t)}</t></is></c>`}var Bt=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t+=1){let n=t;for(let i=0;i<8;i+=1)n=n&1?3988292384^n>>>1:n>>>1;e[t]=n>>>0}return e})();function Ut(e){let t=4294967295;for(let n=0;n<e.length;n+=1)t=Bt[(t^e[n])&255]^t>>>8;return(t^4294967295)>>>0}var $e=33;function Le(e){let t=[],n=[],i=0;for(let o of e){let a=Buffer.from(o.name,"utf8"),l=o.name.endsWith("/"),c=l?Buffer.alloc(0):Rt(o.data),p=l?0:8,d=l?0:Ut(o.data),f=Buffer.alloc(30);f.writeUInt32LE(67324752,0),f.writeUInt16LE(20,4),f.writeUInt16LE(2048,6),f.writeUInt16LE(p,8),f.writeUInt16LE($e,12),f.writeUInt32LE(d,14),f.writeUInt32LE(c.length,18),f.writeUInt32LE(o.data.length,22),f.writeUInt16LE(a.length,26),t.push(f,a,c);let h=Buffer.alloc(46);h.writeUInt32LE(33639248,0),h.writeUInt16LE(20,4),h.writeUInt16LE(20,6),h.writeUInt16LE(2048,8),h.writeUInt16LE(p,10),h.writeUInt16LE($e,14),h.writeUInt32LE(d,16),h.writeUInt32LE(c.length,20),h.writeUInt32LE(o.data.length,24),h.writeUInt16LE(a.length,28),h.writeUInt32LE(i,42),n.push(h,a),i+=f.length+a.length+c.length}let r=Buffer.concat(n),s=Buffer.alloc(22);return s.writeUInt32LE(101010256,0),s.writeUInt16LE(e.length,8),s.writeUInt16LE(e.length,10),s.writeUInt32LE(r.length,12),s.writeUInt32LE(i,16),Buffer.concat([...t,r,s])}function ae(e){let t=L(e);if(!t||t.length===0||t.some(u=>Pt.test(u.name)))return null;let n=new Map;for(let u of t){if(u.name.endsWith("/")){n.set(u.name,Buffer.alloc(0));continue}let g=F(e,u);if(!g)return null;n.set(u.name,g)}let i=[...n.keys()].filter(u=>Nt.test(u));if(i.length===0)return null;let r=n.get("xl/sharedStrings.xml")?.toString("utf8")??null,s=Ft(r),o=new Set,a={},l=new Set,c=re();for(let u of i){let g=n.get(u).toString("utf8"),y=Ht(g);if(!y)return null;let V=jt(u.replace(/^xl\/worksheets\//,"").replace(/\.xml$/,""),y,s),T=V.row,w=new Map;for(let b of y){if(b.type!=="n"||b.row<=T)continue;let _=S(b,s);_!==null&&w.set(b.col,[...w.get(b.col)??[],_])}let C=se(w),R=new Map;for(let[b,{type:_,header:K,how:G}]of V.cols)G==="header"&&C.has(b)||(R.set(b,_),l.add(K));let et=g.replace(Pe,(b,_,K)=>{let G=z(_,"r"),[,X,tt]=/^([A-Z]+)(\d+)$/.exec(G),I={full:b,attrs:_,inner:K??"",col:X,row:Number(tt),type:z(_,"t")??"n"},E=S(I,s),J=()=>{if(I.type==="s"){let pe=/<v>([^<]*)<\/v>/.exec(I.inner);pe&&o.add(Number(pe[1]))}return b};if(E===null||E.trim()==="")return J();let q=R.get(X);if(q&&I.row>T)return Lt(a,`column:${q}`),Ae(_,c(q,E));if(I.type==="n"&&C.has(X))return J();let de=k(E,a);return de.text===E?J():Ae(_,de.text)});n.set(u,Buffer.from(et,"utf8"))}if(r){let u=-1,g=r.replace(/<si\b[^>]*>[\s\S]*?<\/si>|<si\b[^>]*\/>/g,y=>(u+=1,o.has(u)?y:"<si><t></t></si>"));n.set("xl/sharedStrings.xml",Buffer.from(g,"utf8"))}for(let u of[...n.keys()].filter(g=>/^xl\/comments\d*\.xml$/.test(g))){let y=n.get(u).toString("utf8").replace(/(<t(?:\s[^>]*)?>)([\s\S]*?)(<\/t>)/g,(V,T,w,C)=>{let R=k(x(w),a);return`${T}${Ce(R.text)}${C}`});n.set(u,Buffer.from(y,"utf8"))}let p=n.get("docProps/core.xml");if(p){let u=p.toString("utf8").replace(/(<dc:creator>)[\s\S]*?(<\/dc:creator>)/,"$1$2").replace(/(<cp:lastModifiedBy>)[\s\S]*?(<\/cp:lastModifiedBy>)/,"$1$2");n.set("docProps/core.xml",Buffer.from(u,"utf8"))}let d=n.get("xl/workbook.xml");if(d){let u=d.toString("utf8").replace(/<(\w+:)?absPath\b[^>]*\/>|<(\w+:)?absPath\b[^>]*>[\s\S]*?<\/(\w+:)?absPath>/g,"");n.set("xl/workbook.xml",Buffer.from(u,"utf8"))}let f=n.get("docProps/app.xml");if(f){let u=f.toString("utf8").replace(/(<Company>)[\s\S]*?(<\/Company>)/,"$1$2").replace(/(<Manager>)[\s\S]*?(<\/Manager>)/,"$1$2");n.set("docProps/app.xml",Buffer.from(u,"utf8"))}let h=n.has("xl/calcChain.xml"),m=t.map(u=>u.name).filter(u=>!(h&&u==="xl/calcChain.xml"));if(h)for(let u of["[Content_Types].xml","xl/_rels/workbook.xml.rels"]){let g=n.get(u);g&&n.set(u,Buffer.from(g.toString("utf8").replace(/<(Override|Relationship)\b[^>]*calcChain[^>]*\/>/g,""),"utf8"))}return{bytes:Le(m.map(u=>({name:u,data:n.get(u)}))),counts:a,columnsHidden:[...l]}}var ci=64*1024*1024,li=32*1024;function Fe(e){return/\.ndc$/i.test(e)||/\.clean\.[A-Za-z0-9]+$/.test(e)}import{existsSync as Vt,mkdirSync as Ni,readFileSync as Kt,writeFileSync as zi}from"node:fs";import{homedir as Gt}from"node:os";import{join as Xt}from"node:path";var He=()=>Xt(Gt(),".nodata","prefs.json");function Jt(){try{let e=Vt(He())?JSON.parse(Kt(He(),"utf8")).lang:null;return e==="he"||e==="en"?e:null}catch{return null}}function qt(){let t=process.env.LC_ALL||process.env.LC_MESSAGES||process.env.LANG||"";try{t||=Intl.DateTimeFormat().resolvedOptions().locale}catch{}return/^(he|iw)(?:[-_.@]|$)/i.test(t)?"he":"en"}function M(){return Jt()??qt()}function De(e,t,n=M()){return n==="he"?e:t}var on=new Set([".csv",".tsv",".txt",".md",".json",".log",".xml",".sql",".yaml",".yml",".xlsx",".xlsm",".docx",".pptx",".pdf"]),an=50*1024*1024,cn=8,ln={israeli_id:"Israeli ID",credit_card:"card",iban:"IBAN",israeli_phone:"phone",email:"email",secret:"secret"};function je(e){let t=nn(e).toLowerCase();return on.has(Oe(t))||t===".env"||t.startsWith(".env.")}function dn(e){let t=Oe(e).toLowerCase(),n=tn(e),i,r;if(t===".csv"||t===".tsv")r=n.toString("utf8"),i=oe(r,t===".tsv"?"	":void 0).counts;else if(t===".xlsx"||t===".xlsm"||t===".docx"||t===".pptx"||t===".pdf"){let o=t===".xlsx"||t===".xlsm"?ae(n):null;r=H(n,t)?.text??"",i=o?o.counts:k(r).counts}else r=n.toString("utf8"),i=k(r).counts;let s=fe.filter(o=>o.pattern.test(r)).length;return s&&(i.secret=(i.secret??0)+s),i}var pn={israeli_id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",credit_card:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9",iban:"IBAN",israeli_phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",email:'\u05D3\u05D5\u05D0"\u05DC',secret:"\u05E1\u05D5\u05D3",name:"\u05E9\u05DD",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",financial:"\u05DE\u05D9\u05D3\u05E2 \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",bank_account:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7",plate:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"};function un(e){let t=M()==="he",n=i=>(t?pn[i]:ln[i])??i;return Object.entries(e).sort((i,r)=>r[1]-i[1]).map(([i,r])=>`${r} ${i.startsWith("column:")?`${n(i.slice(7))} (${t?"\u05E2\u05DE\u05D5\u05D3\u05D4":"column"})`:n(i)}`).join(", ")}function fn(e,t,n){let i=s=>rn(s)?s:sn(n,s),r=s=>{try{return ze(s).isFile()}catch{return!1}};if(e==="Read"&&typeof t.file_path=="string")return[i(t.file_path)];if(e==="Grep"&&typeof t.path=="string"&&r(i(t.path)))return[i(t.path)];if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"){let s=t.command,o=[...[...s.matchAll(/"([^"]*)"/g)].map(l=>l[1]),...[...s.matchAll(/'([^']*)'/g)].map(l=>l[1]),...s.split(/[\s|;&<>(),=`]+/)],a=[];for(let l of o){let c=l.trim().replace(/^['"]|['"]$/g,"").replace(/\\\\/g,"\\").replace(/^~(?=[\\/])/,Me()).replace(/^\/([a-zA-Z])\//,(d,f)=>process.platform==="win32"?`${f}:/`:d);if(!c||!je(c))continue;let p=i(c);if(r(p)&&!a.includes(p)&&a.push(p),a.length>=cn)break}return a}return[]}function ce(e){return e.replace(/\\+/g,"/")}function Be(e,t,n){let i=[];for(let r of fn(e,t,n)){if(!je(r)||Fe(r)||!Qt(r))continue;let s;try{if(ze(r).size>an)s=`${ce(r)}: too large to check here (over 50 MB)`;else{let o=dn(r);if(Object.keys(o).length===0)continue;s=`${ce(r)}: ${un(o)}`}}catch{s=`${ce(r)}: could not be checked`}i.push(s)}return i}function hn(e,t,n,i){let r=Be(e,t,n);if(r.length===0)return{decision:"allow"};let s=De(`NoData \u05E1\u05E8\u05E7 \u05D0\u05EA \u05D6\u05D4 \u05D1\u05DE\u05D7\u05E9\u05D1 \u05E9\u05DC\u05DA \u05DC\u05E4\u05E0\u05D9 \u05E9\u05D4\u05E2\u05D5\u05D6\u05E8 \u05E7\u05D5\u05E8\u05D0:
   ${r.join(`
   `)}
-Reading it puts these values in front of the AI. Safer: nodata_redact (a clean copy to work on) or nodata_protect (lock it).`+(i?"":" Allow this read anyway?");return{decision:i?"deny":"ask",reason:s}}function Ct(t){try{let e=ke(Se(),".nodata");yt(e,{recursive:!0}),ht(ke(e,"gate.log"),JSON.stringify({at:new Date().toISOString(),...t})+`
-`,{mode:384})}catch{}}async function Ee(t){let e=t.includes("--block"),n="";for await(let a of process.stdin)n+=a;let i;try{i=JSON.parse(n)}catch{return}let r=i.tool_name??"",s=Tt(r,i.tool_input??{},i.cwd??process.cwd(),e);s.decision!=="allow"&&(Ct({tool:r,decision:s.decision}),process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:s.decision,permissionDecisionReason:s.reason}})))}var Rt=[{type:"id_number",patterns:[/\b\d{9}\b/g,/ת\.?ז\.?\s*:?\s*(\d{9})/g,/זהות\s*:?\s*(\d{9})/g],confidence:.9,replacement:()=>"[\u05EA.\u05D6. \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"phone",patterns:[/\b0[2-9]\d[\s\-]?\d{7}\b/g,/\b05[0-9][\s\-]?\d{7}\b/g,/\+972[\s\-]?[2-9]\d[\s\-]?\d{7}\b/g],confidence:.95,replacement:()=>"[\u05D8\u05DC\u05E4\u05D5\u05DF \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"email",patterns:[/[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}/g],confidence:.99,replacement:t=>{let[,e]=t.split("@");return`[\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC: ***@${e}]`}},{type:"full_name",patterns:[/(?:לקוח|מטופל|מועמד|שם|נהג|מבוטח|תובע|נתבע|שוכר|מחזיק)[:\s]+([א-ת][א-ת"'\-\s]{2,30}?)(?=[,\n\d]|ת\.ז)/g,/(?:עו"ד|ד"ר|פרופ'|מר|גברת)\s+([א-ת][א-ת"'\-\s]{2,25}?)(?=[,\n])/g],confidence:.75,replacement:()=>"[\u05E9\u05DD \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"bank_account",patterns:[/\b\d{2}[\-]\d{5,9}[\-]\d{2,3}\b/g,/(?:חשבון|ח-ן)\s*:?\s*(\d[\d\-]{8,15})/g],confidence:.88,replacement:()=>"[\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"medical",patterns:[/(?<![א-ת])[בהוכלמש]{0,2}(?:סוכרת|יתר לחץ דם|אסתמה|דיכאון|חרדה|סרטן|אי ספיקת לב|אפילפסיה)(?![א-ת])/g,/\b(?:Metformin|Lisinopril|Atorvastatin|Amlodipine|Sertraline|Fluoxetine|Omeprazole|Warfarin|Aspirin|Insulin)\b/gi,/\bHbA1c\s*:?\s*[\d.]+%?/g,/\bBMI\s*:?\s*[\d.]+/g,/(?<![א-ת])[בהוכלמש]{0,2}אבחנ[הות]\s*:?\s*[^,\n.]{2,40}/g],confidence:.85,replacement:()=>"[\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"financial_amount",patterns:[/[\d,]+(?:\.\d{2})?\s*(?:₪|ש"ח|NIS|שקל(?:ים)?)/g,/(?:₪|NIS)\s*[\d,]+(?:\.\d{2})?/g],confidence:.92,replacement:()=>"[\u05E1\u05DB\u05D5\u05DD \u05DB\u05E1\u05E4\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"birth_date",patterns:[/(?:תאריך לידה|נולד|נולדה|ד\.ל\.)\s*:?\s*\d{1,2}[\/\.\-]\d{1,2}[\/\.\-]\d{2,4}/g,/(?<![א-ת])[בהוכלמש]{0,2}גיל\s*:?\s*\d{1,3}\b/g],confidence:.88,replacement:()=>"[\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"address",patterns:[/רחוב\s+[א-ת][א-ת\s"'\-]{2,30}\s+\d{1,5}/g,/(?:רח'|רח\.)\s+[א-ת][א-ת\s"'\-]{2,30}\d{1,5}/g],confidence:.72,replacement:()=>"[\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D5\u05E1\u05EA\u05E8\u05EA]"},{type:"license_plate",patterns:[/\b\d{2,3}[\-]\d{2,3}[\-]\d{2,3}\b/g],confidence:.8,replacement:()=>"[\u05DC\u05D5\u05D7\u05D9\u05EA \u05E8\u05D9\u05E9\u05D5\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8\u05EA]"}];function Pt(t){if(t.length!==9)return!1;let e=t.split("").map(Number),n=0;for(let i=0;i<9;i++){let r=e[i]*(i%2===0?1:2);r>9&&(r-=9),n+=r}return n%10===0}var D=class{constructor(e){this.enabledTypes=new Set(e)}detect(e){let n=[],i=new Set;for(let s of Rt)if(this.enabledTypes.has(s.type))for(let a of s.patterns){let o=new RegExp(a.source,a.flags),c;for(;(c=o.exec(e))!==null;){let l=c[0],p=`${s.type}:${c.index}`;if(!i.has(p)){if(i.add(p),s.type==="id_number"){let u=l.replace(/\D/g,"");if(/^\d{9}$/.test(l)&&u.length===9&&!Pt(u))continue}n.push({type:s.type,value:l,startIndex:c.index,endIndex:c.index+l.length,confidence:s.confidence,replacement:s.replacement(l,s.type)})}}}n.sort((s,a)=>s.startIndex-a.startIndex||a.confidence-s.confidence);let r=[];for(let s of n)r.some(o=>s.startIndex<o.endIndex&&s.endIndex>o.startIndex)||r.push(s);return r}};var Lt=[{type:"biometric",tokens:["biometric","fingerprint","\u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9"],phrases:["face id","\u05D8\u05D1\u05D9\u05E2\u05EA \u05D0\u05E6\u05D1\u05E2"]},{type:"medical",tokens:["diagnosis","medical","disease","medication","prescription","allergy","vaccine","\u05D0\u05D1\u05D7\u05D5\u05DF","\u05D0\u05D1\u05D7\u05E0\u05D4","\u05DE\u05D7\u05DC\u05D4","\u05EA\u05E8\u05D5\u05E4\u05D4","\u05DE\u05E8\u05E9\u05DD","\u05D7\u05D9\u05E1\u05D5\u05DF","\u05D0\u05DC\u05E8\u05D2\u05D9\u05D4"],phrases:["medical record","blood type","\u05DE\u05E6\u05D1 \u05E8\u05E4\u05D5\u05D0\u05D9","\u05E1\u05D5\u05D2 \u05D3\u05DD"]},{type:"sensitive_personal",tokens:["religion","ethnicity","nationality","\u05D3\u05EA","\u05DC\u05D0\u05D5\u05DD","\u05E2\u05D3\u05D4","\u05DE\u05D5\u05E6\u05D0"],phrases:["sexual orientation","marital status","\u05DE\u05E6\u05D1 \u05DE\u05E9\u05E4\u05D7\u05EA\u05D9","\u05E0\u05D8\u05D9\u05D9\u05D4 \u05DE\u05D9\u05E0\u05D9\u05EA"]},{type:"minor_data",tokens:["minor","\u05E7\u05D8\u05D9\u05DF"],phrases:["child name","\u05E9\u05DD \u05D4\u05D9\u05DC\u05D3","\u05E9\u05DD \u05D4\u05E7\u05D8\u05D9\u05DF"]},{type:"id",tokens:["ssn","passport","\u05D6\u05D4\u05D5\u05EA","\u05D3\u05E8\u05DB\u05D5\u05DF"],phrases:["national id","id number","identity number","social security","driver license","driving license","drivers license","passport number","tax id","\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA","\u05DE\u05E1\u05E4\u05E8 \u05D6\u05D4\u05D5\u05EA","\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4"]},{type:"financial",tokens:["iban","swift","bic","salary","income","wage","\u05D0\u05E9\u05E8\u05D0\u05D9","\u05E9\u05DB\u05E8","\u05DE\u05E9\u05DB\u05D5\u05E8\u05EA","\u05D4\u05DB\u05E0\u05E1\u05D4"],phrases:["bank account","account number","credit card","card number","routing number","sort code","\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7","\u05DE\u05E1\u05E4\u05E8 \u05D7\u05E9\u05D1\u05D5\u05DF","\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"]},{type:"policy",tokens:["policy","\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"],phrases:["policy number","member number","\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"]},{type:"agent_id",tokens:["\u05DE\u05E9\u05D5\u05D5\u05E7"],phrases:["agent number","agent code","broker id","\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF"]},{type:"dob",tokens:["dob","birthdate","birthday","\u05DC\u05D9\u05D3\u05D4","\u05D4\u05D5\u05DC\u05D3\u05EA","\u05D2\u05D9\u05DC"],phrases:["date of birth","birth date","\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"]},{type:"phone",tokens:["phone","tel","mobile","cell","fax","\u05D8\u05DC\u05E4\u05D5\u05DF","\u05E0\u05D9\u05D9\u05D3","\u05E4\u05DC\u05D0\u05E4\u05D5\u05DF","\u05E1\u05DC\u05D5\u05DC\u05E8\u05D9"],phrases:["phone number","mobile number","cell phone","\u05D8\u05DC\u05E4\u05D5\u05DF \u05E0\u05D9\u05D9\u05D3"]},{type:"email",tokens:["email","mail","\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC","\u05DE\u05D9\u05D9\u05DC","\u05D3\u05D5\u05D0\u05DC"],phrases:["email address","e mail","\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D9\u05D9\u05DC"]},{type:"address",tokens:["address","street","city","zipcode","zip","postcode","\u05DB\u05EA\u05D5\u05D1\u05EA","\u05E8\u05D7\u05D5\u05D1","\u05E2\u05D9\u05E8","\u05D9\u05E9\u05D5\u05D1","\u05D9\u05D9\u05E9\u05D5\u05D1","\u05DE\u05D9\u05E7\u05D5\u05D3","\u05DE\u05E2\u05DF"],phrases:["home address","postal code","street address","zip code","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D2\u05D5\u05E8\u05D9\u05DD"]},{type:"location",tokens:["gps","latitude","longitude","geolocation","\u05DE\u05D9\u05E7\u05D5\u05DD"],phrases:["gps coordinates"]},{type:"tracking",tokens:["plate","vehicle","\u05E8\u05DB\u05D1","\u05E8\u05D9\u05E9\u05D5\u05D9"],phrases:["license plate","vehicle number","plate number","\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"]},{type:"name",tokens:["name","\u05E9\u05DD"],phrases:["first name","last name","full name","family name","given name","surname","\u05E9\u05DD \u05E4\u05E8\u05D8\u05D9","\u05E9\u05DD \u05DE\u05E9\u05E4\u05D7\u05D4","\u05E9\u05DD \u05DE\u05DC\u05D0"]}];function Ae(t){if(!t)return null;let e=t.trim().toLowerCase().replace(/["'`׳״]/g,"").replace(/[_\-.]+/g," ").replace(/\s+/g," ").trim();if(!e)return null;let n=new Set(e.match(/[\p{L}\p{N}]+/gu)??[]);for(let i of Lt)if(i.phrases?.some(s=>e.includes(s))||i.tokens?.some(s=>n.has(s)))return{type:i.type,label:i.type,labelHe:Dt(i.type)};return null}function Dt(t){return{id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",name:"\u05E9\u05DD \u05D0\u05D3\u05DD",email:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9",phone:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",financial:"\u05E4\u05E8\u05D8\u05D9\u05DD \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9\u05D9\u05DD",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",minor_data:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF",sensitive_personal:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9",biometric:"\u05DE\u05D9\u05D3\u05E2 \u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9",auth:"\u05E1\u05D9\u05E1\u05DE\u05D0\u05D5\u05EA/\u05E1\u05D5\u05D3\u05D5\u05EA",tracking:"\u05DE\u05D6\u05D4\u05D9 \u05DE\u05E2\u05E7\u05D1",location:"\u05DE\u05D9\u05E7\u05D5\u05DD"}[t]??"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9"}var $e={_comment:"CANONICAL secret ruleset \u2014 the SINGLE SOURCE OF TRUTH for hardcoded-secret detection, loaded by BOTH the web scanner (lib/soc/exposure-map.ts) and the installed Capsule agent (apps/desktop/src-tauri/src/scanner.rs, via include_str!). Patterns are written in the regex subset both JavaScript and the Rust `regex` crate accept (no lookaround, no backreferences). A connection string counts only WITH credentials (user:pass@). Edit here once and both engines stay aligned.",rules:[{id:"aws-access-key",subkind:"aws_access_key",name:"AWS Access Key",severity:"critical",pattern:"(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)",hint:"AWS access key id detected. Rotate via IAM and move to an environment variable."},{id:"aws-secret-key",subkind:"aws_secret_key",name:"AWS Secret Key",severity:"critical",pattern:`(?:aws_secret_access_key|aws_secret_key|secret_access_key)\\s*[=:]\\s*['"]?[A-Za-z0-9/+=]{40}['"]?`,hint:"AWS secret access key detected. Rotate immediately."},{id:"gcp-api-key",subkind:"gcp_api_key",name:"GCP API Key",severity:"critical",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Google API key detected. Restrict or rotate it in the Google Cloud console."},{id:"gcp-service-account",subkind:"gcp_service_account",name:"GCP Service Account",severity:"critical",pattern:'"type"\\s*:\\s*"service_account"',hint:"GCP service-account JSON detected. Move it out of the repo and rotate the key."},{id:"github-token",subkind:"github_token",name:"GitHub Token",severity:"critical",pattern:"gh[pousr]_[0-9a-zA-Z]{36,}",hint:"GitHub token detected. Revoke at https://github.com/settings/tokens."},{id:"github-fine-grained",subkind:"github_fine_grained_token",name:"GitHub Fine-Grained Token",severity:"critical",pattern:"github_pat_[0-9a-zA-Z_]{22,}",hint:"GitHub fine-grained token detected. Revoke it in GitHub settings."},{id:"gitlab-token",subkind:"gitlab_token",name:"GitLab Token",severity:"critical",pattern:"glpat-[0-9a-zA-Z_-]{20,}",hint:"GitLab token detected. Revoke it in GitLab access tokens."},{id:"stripe-secret",subkind:"stripe_key",name:"Stripe Secret Key",severity:"critical",pattern:"sk_live_[0-9a-zA-Z]{24,}",hint:"Stripe live secret key detected. Roll it in the Stripe dashboard."},{id:"stripe-restricted",subkind:"stripe_restricted_key",name:"Stripe Restricted Key",severity:"critical",pattern:"rk_live_[0-9a-zA-Z]{24,}",hint:"Stripe restricted key detected. Roll it in the Stripe dashboard."},{id:"slack-token",subkind:"slack_token",name:"Slack Token",severity:"high",pattern:"xox[baprs]-[0-9a-zA-Z-]{10,}",hint:"Slack token detected. Revoke it in the Slack app settings."},{id:"slack-webhook",subkind:"slack_webhook",name:"Slack Webhook",severity:"high",pattern:"hooks\\.slack\\.com/services/T[0-9A-Z]{8,}/B[0-9A-Z]{8,}/[0-9a-zA-Z]{24}",hint:"Slack incoming-webhook URL detected. Regenerate it."},{id:"twilio-api-key",subkind:"twilio_api_key",name:"Twilio API Key",severity:"high",pattern:"SK[0-9a-fA-F]{32}",hint:"Twilio API key detected. Rotate it in the Twilio console."},{id:"sendgrid-api-key",subkind:"sendgrid_api_key",name:"SendGrid API Key",severity:"critical",pattern:"SG\\.[0-9a-zA-Z_-]{22}\\.[0-9a-zA-Z_-]{43}",hint:"SendGrid API key detected. Rotate it in the SendGrid console."},{id:"postgres-uri",subkind:"postgres_uri",name:"PostgreSQL Connection String",severity:"critical",pattern:`postgres(?:ql)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"PostgreSQL connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"mongodb-uri",subkind:"mongodb_uri",name:"MongoDB Connection String",severity:"critical",pattern:`mongodb(?:\\+srv)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"MongoDB connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"redis-uri",subkind:"redis_uri",name:"Redis Connection String",severity:"high",pattern:`redis(?:s)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"Redis connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"openai-key",subkind:"openai_key",name:"OpenAI API Key",severity:"critical",pattern:"sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}",hint:"OpenAI API key detected. Rotate at https://platform.openai.com/api-keys."},{id:"anthropic-key",subkind:"anthropic_key",name:"Anthropic API Key",severity:"critical",pattern:"sk-ant-[0-9a-zA-Z_-]{40,}",hint:"Anthropic API key detected. Rotate at https://console.anthropic.com/."},{id:"firebase-key",subkind:"firebase_key",name:"Firebase API Key",severity:"high",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Firebase API key detected. Restrict it in the Firebase console."},{id:"supabase-key",subkind:"supabase_key",name:"Supabase Service Key",severity:"critical",pattern:"eyJ[0-9a-zA-Z_-]{100,}",hint:"Long JWT (possible Supabase service key) detected. Rotate it and keep it server-side only."},{id:"private-key",subkind:"private_key",name:"Private Key",severity:"critical",pattern:"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",hint:"Private key material in plaintext. Rotate immediately and move to a key manager (KMS/Vault).",skipPlaceholder:!0},{id:"jwt-secret",subkind:"jwt_secret",name:"JWT/Generic Secret",severity:"high",pattern:`(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded signing/API secret detected. Move it to an environment variable and rotate it."},{id:"password-in-code",subkind:"password_in_code",name:"Password in Code",severity:"high",pattern:`(?:password|passwd|pwd)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded password detected. Move it to a secret manager and rotate it."},{id:"bearer-token",subkind:"bearer_token",name:"Bearer Token in Code",severity:"high",pattern:`['"]Bearer\\s+[0-9a-zA-Z._-]{20,}['"]`,hint:"Hardcoded bearer token detected. Move it to a secret manager and rotate it."},{id:"hex-secret-32",subkind:"hex_secret",name:"Hardcoded 32+ Hex Secret",severity:"medium",pattern:`['"][0-9a-f]{32,}['"]`,hint:"Long hex string that looks like a secret/hash. Confirm it is not a live credential."},{id:"base64-secret",subkind:"base64_secret",name:"Hardcoded Base64 Secret (long)",severity:"medium",pattern:`['"][A-Za-z0-9+/]{64,}={0,2}['"]`,hint:"Long base64 blob that looks like an embedded secret. Confirm it is not a live credential."}]};var Ht=[{type:"full_name",kind:"name",severity:"medium",hint:`A person's name in free text (after a role word such as \u05DC\u05E7\u05D5\u05D7 / \u05DE\u05E8 / \u05E2\u05D5"\u05D3).`},{type:"bank_account",kind:"bank_account",severity:"high",hint:"An Israeli bank account number (branch-account-check form) in plaintext."},{type:"medical",kind:"medical",severity:"high",hint:"Medical information (diagnosis, medication, lab value) in plaintext."},{type:"birth_date",kind:"dob",severity:"medium",hint:"A date of birth in plaintext."},{type:"address",kind:"address",severity:"medium",hint:"A street address in plaintext."},{type:"license_plate",kind:"plate",severity:"low",hint:"A vehicle licence plate in plaintext."}],zt=/^(?:לקוח|מטופל|מועמד|שם|נהג|מבוטח|תובע|נתבע|שוכר|מחזיק|עו"ד|ד"ר|פרופ'|מר|גברת|חשבון|ח-ן|[בהוכלמש]{0,2}אבחנ[הות]|תאריך לידה|נולד|נולדה|ד\.ל\.|[בהוכלמש]{0,2}גיל)\s*:?\s*/;function Nt(t,e,n,i){if(i==="address")return{start:e,end:n};let r=zt.exec(t.slice(e,n));return r&&e+r[0].length<n?{start:e+r[0].length,end:n}:{start:e,end:n}}var Ut=new Set(["hex-secret-32","base64-secret"]),Te=!1;function Ce(){if(Te)return;Te=!0;let t=Ht.map(({type:n,kind:i,severity:r,hint:s})=>{let a=new D([n]);return{kind:i,severity:r,hint:s,find:o=>a.detect(o).map(c=>Nt(o,c.startIndex,c.endIndex,i))}}),e=$e.rules.filter(n=>!Ut.has(n.id)).map(n=>({id:n.id,name:n.name,severity:n.severity,pattern:new RegExp(n.pattern)}));N({text:t,header:n=>{let i=Ae(n);return i?{type:i.type,label:i.labelHe||i.label}:null},secrets:e})}Ce();Ee(process.argv.slice(2)).catch(()=>{process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"ask",permissionDecisionReason:"NoData could not check this file before it is read. Allow anyway?"}}))});
+\u05E7\u05E8\u05D9\u05D0\u05D4 \u05EA\u05E6\u05D9\u05D2 \u05D0\u05EA \u05D4\u05E2\u05E8\u05DB\u05D9\u05DD \u05D4\u05D0\u05DC\u05D4 \u05DC\u05D1\u05D9\u05E0\u05D4 \u05D4\u05DE\u05DC\u05D0\u05DB\u05D5\u05EA\u05D9\u05EA. \u05D1\u05D8\u05D5\u05D7 \u05D9\u05D5\u05EA\u05E8: nodata_redact (\u05E2\u05D5\u05EA\u05E7 \u05E0\u05E7\u05D9 \u05DC\u05E2\u05D1\u05D5\u05D3\u05D4) \u05D0\u05D5 nodata_protect (\u05E0\u05E2\u05D9\u05DC\u05D4).`+(i?"":" \u05DC\u05D0\u05E9\u05E8 \u05D0\u05EA \u05D4\u05E7\u05E8\u05D9\u05D0\u05D4 \u05D1\u05DB\u05DC \u05D6\u05D0\u05EA?"),`NoData scanned this on your machine before the assistant reads it:
+  ${r.join(`
+  `)}
+Reading it puts these values in front of the AI. Safer: nodata_redact (a clean copy to work on) or nodata_protect (lock it).`+(i?"":" Allow this read anyway?"));return{decision:i?"deny":"ask",reason:s}}function mn(e,t,n){let i=Be(e,t,n);return i.length===0?null:`NoData \xB7 ON SCREEN rule. What you just read holds personal data:
+  ${i.join(`
+  `)}
+The user's screen is not private \u2014 someone may be beside them. Answer with totals, counts, groupings and trends. Do not print names, ID / policy / account numbers, addresses, phones, or amounts tied to a person \u2014 not in a table, not as an "example" \u2014 unless the user explicitly asks to see those values. To work on the values safely, offer nodata_redact (a clean copy).`+(M()==="he"?" Answer the user in Hebrew.":"")}function gn(e){try{let t=Ne(Me(),".nodata");en(t,{recursive:!0}),Yt(Ne(t,"gate.log"),JSON.stringify({at:new Date().toISOString(),...e})+`
+`,{mode:384})}catch{}}async function Ue(e){let t=e.includes("--block"),n=e.includes("--post"),i="";for await(let a of process.stdin)i+=a;let r;try{r=JSON.parse(i)}catch{return}let s=r.tool_name??"";if(n){let a=mn(s,r.tool_input??{},r.cwd??process.cwd());a&&process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PostToolUse",additionalContext:a}}));return}let o=hn(s,r.tool_input??{},r.cwd??process.cwd(),t);o.decision!=="allow"&&(gn({tool:s,decision:o.decision}),process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:o.decision,permissionDecisionReason:o.reason}})))}var yn=[{type:"id_number",patterns:[/\b\d{9}\b/g,/ת\.?ז\.?\s*:?\s*(\d{9})/g,/זהות\s*:?\s*(\d{9})/g],confidence:.9,replacement:()=>"[\u05EA.\u05D6. \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"phone",patterns:[/\b0[2-9]\d[\s\-]?\d{7}\b/g,/\b05[0-9][\s\-]?\d{7}\b/g,/\+972[\s\-]?[2-9]\d[\s\-]?\d{7}\b/g],confidence:.95,replacement:()=>"[\u05D8\u05DC\u05E4\u05D5\u05DF \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"email",patterns:[/[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}/g],confidence:.99,replacement:e=>{let[,t]=e.split("@");return`[\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC: ***@${t}]`}},{type:"full_name",patterns:[/(?:לקוח|מטופל|מועמד|שם|נהג|מבוטח|תובע|נתבע|שוכר|מחזיק)[:\s]+([א-ת][א-ת"'\-\s]{2,30}?)(?=[,\n\d]|ת\.ז)/g,/(?:עו"ד|ד"ר|פרופ'|מר|גברת)\s+([א-ת][א-ת"'\-\s]{2,25}?)(?=[,\n])/g],confidence:.75,replacement:()=>"[\u05E9\u05DD \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"bank_account",patterns:[/\b\d{2}[\-]\d{5,9}[\-]\d{2,3}\b/g,/(?:חשבון|ח-ן)\s*:?\s*(\d[\d\-]{8,15})/g],confidence:.88,replacement:()=>"[\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"medical",patterns:[/(?<![א-ת])[בהוכלמש]{0,2}(?:סוכרת|יתר לחץ דם|אסתמה|דיכאון|חרדה|סרטן|אי ספיקת לב|אפילפסיה)(?![א-ת])/g,/\b(?:Metformin|Lisinopril|Atorvastatin|Amlodipine|Sertraline|Fluoxetine|Omeprazole|Warfarin|Aspirin|Insulin)\b/gi,/\bHbA1c\s*:?\s*[\d.]+%?/g,/\bBMI\s*:?\s*[\d.]+/g,/(?<![א-ת])[בהוכלמש]{0,2}אבחנ[הות]\s*:?\s*[^,\n.]{2,40}/g],confidence:.85,replacement:()=>"[\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"financial_amount",patterns:[/[\d,]+(?:\.\d{2})?\s*(?:₪|ש"ח|NIS|שקל(?:ים)?)/g,/(?:₪|NIS)\s*[\d,]+(?:\.\d{2})?/g],confidence:.92,replacement:()=>"[\u05E1\u05DB\u05D5\u05DD \u05DB\u05E1\u05E4\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"birth_date",patterns:[/(?:תאריך לידה|נולד|נולדה|ד\.ל\.)\s*:?\s*\d{1,2}[\/\.\-]\d{1,2}[\/\.\-]\d{2,4}/g,/(?<![א-ת])[בהוכלמש]{0,2}גיל\s*:?\s*\d{1,3}\b/g],confidence:.88,replacement:()=>"[\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"address",patterns:[/רחוב\s+[א-ת][א-ת\s"'\-]{2,30}\s+\d{1,5}/g,/(?:רח'|רח\.)\s+[א-ת][א-ת\s"'\-]{2,30}\d{1,5}/g],confidence:.72,replacement:()=>"[\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D5\u05E1\u05EA\u05E8\u05EA]"},{type:"license_plate",patterns:[/\b\d{2,3}[\-]\d{2,3}[\-]\d{2,3}\b/g],confidence:.8,replacement:()=>"[\u05DC\u05D5\u05D7\u05D9\u05EA \u05E8\u05D9\u05E9\u05D5\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8\u05EA]"}];function bn(e){if(e.length!==9)return!1;let t=e.split("").map(Number),n=0;for(let i=0;i<9;i++){let r=t[i]*(i%2===0?1:2);r>9&&(r-=9),n+=r}return n%10===0}var O=class{constructor(t){this.enabledTypes=new Set(t)}detect(t){let n=[],i=new Set;for(let s of yn)if(this.enabledTypes.has(s.type))for(let o of s.patterns){let a=new RegExp(o.source,o.flags),l;for(;(l=a.exec(t))!==null;){let c=l[0],p=`${s.type}:${l.index}`;if(!i.has(p)){if(i.add(p),s.type==="id_number"){let d=c.replace(/\D/g,"");if(/^\d{9}$/.test(c)&&d.length===9&&!bn(d))continue}n.push({type:s.type,value:c,startIndex:l.index,endIndex:l.index+c.length,confidence:s.confidence,replacement:s.replacement(c,s.type)})}}}n.sort((s,o)=>s.startIndex-o.startIndex||o.confidence-s.confidence);let r=[];for(let s of n)r.some(a=>s.startIndex<a.endIndex&&s.endIndex>a.startIndex)||r.push(s);return r}};var _n=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם_אדם|שם הלקוח|שם_הלקוח|שם בן זוג|שם בן_זוג|שם המבוטח|שם_המבוטח|שם המוטב|שם_המוטב|שם מבוטח|שם_מבוטח|שם מוטב|שם_מוטב|שם הילד|שם_הילד|שם הקטין|שם_הקטין|firstname_he|lastname_he|shem|shem_mishpacha|shem_prati)$/i,type:"name",label:"Person name (Hebrew)",labelHe:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מספר_זהות|מס' זהות|מס_זהות|מס' ת"ז|teudat_zehut|tz|t_z|israeli_id|il_id)$/i,type:"id",label:"Israeli ID",labelHe:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|מס דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה|מס רישיון|דרכון_מספר)$/i,type:"id",label:"Passport / DL (Hebrew)",labelHe:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|דואר_אלקטרוני|אימייל|כתובת מייל|כתובת_מייל|כתובת דואר|כתובת_דואר)$/i,type:"email",label:"Email (Hebrew)",labelHe:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|מספר_טלפון|טלפון נייד|טלפון_נייד|מס נייד|מס_נייד|מס' טל)$/i,type:"phone",label:"Phone (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|כתובת_מגורים|רחוב|מס בית|מספר בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|כתובת_מלאה|מען)$/i,type:"address",label:"Address (Hebrew)",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|תאריך_לידה|ת לידה|תאריך הולדת|תאריך_הולדת|יום הולדת|יום_הולדת|גיל)$/i,type:"dob",label:"Date of birth (Hebrew)",labelHe:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|חשבון_בנק|מספר חשבון|מספר_חשבון|מס חשבון|מס' חשבון|בנק|סניף|מס סניף|iban|iban_il)$/i,type:"financial",label:"Bank account (Hebrew)",labelHe:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|כרטיס_אשראי|מספר אשראי|מס אשראי|מס' אשראי|cvv|אשראי|מס כרטיס|מס_כרטיס)$/i,type:"financial",label:"Credit card (Hebrew)",labelHe:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר_ברוטו|שכר נטו|שכר_נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"Salary / income (Hebrew)",labelHe:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|בדיקה_רפואית|מצב רפואי|מצב_רפואי|חיסון|תוצאת בדיקה|תוצאת_בדיקה|רופא|רגישות|אלרגיה|סוג דם|סוג_דם)$/i,type:"medical",label:"Medical (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מספר_פוליסה|מס פוליסה|מס' פוליסה|פוליסה|מספר חבר|מספר_חבר|מס חבר|מספר ביטוח|מספר_ביטוח|policy_?number|policy_?no|policy_?id)$/i,type:"policy",label:"Insurance policy number (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"},{pattern:/^(?:מספר סוכן|מספר_סוכן|מס סוכן|מס' סוכן|מס_סוכן|קוד סוכן|קוד_סוכן|מספר משווק|מספר_משווק|מספר יצרן|סוכן ביטוח|agent_?number|agent_?no|agent_?id|agent_?code|broker_?id|broker_?number)$/i,type:"agent_id",label:"Insurance agent / broker number (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF"},{pattern:/^(?:שם הילד|שם_הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|מספר_ילדים|תעודת לידה|ת לידה ילד)$/i,type:"minor_data",label:"Minor data (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|נטייה_מינית|השקפה פוליטית|השקפה_פוליטית|מצב משפחתי|מצב_משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"Sensitive personal (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מספר_רכב|מס רכב|מס' רכב|לוחית רישוי|לוחית_רישוי|מספר רישוי|מספר_רישוי)$/i,type:"tracking",label:"Vehicle ID (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}];function le(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let n=t.padStart(9,"0"),i=0;for(let r=0;r<9;r++){let s=parseInt(n[r]??"0",10)*(r%2+1);s>9&&(s-=9),i+=s}return i%10===0&&parseInt(n,10)>0}var j=/(?:\+972[\s-]?|0)(?:5[0-9]|[2-4]|[89])(?:[\s-]?\d){7}/g,B=/[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}/gi,U=/\bIL\d{2}\s?(?:\d{4}\s?){4}\d{3}\b/g;function Ze(e){let t=String(e??"").replace(/\D/g,"");if(t.length<13||t.length>19)return!1;let n=0,i=!1;for(let r=t.length-1;r>=0;r--){let s=t.charCodeAt(r)-48;if(s<0||s>9)return!1;i&&(s*=2,s>9&&(s-=9)),n+=s,i=!i}return n%10===0}function We(e){if(!e)return null;let t=e.trim();for(let n of _n)if(n.pattern.test(t))return{type:n.type,label:n.label,labelHe:n.labelHe};return null}var vn=[{type:"biometric",tokens:["biometric","fingerprint","\u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9"],phrases:["face id","\u05D8\u05D1\u05D9\u05E2\u05EA \u05D0\u05E6\u05D1\u05E2"]},{type:"medical",tokens:["diagnosis","medical","disease","medication","prescription","allergy","vaccine","\u05D0\u05D1\u05D7\u05D5\u05DF","\u05D0\u05D1\u05D7\u05E0\u05D4","\u05DE\u05D7\u05DC\u05D4","\u05EA\u05E8\u05D5\u05E4\u05D4","\u05DE\u05E8\u05E9\u05DD","\u05D7\u05D9\u05E1\u05D5\u05DF","\u05D0\u05DC\u05E8\u05D2\u05D9\u05D4"],phrases:["medical record","blood type","\u05DE\u05E6\u05D1 \u05E8\u05E4\u05D5\u05D0\u05D9","\u05E1\u05D5\u05D2 \u05D3\u05DD"]},{type:"sensitive_personal",tokens:["religion","ethnicity","nationality","\u05D3\u05EA","\u05DC\u05D0\u05D5\u05DD","\u05E2\u05D3\u05D4","\u05DE\u05D5\u05E6\u05D0"],phrases:["sexual orientation","marital status","\u05DE\u05E6\u05D1 \u05DE\u05E9\u05E4\u05D7\u05EA\u05D9","\u05E0\u05D8\u05D9\u05D9\u05D4 \u05DE\u05D9\u05E0\u05D9\u05EA"]},{type:"minor_data",tokens:["minor","\u05E7\u05D8\u05D9\u05DF"],phrases:["child name","\u05E9\u05DD \u05D4\u05D9\u05DC\u05D3","\u05E9\u05DD \u05D4\u05E7\u05D8\u05D9\u05DF"]},{type:"id",tokens:["ssn","passport","\u05D6\u05D4\u05D5\u05EA","\u05D3\u05E8\u05DB\u05D5\u05DF"],phrases:["national id","id number","identity number","social security","driver license","driving license","drivers license","passport number","tax id","\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA","\u05DE\u05E1\u05E4\u05E8 \u05D6\u05D4\u05D5\u05EA","\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4"]},{type:"financial",tokens:["iban","swift","bic","salary","income","wage","\u05D0\u05E9\u05E8\u05D0\u05D9","\u05E9\u05DB\u05E8","\u05DE\u05E9\u05DB\u05D5\u05E8\u05EA","\u05D4\u05DB\u05E0\u05E1\u05D4"],phrases:["bank account","account number","credit card","card number","routing number","sort code","\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7","\u05DE\u05E1\u05E4\u05E8 \u05D7\u05E9\u05D1\u05D5\u05DF","\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"]},{type:"policy",tokens:["policy","\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"],phrases:["policy number","member number","\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"]},{type:"agent_id",tokens:["\u05DE\u05E9\u05D5\u05D5\u05E7"],phrases:["agent number","agent code","broker id","\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF"]},{type:"dob",tokens:["dob","birthdate","birthday","\u05DC\u05D9\u05D3\u05D4","\u05D4\u05D5\u05DC\u05D3\u05EA","\u05D2\u05D9\u05DC"],phrases:["date of birth","birth date","\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"]},{type:"phone",tokens:["phone","tel","mobile","cell","fax","\u05D8\u05DC\u05E4\u05D5\u05DF","\u05E0\u05D9\u05D9\u05D3","\u05E4\u05DC\u05D0\u05E4\u05D5\u05DF","\u05E1\u05DC\u05D5\u05DC\u05E8\u05D9"],phrases:["phone number","mobile number","cell phone","\u05D8\u05DC\u05E4\u05D5\u05DF \u05E0\u05D9\u05D9\u05D3"]},{type:"email",tokens:["email","mail","\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC","\u05DE\u05D9\u05D9\u05DC","\u05D3\u05D5\u05D0\u05DC"],phrases:["email address","e mail","\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D9\u05D9\u05DC"]},{type:"address",tokens:["address","street","city","zipcode","zip","postcode","\u05DB\u05EA\u05D5\u05D1\u05EA","\u05E8\u05D7\u05D5\u05D1","\u05E2\u05D9\u05E8","\u05D9\u05E9\u05D5\u05D1","\u05D9\u05D9\u05E9\u05D5\u05D1","\u05DE\u05D9\u05E7\u05D5\u05D3","\u05DE\u05E2\u05DF"],phrases:["home address","postal code","street address","zip code","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D2\u05D5\u05E8\u05D9\u05DD"]},{type:"location",tokens:["gps","latitude","longitude","geolocation","\u05DE\u05D9\u05E7\u05D5\u05DD"],phrases:["gps coordinates"]},{type:"tracking",tokens:["plate","vehicle","\u05E8\u05DB\u05D1","\u05E8\u05D9\u05E9\u05D5\u05D9"],phrases:["license plate","vehicle number","plate number","\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"]},{type:"name",tokens:["name","\u05E9\u05DD"],phrases:["first name","last name","full name","family name","given name","surname","\u05E9\u05DD \u05E4\u05E8\u05D8\u05D9","\u05E9\u05DD \u05DE\u05E9\u05E4\u05D7\u05D4","\u05E9\u05DD \u05DE\u05DC\u05D0"]}];function Z(e){if(!e)return null;let t=e.trim().toLowerCase().replace(/["'`׳״]/g,"").replace(/[_\-.]+/g," ").replace(/\s+/g," ").trim();if(!t)return null;let n=new Set(t.match(/[\p{L}\p{N}]+/gu)??[]);for(let i of vn)if(i.phrases?.some(s=>t.includes(s))||i.tokens?.some(s=>n.has(s)))return{type:i.type,label:i.type,labelHe:W(i.type)};return null}function W(e){return{id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",name:"\u05E9\u05DD \u05D0\u05D3\u05DD",email:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9",phone:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",financial:"\u05E4\u05E8\u05D8\u05D9\u05DD \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9\u05D9\u05DD",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",minor_data:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF",sensitive_personal:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9",biometric:"\u05DE\u05D9\u05D3\u05E2 \u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9",auth:"\u05E1\u05D9\u05E1\u05DE\u05D0\u05D5\u05EA/\u05E1\u05D5\u05D3\u05D5\u05EA",tracking:"\u05DE\u05D6\u05D4\u05D9 \u05DE\u05E2\u05E7\u05D1",location:"\u05DE\u05D9\u05E7\u05D5\u05DD"}[e]??"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9"}function Ve(e){let t=0,n=0,i=0,r=0,s=0;for(let a of e)typeof a=="string"&&(le(a)&&t++,j.lastIndex=0,j.test(a)&&n++,B.lastIndex=0,B.test(a)&&i++,U.lastIndex=0,U.test(a)&&r++,Ze(a)&&s++);let o=e.length||1;return t/o>=.3?{type:"id",label:"Israeli ID (sniffed)",matchedSample:t}:r/o>=.3?{type:"financial",label:"IBAN-IL (sniffed)",matchedSample:r}:n/o>=.3?{type:"phone",label:"IL phone (sniffed)",matchedSample:n}:i/o>=.3?{type:"email",label:"Email (sniffed)",matchedSample:i}:s/o>=.3?{type:"financial",label:"Credit card (sniffed)",matchedSample:s}:null}var Ke={_comment:"CANONICAL secret ruleset \u2014 the SINGLE SOURCE OF TRUTH for hardcoded-secret detection, loaded by BOTH the web scanner (lib/soc/exposure-map.ts) and the installed Capsule agent (apps/desktop/src-tauri/src/scanner.rs, via include_str!). Patterns are written in the regex subset both JavaScript and the Rust `regex` crate accept (no lookaround, no backreferences). A connection string counts only WITH credentials (user:pass@). Edit here once and both engines stay aligned.",rules:[{id:"aws-access-key",subkind:"aws_access_key",name:"AWS Access Key",severity:"critical",pattern:"(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)",hint:"AWS access key id detected. Rotate via IAM and move to an environment variable."},{id:"aws-secret-key",subkind:"aws_secret_key",name:"AWS Secret Key",severity:"critical",pattern:`(?:aws_secret_access_key|aws_secret_key|secret_access_key)\\s*[=:]\\s*['"]?[A-Za-z0-9/+=]{40}['"]?`,hint:"AWS secret access key detected. Rotate immediately."},{id:"gcp-api-key",subkind:"gcp_api_key",name:"GCP API Key",severity:"critical",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Google API key detected. Restrict or rotate it in the Google Cloud console."},{id:"gcp-service-account",subkind:"gcp_service_account",name:"GCP Service Account",severity:"critical",pattern:'"type"\\s*:\\s*"service_account"',hint:"GCP service-account JSON detected. Move it out of the repo and rotate the key."},{id:"github-token",subkind:"github_token",name:"GitHub Token",severity:"critical",pattern:"gh[pousr]_[0-9a-zA-Z]{36,}",hint:"GitHub token detected. Revoke at https://github.com/settings/tokens."},{id:"github-fine-grained",subkind:"github_fine_grained_token",name:"GitHub Fine-Grained Token",severity:"critical",pattern:"github_pat_[0-9a-zA-Z_]{22,}",hint:"GitHub fine-grained token detected. Revoke it in GitHub settings."},{id:"gitlab-token",subkind:"gitlab_token",name:"GitLab Token",severity:"critical",pattern:"glpat-[0-9a-zA-Z_-]{20,}",hint:"GitLab token detected. Revoke it in GitLab access tokens."},{id:"stripe-secret",subkind:"stripe_key",name:"Stripe Secret Key",severity:"critical",pattern:"sk_live_[0-9a-zA-Z]{24,}",hint:"Stripe live secret key detected. Roll it in the Stripe dashboard."},{id:"stripe-restricted",subkind:"stripe_restricted_key",name:"Stripe Restricted Key",severity:"critical",pattern:"rk_live_[0-9a-zA-Z]{24,}",hint:"Stripe restricted key detected. Roll it in the Stripe dashboard."},{id:"slack-token",subkind:"slack_token",name:"Slack Token",severity:"high",pattern:"xox[baprs]-[0-9a-zA-Z-]{10,}",hint:"Slack token detected. Revoke it in the Slack app settings."},{id:"slack-webhook",subkind:"slack_webhook",name:"Slack Webhook",severity:"high",pattern:"hooks\\.slack\\.com/services/T[0-9A-Z]{8,}/B[0-9A-Z]{8,}/[0-9a-zA-Z]{24}",hint:"Slack incoming-webhook URL detected. Regenerate it."},{id:"twilio-api-key",subkind:"twilio_api_key",name:"Twilio API Key",severity:"high",pattern:"SK[0-9a-fA-F]{32}",hint:"Twilio API key detected. Rotate it in the Twilio console."},{id:"sendgrid-api-key",subkind:"sendgrid_api_key",name:"SendGrid API Key",severity:"critical",pattern:"SG\\.[0-9a-zA-Z_-]{22}\\.[0-9a-zA-Z_-]{43}",hint:"SendGrid API key detected. Rotate it in the SendGrid console."},{id:"postgres-uri",subkind:"postgres_uri",name:"PostgreSQL Connection String",severity:"critical",pattern:`postgres(?:ql)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"PostgreSQL connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"mongodb-uri",subkind:"mongodb_uri",name:"MongoDB Connection String",severity:"critical",pattern:`mongodb(?:\\+srv)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"MongoDB connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"redis-uri",subkind:"redis_uri",name:"Redis Connection String",severity:"high",pattern:`redis(?:s)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"Redis connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"openai-key",subkind:"openai_key",name:"OpenAI API Key",severity:"critical",pattern:"sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}",hint:"OpenAI API key detected. Rotate at https://platform.openai.com/api-keys."},{id:"anthropic-key",subkind:"anthropic_key",name:"Anthropic API Key",severity:"critical",pattern:"sk-ant-[0-9a-zA-Z_-]{40,}",hint:"Anthropic API key detected. Rotate at https://console.anthropic.com/."},{id:"firebase-key",subkind:"firebase_key",name:"Firebase API Key",severity:"high",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Firebase API key detected. Restrict it in the Firebase console."},{id:"supabase-key",subkind:"supabase_key",name:"Supabase Service Key",severity:"critical",pattern:"eyJ[0-9a-zA-Z_-]{100,}",hint:"Long JWT (possible Supabase service key) detected. Rotate it and keep it server-side only."},{id:"private-key",subkind:"private_key",name:"Private Key",severity:"critical",pattern:"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",hint:"Private key material in plaintext. Rotate immediately and move to a key manager (KMS/Vault).",skipPlaceholder:!0},{id:"jwt-secret",subkind:"jwt_secret",name:"JWT/Generic Secret",severity:"high",pattern:`(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded signing/API secret detected. Move it to an environment variable and rotate it."},{id:"password-in-code",subkind:"password_in_code",name:"Password in Code",severity:"high",pattern:`(?:password|passwd|pwd)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded password detected. Move it to a secret manager and rotate it."},{id:"bearer-token",subkind:"bearer_token",name:"Bearer Token in Code",severity:"high",pattern:`['"]Bearer\\s+[0-9a-zA-Z._-]{20,}['"]`,hint:"Hardcoded bearer token detected. Move it to a secret manager and rotate it."},{id:"hex-secret-32",subkind:"hex_secret",name:"Hardcoded 32+ Hex Secret",severity:"medium",pattern:`['"][0-9a-f]{32,}['"]`,hint:"Long hex string that looks like a secret/hash. Confirm it is not a live credential."},{id:"base64-secret",subkind:"base64_secret",name:"Hardcoded Base64 Secret (long)",severity:"medium",pattern:`['"][A-Za-z0-9+/]{64,}={0,2}['"]`,hint:"Long base64 blob that looks like an embedded secret. Confirm it is not a live credential."}]};var Sn=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name",labelHe:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA \u05D0\u05D9\u05DE\u05D9\u05D9\u05DC"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05DE\u05D6\u05D4\u05D4"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth",labelHe:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account",labelHe:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card",labelHe:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Financial data",labelHe:"\u05E0\u05EA\u05D5\u05DF \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication)$/i,type:"medical",label:"Medical data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(ip_?address)$/i,type:"tracking",label:"IP address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA IP"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D3\u05E8\u05DB\u05D5\u05DF"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license",labelHe:"\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4"},{pattern:/^(iban|swift_?code|bic)$/i,type:"financial",label:"Banking code",labelHe:"\u05E7\u05D5\u05D3 \u05D1\u05E0\u05E7\u05D0\u05D9"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05DE\u05E1"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Member ID",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D1\u05D9\u05D8\u05D5\u05D7/\u05D7\u05D1\u05E8"},{pattern:/^(blood_?type|allergy|allergies|prescription)$/i,type:"medical",label:"Medical data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation",labelHe:"\u05DE\u05D9\u05E7\u05D5\u05DD \u05D2\u05D9\u05D0\u05D5\u05D2\u05E8\u05E4\u05D9"},{pattern:/^(mac_?address|device_?fingerprint|imei|serial_?number)$/i,type:"tracking",label:"Device identifier",labelHe:"\u05DE\u05D6\u05D4\u05D4 \u05DE\u05DB\u05E9\u05D9\u05E8"},{pattern:/^(ethnicity|race|religion|political_?affiliation|sexual_?orientation)$/i,type:"sensitive_personal",label:"Sensitive personal",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(minor|child_?name|child_?age|dependent)$/i,type:"minor_data",label:"Minor data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05E0\u05D9\u05DD"},{pattern:/^(signature|digital_?signature)$/i,type:"id",label:"Signature",labelHe:"\u05D7\u05EA\u05D9\u05DE\u05D4"},{pattern:/^(vehicle_?number|license_?plate|plate_?number)$/i,type:"tracking",label:"Vehicle ID",labelHe:"\u05DE\u05D6\u05D4\u05D4 \u05E8\u05DB\u05D1"}],wn=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|sort_?order|position|enabled|active|public|version|metadata|config|settings|options|data|content|body|raw|json|text|note|comment|label|color|icon|image|avatar|logo|thumbnail|preview|template|schema|format|mode|level|priority|severity|source|target|parent|child|owner|creator|modifier|assignee|project|workspace|organization|team|group|channel|thread|room|session|device|platform|browser|locale|timezone|currency|country|region|city|zip|postal|state|province|name|display_?name|user_?agent|password_?hash|secret|token|private_?key|auth_?token|constraint|index|sequence|trigger|function|procedure|database|namespace|migration|revision)$/i,In=/^(beacon_?registr|device_?config|hardware|sensor|firmware|telemetry|metric|analytic|log_?event|audit_?log|system_?config|cache|queue|job|migration|schema_?version|spatial_?ref)/i,En=/^(minor|major|uuid|rssi|tx_?power|beacon_?id|device_?type|firmware_?version|batch_?id|zone_?id)$/i;function Ge(e,t){if(wn.test(e)||/^name$/i.test(e)||t&&In.test(t)||En.test(e))return null;for(let i of Sn)if(i.pattern.test(e))return i.type;let n=We(e);return n?n.type:null}var nr=Ke.rules.map(e=>({id:e.id,name:e.name,pattern:new RegExp(e.pattern),severity:e.severity}));var ir=512*1024,rr=50*1024*1024;var An={id:"high",agent_id:"high",policy:"high",financial:"high",medical:"critical",sensitive_personal:"critical",minor_data:"critical",biometric:"critical",auth:"critical",name:"medium",email:"high",phone:"high",address:"high",dob:"high",location:"high",tracking:"low"};function $n(e){return An[e]??"low"}function Je(e,t){let n=[];for(let i of t){let r=i.rows.length;for(let s=0;s<i.headers.length;s++){let o=i.headers[s]??"",a=o?Ge(o.trim().replace(/["'`׳״:]/g,"").replace(/\s+/g,"_"),i.name)??Z(o)?.type??null:null,l=[];for(let p of i.rows){let d=p[s];typeof d=="string"&&d.length>0&&l.push(d)}let c=l.length>0?Ve(l):null;c?n.push(Xe(e,i.name,o,c.type,c.label,"value",c.matchedSample,r)):a&&n.push(Xe(e,i.name,o,a,W(a),"header",0,r))}}return n}function Xe(e,t,n,i,r,s,o,a){return{file:e,location:t,column:n,type:i,label:r,category:W(i),severity:$n(i),matchKind:s,hits:o,sampleSize:a}}var qe={_comment:"CANONICAL secret ruleset \u2014 the SINGLE SOURCE OF TRUTH for hardcoded-secret detection, loaded by BOTH the web scanner (lib/soc/exposure-map.ts) and the installed Capsule agent (apps/desktop/src-tauri/src/scanner.rs, via include_str!). Patterns are written in the regex subset both JavaScript and the Rust `regex` crate accept (no lookaround, no backreferences). A connection string counts only WITH credentials (user:pass@). Edit here once and both engines stay aligned.",rules:[{id:"aws-access-key",subkind:"aws_access_key",name:"AWS Access Key",severity:"critical",pattern:"(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)",hint:"AWS access key id detected. Rotate via IAM and move to an environment variable."},{id:"aws-secret-key",subkind:"aws_secret_key",name:"AWS Secret Key",severity:"critical",pattern:`(?:aws_secret_access_key|aws_secret_key|secret_access_key)\\s*[=:]\\s*['"]?[A-Za-z0-9/+=]{40}['"]?`,hint:"AWS secret access key detected. Rotate immediately."},{id:"gcp-api-key",subkind:"gcp_api_key",name:"GCP API Key",severity:"critical",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Google API key detected. Restrict or rotate it in the Google Cloud console."},{id:"gcp-service-account",subkind:"gcp_service_account",name:"GCP Service Account",severity:"critical",pattern:'"type"\\s*:\\s*"service_account"',hint:"GCP service-account JSON detected. Move it out of the repo and rotate the key."},{id:"github-token",subkind:"github_token",name:"GitHub Token",severity:"critical",pattern:"gh[pousr]_[0-9a-zA-Z]{36,}",hint:"GitHub token detected. Revoke at https://github.com/settings/tokens."},{id:"github-fine-grained",subkind:"github_fine_grained_token",name:"GitHub Fine-Grained Token",severity:"critical",pattern:"github_pat_[0-9a-zA-Z_]{22,}",hint:"GitHub fine-grained token detected. Revoke it in GitHub settings."},{id:"gitlab-token",subkind:"gitlab_token",name:"GitLab Token",severity:"critical",pattern:"glpat-[0-9a-zA-Z_-]{20,}",hint:"GitLab token detected. Revoke it in GitLab access tokens."},{id:"stripe-secret",subkind:"stripe_key",name:"Stripe Secret Key",severity:"critical",pattern:"sk_live_[0-9a-zA-Z]{24,}",hint:"Stripe live secret key detected. Roll it in the Stripe dashboard."},{id:"stripe-restricted",subkind:"stripe_restricted_key",name:"Stripe Restricted Key",severity:"critical",pattern:"rk_live_[0-9a-zA-Z]{24,}",hint:"Stripe restricted key detected. Roll it in the Stripe dashboard."},{id:"slack-token",subkind:"slack_token",name:"Slack Token",severity:"high",pattern:"xox[baprs]-[0-9a-zA-Z-]{10,}",hint:"Slack token detected. Revoke it in the Slack app settings."},{id:"slack-webhook",subkind:"slack_webhook",name:"Slack Webhook",severity:"high",pattern:"hooks\\.slack\\.com/services/T[0-9A-Z]{8,}/B[0-9A-Z]{8,}/[0-9a-zA-Z]{24}",hint:"Slack incoming-webhook URL detected. Regenerate it."},{id:"twilio-api-key",subkind:"twilio_api_key",name:"Twilio API Key",severity:"high",pattern:"SK[0-9a-fA-F]{32}",hint:"Twilio API key detected. Rotate it in the Twilio console."},{id:"sendgrid-api-key",subkind:"sendgrid_api_key",name:"SendGrid API Key",severity:"critical",pattern:"SG\\.[0-9a-zA-Z_-]{22}\\.[0-9a-zA-Z_-]{43}",hint:"SendGrid API key detected. Rotate it in the SendGrid console."},{id:"postgres-uri",subkind:"postgres_uri",name:"PostgreSQL Connection String",severity:"critical",pattern:`postgres(?:ql)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"PostgreSQL connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"mongodb-uri",subkind:"mongodb_uri",name:"MongoDB Connection String",severity:"critical",pattern:`mongodb(?:\\+srv)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"MongoDB connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"redis-uri",subkind:"redis_uri",name:"Redis Connection String",severity:"high",pattern:`redis(?:s)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"Redis connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"openai-key",subkind:"openai_key",name:"OpenAI API Key",severity:"critical",pattern:"sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}",hint:"OpenAI API key detected. Rotate at https://platform.openai.com/api-keys."},{id:"anthropic-key",subkind:"anthropic_key",name:"Anthropic API Key",severity:"critical",pattern:"sk-ant-[0-9a-zA-Z_-]{40,}",hint:"Anthropic API key detected. Rotate at https://console.anthropic.com/."},{id:"firebase-key",subkind:"firebase_key",name:"Firebase API Key",severity:"high",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Firebase API key detected. Restrict it in the Firebase console."},{id:"supabase-key",subkind:"supabase_key",name:"Supabase Service Key",severity:"critical",pattern:"eyJ[0-9a-zA-Z_-]{100,}",hint:"Long JWT (possible Supabase service key) detected. Rotate it and keep it server-side only."},{id:"private-key",subkind:"private_key",name:"Private Key",severity:"critical",pattern:"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",hint:"Private key material in plaintext. Rotate immediately and move to a key manager (KMS/Vault).",skipPlaceholder:!0},{id:"jwt-secret",subkind:"jwt_secret",name:"JWT/Generic Secret",severity:"high",pattern:`(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded signing/API secret detected. Move it to an environment variable and rotate it."},{id:"password-in-code",subkind:"password_in_code",name:"Password in Code",severity:"high",pattern:`(?:password|passwd|pwd)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded password detected. Move it to a secret manager and rotate it."},{id:"bearer-token",subkind:"bearer_token",name:"Bearer Token in Code",severity:"high",pattern:`['"]Bearer\\s+[0-9a-zA-Z._-]{20,}['"]`,hint:"Hardcoded bearer token detected. Move it to a secret manager and rotate it."},{id:"hex-secret-32",subkind:"hex_secret",name:"Hardcoded 32+ Hex Secret",severity:"medium",pattern:`['"][0-9a-f]{32,}['"]`,hint:"Long hex string that looks like a secret/hash. Confirm it is not a live credential."},{id:"base64-secret",subkind:"base64_secret",name:"Hardcoded Base64 Secret (long)",severity:"medium",pattern:`['"][A-Za-z0-9+/]{64,}={0,2}['"]`,hint:"Long base64 blob that looks like an embedded secret. Confirm it is not a live credential."}]};var Cn=[{type:"full_name",kind:"name",severity:"medium",hint:`A person's name in free text (after a role word such as \u05DC\u05E7\u05D5\u05D7 / \u05DE\u05E8 / \u05E2\u05D5"\u05D3).`},{type:"bank_account",kind:"bank_account",severity:"high",hint:"An Israeli bank account number (branch-account-check form) in plaintext."},{type:"medical",kind:"medical",severity:"high",hint:"Medical information (diagnosis, medication, lab value) in plaintext."},{type:"birth_date",kind:"dob",severity:"medium",hint:"A date of birth in plaintext."},{type:"address",kind:"address",severity:"medium",hint:"A street address in plaintext."},{type:"license_plate",kind:"plate",severity:"low",hint:"A vehicle licence plate in plaintext."}],Rn=/^(?:לקוח|מטופל|מועמד|שם|נהג|מבוטח|תובע|נתבע|שוכר|מחזיק|עו"ד|ד"ר|פרופ'|מר|גברת|חשבון|ח-ן|[בהוכלמש]{0,2}אבחנ[הות]|תאריך לידה|נולד|נולדה|ד\.ל\.|[בהוכלמש]{0,2}גיל)\s*:?\s*/;function Pn(e,t,n,i){if(i==="address")return{start:t,end:n};let r=Rn.exec(e.slice(t,n));return r&&t+r[0].length<n?{start:t+r[0].length,end:n}:{start:t,end:n}}var Ln=new Set(["hex-secret-32","base64-secret"]),Ye=!1;function Qe(){if(Ye)return;Ye=!0;let e=Cn.map(({type:n,kind:i,severity:r,hint:s})=>{let o=new O([n]);return{kind:i,severity:r,hint:s,find:a=>o.detect(a).map(l=>Pn(a,l.startIndex,l.endIndex,i))}}),t=qe.rules.filter(n=>!Ln.has(n.id)).map(n=>({id:n.id,name:n.name,severity:n.severity,pattern:new RegExp(n.pattern)}));Y({text:e,header:n=>{let i=Z(n);return i?{type:i.type,label:i.labelHe||i.label}:null},secrets:t,table:n=>Je("",[n]).filter(i=>i.column).map(i=>({column:i.column,type:i.type,category:i.category,severity:i.severity,hits:i.hits,how:i.matchKind==="value"?"value":"header"}))})}Qe();Ue(process.argv.slice(2)).catch(()=>{process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"ask",permissionDecisionReason:"NoData could not check this file before it is read. Allow anyway?"}}))});