@nodatachat/mcp 1.6.23 → 1.6.27
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/gate.js +56 -51
- package/dist/index.js +416 -406
- package/dist/scan-worker.js +1 -1
- package/dist/status.js +1 -1
- package/package.json +1 -1
package/dist/gate.js
CHANGED
|
@@ -1,72 +1,77 @@
|
|
|
1
|
-
/*! @nodatachat/mcp 1.6.
|
|
2
|
-
import{appendFileSync as Za,copyFileSync as Cp,existsSync as Sn,mkdirSync as ds,readdirSync as Ya,readFileSync as En,statSync as yt,writeFileSync as Ja}from"node:fs";import{homedir as K}from"node:os";import{basename as bt,extname as us,isAbsolute as te,join as _e,relative as fs,resolve as D}from"node:path";import{TextDecoder as kr}from"node:util";var M={text:[],header:[],secrets:[],table:null,amounts:null,severity:null};function St(e){e.table&&(M.table=e.table),e.severity&&(M.severity=e.severity),e.amounts&&(M.amounts=e.amounts);for(let t of e.text??[])M.text.some(r=>r.kind===t.kind)||M.text.push(t);e.header&&!M.header.includes(e.header)&&M.header.push(e.header);for(let t of e.secrets??[])M.secrets.some(r=>r.id===t.id)||M.secrets.push(t)}function Et(){return M.amounts?.()===!0}function Oe(){return M.text}function Nn(){return M.header}function ve(){return M.table}function On(){return M.secrets}var De=[{id:"aws-access-key",name:"AWS Access Key",pattern:/(?:^|[^A-Z0-9])AKIA(?!X{16})[A-Z2-7]{16}(?:[^A-Z2-7]|$)/,severity:"critical"},{id:"aws-secret-key",name:"AWS Secret Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/,severity:"critical"},{id:"gcp-api-key",name:"GCP API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"critical"},{id:"gcp-service-account",name:"GCP Service Account",pattern:/"type"\s*:\s*"service_account"/,severity:"critical"},{id:"github-token",name:"GitHub Token",pattern:/gh[pousr]_[0-9a-zA-Z]{36,}/,severity:"critical"},{id:"github-fine-grained",name:"GitHub Fine-Grained Token",pattern:/github_pat_[0-9a-zA-Z_]{22,}/,severity:"critical"},{id:"gitlab-token",name:"GitLab Token",pattern:/glpat-[0-9a-zA-Z_-]{20,}/,severity:"critical"},{id:"stripe-secret",name:"Stripe Secret Key",pattern:/sk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"stripe-restricted",name:"Stripe Restricted Key",pattern:/rk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"slack-token",name:"Slack Token",pattern:/xox[baprs]-[0-9a-zA-Z-]{10,}/,severity:"high"},{id:"slack-webhook",name:"Slack Webhook",pattern:/hooks\.slack\.com\/services\/T[0-9A-Z]{8,}\/B[0-9A-Z]{8,}\/[0-9a-zA-Z]{24}/,severity:"high"},{id:"twilio-api-key",name:"Twilio API Key",pattern:/SK[0-9a-fA-F]{32}/,severity:"high"},{id:"sendgrid-api-key",name:"SendGrid API Key",pattern:/SG\.[0-9a-zA-Z_-]{22}\.[0-9a-zA-Z_-]{43}/,severity:"critical"},{id:"postgres-uri",name:"PostgreSQL Connection String",pattern:/postgres(?:ql)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"mongodb-uri",name:"MongoDB Connection String",pattern:/mongodb(?:\+srv)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"redis-uri",name:"Redis Connection String",pattern:/redis(?:s)?:\/\/[^\s'"]{10,}/,severity:"high"},{id:"openai-key",name:"OpenAI API Key",pattern:/sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}/,severity:"critical"},{id:"openai-project-key",name:"OpenAI API Key",pattern:/sk-(?:proj|svcacct|admin)-[0-9A-Za-z_-]{40,}/,severity:"critical"},{id:"anthropic-key",name:"Anthropic API Key",pattern:/sk-ant-[0-9a-zA-Z_-]{40,}/,severity:"critical"},{id:"firebase-key",name:"Firebase API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"high"},{id:"supabase-key",name:"Supabase Service Key",pattern:/eyJ[0-9a-zA-Z_-]{100,}/,severity:"critical"},{id:"supabase-access-token",name:"Supabase Access Token",pattern:/\bsbp_[0-9a-f]{40}\b/,severity:"critical"},{id:"supabase-secret-key",name:"Supabase Secret Key",pattern:/\bsb_secret_[0-9A-Za-z_-]{20,}/,severity:"critical"},{id:"private-key",name:"Private Key",pattern:/-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,severity:"critical"},{id:"jwt-secret",name:"JWT/Generic Secret",pattern:/(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"password-in-code",name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"bearer-token",name:"Bearer Token in Code",pattern:/['"]Bearer\s+[0-9a-zA-Z._-]{20,}['"]/,severity:"high"}];function Se(){let e=On().filter(t=>!De.some(r=>r.id===t.id));return[...De,...e]}var Us=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Salary / income"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication|prescription)$/i,type:"medical",label:"Medical"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Policy"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation"}],Bs=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם הלקוח|שם בן זוג|שם המבוטח|שם המוטב|שם הילד|שם הקטין)$/i,type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מס' זהות|teudat_zehut|tz|israeli_id|il_id)$/i,type:"id",label:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה)$/i,type:"id",label:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|אימייל|כתובת מייל)$/i,type:"email",label:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|טלפון נייד)$/i,type:"phone",label:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|רחוב|מס בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|מען)$/i,type:"address",label:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|ת לידה|תאריך הולדת|יום הולדת|גיל)$/i,type:"dob",label:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|מספר חשבון|מס חשבון|סניף|iban|iban_il)$/i,type:"financial",label:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|מספר אשראי|cvv|אשראי)$/i,type:"financial",label:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|מצב רפואי|חיסון|רגישות|אלרגיה|סוג דם)$/i,type:"medical",label:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מס פוליסה|פוליסה|מספר חבר|מספר ביטוח)$/i,type:"id",label:"\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4/\u05D7\u05D1\u05E8\u05D5\u05EA"},{pattern:/^(?:שם הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|תעודת לידה)$/i,type:"minor_data",label:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|השקפה פוליטית|מצב משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מס רכב|לוחית רישוי|מספר רישוי)$/i,type:"tracking",label:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}],zs=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|enabled|active|public|version|metadata|config|settings|data|content|note|comment|label|color|icon)$/i,Ws=/^שם[ _](?:ה)?(?:קובץ|מוצר|פריט|חברה|ארגון|עסק|פרויקט|גיליון|טבלה|שדה|קטגוריה|סניף|בנק|עיר|רחוב|ישוב|יישוב|מסמך|תוכנית|חבילה|קורס|מחלקה|אתר|דומיין|מותג|ספק|שירות|תפקיד)$|^(file|product|item|company|org|organization|project|sheet|table|field|category|branch|bank|city|street|document|plan|course|department|site|domain|brand|vendor|service|role)[ _-]?name$/i;function Ee(e){if(!e)return null;let t=e.trim();if(zs.test(t)||/^name$/i.test(t)||/^\[[A-Z_]+(?:-\d+)?\]$/.test(t))return null;let r=t.replace(/[\s-]+/g,"_");for(let n of[...Bs,...Us])if(n.pattern.test(t)||n.pattern.test(r))return{type:n.type,label:n.label};if(Ws.test(t))return null;if(/^שם[ _][\u0590-\u05FF"'׳ ]{2,20}$/.test(t))return{type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"};if(/^(customer|client|employee|inspector|supervisor|contact|person|patient|user|owner|manager|agent|member|driver|tenant|student|parent|beneficiary|insured)_?(full_?)?name$/i.test(r))return{type:"name",label:"Person name"};for(let n of Nn()){let s=n(t);if(s)return{type:s.type,label:s.label}}return null}function Dn(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let r=t.padStart(9,"0"),n=0;for(let s=0;s<9;s++){let i=parseInt(r[s]??"0",10)*(s%2+1);i>9&&(i-=9),n+=i}return n%10===0&&parseInt(r,10)>0}function Gs(e){let t=String(e??"").replace(/\D/g,"");if(t.length<12||t.length>19)return!1;let r=0,n=!1;for(let s=t.length-1;s>=0;s-=1){let i=parseInt(t[s]??"0",10);n&&(i*=2,i>9&&(i-=9)),r+=i,n=!n}return r%10===0}function Fn(e){let t=String(e??"").replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let r=t.slice(4)+t.slice(0,4),n=0;for(let s of r){let i=s>="A"&&s<="Z"?String(s.charCodeAt(0)-55):s;for(let o of i)n=(n*10+Number(o))%97}return n===1}var At="(?<!\\d)(?<!\\d[.,])",$t="(?!\\d)(?![.,]\\d)",Rt=[{subkind:"israeli_id",severity:"high",pattern:new RegExp(`${At}(?:\\d{8}-\\d|\\d{9})${$t}`,"g"),validate:Dn,hint:"Israeli national ID (check digit verified) in plaintext. Encrypt the column or mask it at rest."},{subkind:"credit_card",severity:"critical",pattern:new RegExp(`${At}[2-6][ -]?(?:\\d[ -]?){11,17}\\d${$t}`,"g"),validate:Gs,hint:"Payment card number (Luhn verified) in plaintext. This is PCI scope."},{subkind:"iban",severity:"high",pattern:/\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b/g,validate:Fn,hint:"Bank account in IBAN form (mod-97 verified) in plaintext."},{subkind:"israeli_phone",severity:"medium",pattern:new RegExp(`${At}(?:\\+972[- ]?|0)(?:[57]\\d|[2-489])[- ]?\\d{3}[- ]?\\d{4}${$t}`,"g"),validate:e=>{let t=e.replace(/\D/g,"").replace(/^972/,"0");return/^0[57]\d{8}$/.test(t)?!0:/^0[2-489]\d{7}$/.test(t)&&(/[- ]/.test(e)||e.startsWith("+972"))},hint:"Israeli phone number in plaintext."}];function Fe(e,t){let r=[],n="",s=!1;for(let i=0;i<e.length;i++){let o=e[i];s?o==='"'&&e[i+1]==='"'?(n+='"',i++):o==='"'?s=!1:n+=o:o==='"'?s=!0:o===t?(r.push(n),n=""):n+=o}return r.push(n),r}import{inflateRawSync as Hi}from"node:zlib";import{inflateSync as Mn}from"node:zlib";var Me=new Set([".pdf"]),jn=8*1024*1024;function zn(e){let t=e.toString("latin1"),r=new Map,n=/(\d+)\s+(\d+)\s+obj\b/g,s;for(;(s=n.exec(t))!==null;){let i=Number(s[1]),o=n.lastIndex,a=t.indexOf("endobj",o);if(a<0)continue;let c=t.indexOf("stream",o),l,f=null;if(c>=0&&c<a){l=t.slice(o,c);let d=c+6;t[d]==="\r"&&(d+=1),t[d]===`
|
|
3
|
-
`&&(d+=1);let h=t.indexOf("endstream",d);h>d&&(f=e.subarray(d,h))}else l=t.slice(
|
|
4
|
-
`),n="",a=0},f=()=>{n&&!n.endsWith(" ")&&a>1&&(n+=" ")},d=/\/([^\s/<>[\]()]+)\s+-?[\d.]+\s+Tf|(-?[\d.]+)\s+(-?[\d.]+)\s+T[dD]\b|(?:-?[\d.]+\s+){5}(-?[\d.]+)\s+Tm\b|T\*|\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>|\[|\]|-?\d+(?:\.\d+)?|TJ|Tj|'|"/g,h;for(;(h=d.exec(e))!==null;){let p=h[0];if(h[1]!==void 0&&p.endsWith("Tf")){s=t.get(h[1]);continue}if(h[2]!==void 0){Math.abs(Number(h[3]))>.01?l():Number(h[2])!==0&&f();continue}if(h[4]!==void 0){let g=Number(h[4]);c!==null&&Math.abs(g-c)>.01?l():c!==null&&f(),c=g;continue}if(p==="T*"){l();continue}if(p==="["){
|
|
5
|
-
`)}var
|
|
6
|
-
`);return
|
|
7
|
-
`).map(
|
|
1
|
+
/*! @nodatachat/mcp 1.6.27 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
|
|
2
|
+
import{appendFileSync as hc,copyFileSync as nh,existsSync as In,mkdirSync as vs,readdirSync as mc,readFileSync as Tn,statSync as xt,writeFileSync as gc}from"node:fs";import{homedir as Y}from"node:os";import{basename as wt,extname as Ss,isAbsolute as ne,join as _e,relative as Es,resolve as D}from"node:path";import{TextDecoder as $r}from"node:util";var H={text:[],header:[],secrets:[],table:null,amounts:null,severity:null};function $t(e){e.table&&(H.table=e.table),e.severity&&(H.severity=e.severity),e.amounts&&(H.amounts=e.amounts);for(let t of e.text??[])H.text.some(r=>r.kind===t.kind)||H.text.push(t);e.header&&!H.header.includes(e.header)&&H.header.push(e.header);for(let t of e.secrets??[])H.secrets.some(r=>r.id===t.id)||H.secrets.push(t)}function Rt(){return H.amounts?.()===!0}function De(){return H.text}function jn(){return H.header}function ve(){return H.table}function Hn(){return H.secrets}var Fe=[{id:"aws-access-key",name:"AWS Access Key",pattern:/(?:^|[^A-Z0-9])AKIA(?!X{16})[A-Z2-7]{16}(?:[^A-Z2-7]|$)/,severity:"critical"},{id:"aws-secret-key",name:"AWS Secret Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/,severity:"critical"},{id:"gcp-api-key",name:"GCP API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"critical"},{id:"gcp-service-account",name:"GCP Service Account",pattern:/"type"\s*:\s*"service_account"/,severity:"critical"},{id:"github-token",name:"GitHub Token",pattern:/gh[pousr]_[0-9a-zA-Z]{36,}/,severity:"critical"},{id:"github-fine-grained",name:"GitHub Fine-Grained Token",pattern:/github_pat_[0-9a-zA-Z_]{22,}/,severity:"critical"},{id:"gitlab-token",name:"GitLab Token",pattern:/glpat-[0-9a-zA-Z_-]{20,}/,severity:"critical"},{id:"stripe-secret",name:"Stripe Secret Key",pattern:/sk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"stripe-restricted",name:"Stripe Restricted Key",pattern:/rk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"slack-token",name:"Slack Token",pattern:/xox[baprs]-[0-9a-zA-Z-]{10,}/,severity:"high"},{id:"slack-webhook",name:"Slack Webhook",pattern:/hooks\.slack\.com\/services\/T[0-9A-Z]{8,}\/B[0-9A-Z]{8,}\/[0-9a-zA-Z]{24}/,severity:"high"},{id:"twilio-api-key",name:"Twilio API Key",pattern:/SK[0-9a-fA-F]{32}/,severity:"high"},{id:"sendgrid-api-key",name:"SendGrid API Key",pattern:/SG\.[0-9a-zA-Z_-]{22}\.[0-9a-zA-Z_-]{43}/,severity:"critical"},{id:"postgres-uri",name:"PostgreSQL Connection String",pattern:/postgres(?:ql)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"mongodb-uri",name:"MongoDB Connection String",pattern:/mongodb(?:\+srv)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"redis-uri",name:"Redis Connection String",pattern:/redis(?:s)?:\/\/[^\s'"]{10,}/,severity:"high"},{id:"openai-key",name:"OpenAI API Key",pattern:/sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}/,severity:"critical"},{id:"openai-project-key",name:"OpenAI API Key",pattern:/sk-(?:proj|svcacct|admin)-[0-9A-Za-z_-]{40,}/,severity:"critical"},{id:"anthropic-key",name:"Anthropic API Key",pattern:/sk-ant-[0-9a-zA-Z_-]{40,}/,severity:"critical"},{id:"firebase-key",name:"Firebase API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"high"},{id:"supabase-key",name:"Supabase Service Key",pattern:/eyJ[0-9a-zA-Z_-]{100,}/,severity:"critical"},{id:"supabase-access-token",name:"Supabase Access Token",pattern:/\bsbp_[0-9a-f]{40}\b/,severity:"critical"},{id:"supabase-secret-key",name:"Supabase Secret Key",pattern:/\bsb_secret_[0-9A-Za-z_-]{20,}/,severity:"critical"},{id:"private-key",name:"Private Key",pattern:/-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,severity:"critical"},{id:"jwt-secret",name:"JWT/Generic Secret",pattern:/(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"password-in-code",name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"bearer-token",name:"Bearer Token in Code",pattern:/['"]Bearer\s+[0-9a-zA-Z._-]{20,}['"]/,severity:"high"}];function Se(){let e=Hn().filter(t=>!Fe.some(r=>r.id===t.id));return[...Fe,...e]}var eo=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Salary / income"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication|prescription)$/i,type:"medical",label:"Medical"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Policy"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation"}],to=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם הלקוח|שם בן זוג|שם המבוטח|שם המוטב|שם הילד|שם הקטין)$/i,type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מס' זהות|teudat_zehut|tz|israeli_id|il_id)$/i,type:"id",label:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה)$/i,type:"id",label:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|אימייל|כתובת מייל)$/i,type:"email",label:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|טלפון נייד)$/i,type:"phone",label:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|רחוב|מס בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|מען)$/i,type:"address",label:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|ת לידה|תאריך הולדת|יום הולדת|גיל)$/i,type:"dob",label:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|מספר חשבון|מס חשבון|סניף|iban|iban_il)$/i,type:"financial",label:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|מספר אשראי|cvv|אשראי)$/i,type:"financial",label:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|מצב רפואי|חיסון|רגישות|אלרגיה|סוג דם)$/i,type:"medical",label:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מס פוליסה|פוליסה|מספר חבר|מספר ביטוח)$/i,type:"id",label:"\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4/\u05D7\u05D1\u05E8\u05D5\u05EA"},{pattern:/^(?:שם הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|תעודת לידה)$/i,type:"minor_data",label:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|השקפה פוליטית|מצב משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מס רכב|לוחית רישוי|מספר רישוי)$/i,type:"tracking",label:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}],no=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|enabled|active|public|version|metadata|config|settings|data|content|note|comment|label|color|icon)$/i,ro=/^שם[ _](?:ה)?(?:קובץ|מוצר|פריט|חברה|ארגון|עסק|פרויקט|גיליון|טבלה|שדה|קטגוריה|סניף|בנק|עיר|רחוב|ישוב|יישוב|מסמך|תוכנית|חבילה|קורס|מחלקה|אתר|דומיין|מותג|ספק|שירות|תפקיד)$|^(file|product|item|company|org|organization|project|sheet|table|field|category|branch|bank|city|street|document|plan|course|department|site|domain|brand|vendor|service|role)[ _-]?name$/i;function Ee(e){if(!e)return null;let t=e.trim();if(no.test(t)||/^name$/i.test(t)||/^\[[A-Z_]+(?:-\d+)?\]$/.test(t))return null;let r=t.replace(/[\s-]+/g,"_");for(let n of[...to,...eo])if(n.pattern.test(t)||n.pattern.test(r))return{type:n.type,label:n.label};if(ro.test(t))return null;if(/^שם[ _][\u0590-\u05FF"'׳ ]{2,20}$/.test(t))return{type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"};if(/^(customer|client|employee|inspector|supervisor|contact|person|patient|user|owner|manager|agent|member|driver|tenant|student|parent|beneficiary|insured)_?(full_?)?name$/i.test(r))return{type:"name",label:"Person name"};for(let n of jn()){let s=n(t);if(s)return{type:s.type,label:s.label}}return null}function Un(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let r=t.padStart(9,"0"),n=0;for(let s=0;s<9;s++){let o=parseInt(r[s]??"0",10)*(s%2+1);o>9&&(o-=9),n+=o}return n%10===0&&parseInt(r,10)>0}function so(e){let t=String(e??"").replace(/\D/g,"");if(t.length<12||t.length>19)return!1;let r=0,n=!1;for(let s=t.length-1;s>=0;s-=1){let o=parseInt(t[s]??"0",10);n&&(o*=2,o>9&&(o-=9)),r+=o,n=!n}return r%10===0}function Bn(e){let t=String(e??"").replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let r=t.slice(4)+t.slice(0,4),n=0;for(let s of r){let o=s>="A"&&s<="Z"?String(s.charCodeAt(0)-55):s;for(let i of o)n=(n*10+Number(i))%97}return n===1}var It="(?<!\\d)(?<!\\d[.,])",Tt="(?!\\d)(?![.,]\\d)",Ct=[{subkind:"israeli_id",severity:"high",pattern:new RegExp(`${It}(?:\\d{8}-\\d|\\d{9})${Tt}`,"g"),validate:Un,hint:"Israeli national ID (check digit verified) in plaintext. Encrypt the column or mask it at rest."},{subkind:"credit_card",severity:"critical",pattern:new RegExp(`${It}[2-6][ -]?(?:\\d[ -]?){11,17}\\d${Tt}`,"g"),validate:so,hint:"Payment card number (Luhn verified) in plaintext. This is PCI scope."},{subkind:"iban",severity:"high",pattern:/\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b/g,validate:Bn,hint:"Bank account in IBAN form (mod-97 verified) in plaintext."},{subkind:"israeli_phone",severity:"medium",pattern:new RegExp(`${It}(?:\\+972[- ]?|0)(?:[57]\\d|[2-489])[- ]?\\d{3}[- ]?\\d{4}${Tt}`,"g"),validate:e=>{let t=e.replace(/\D/g,"").replace(/^972/,"0");return/^0[57]\d{8}$/.test(t)?!0:/^0[2-489]\d{7}$/.test(t)&&(/[- ]/.test(e)||e.startsWith("+972"))},hint:"Israeli phone number in plaintext."}];function Me(e,t){let r=[],n="",s=!1;for(let o=0;o<e.length;o++){let i=e[o];s?i==='"'&&e[o+1]==='"'?(n+='"',o++):i==='"'?s=!1:n+=i:i==='"'?s=!0:i===t?(r.push(n),n=""):n+=i}return r.push(n),r}import{inflateRawSync as ei}from"node:zlib";import{inflateSync as zn}from"node:zlib";var je=new Set([".pdf"]),Wn=8*1024*1024;function Kn(e){let t=e.toString("latin1"),r=new Map,n=/(\d+)\s+(\d+)\s+obj\b/g,s;for(;(s=n.exec(t))!==null;){let o=Number(s[1]),i=n.lastIndex,a=t.indexOf("endobj",i);if(a<0)continue;let c=t.indexOf("stream",i),l,f=null;if(c>=0&&c<a){l=t.slice(i,c);let d=c+6;t[d]==="\r"&&(d+=1),t[d]===`
|
|
3
|
+
`&&(d+=1);let h=t.indexOf("endstream",d);h>d&&(f=e.subarray(d,h))}else l=t.slice(i,a);r.set(o,{num:o,dict:l,stream:f})}for(let o of[...r.values()]){if(!o.stream||!/\/Type\s*\/ObjStm\b/.test(o.dict))continue;let i=He(o),a=Number(/\/N\s+(\d+)/.exec(o.dict)?.[1]??0),c=Number(/\/First\s+(\d+)/.exec(o.dict)?.[1]??-1);if(i===null||!a||c<0)continue;let l=i.slice(0,c).trim().split(/\s+/).map(Number);for(let f=0;f<a;f+=1){let d=l[2*f],h=l[2*f+1];if(d===void 0||h===void 0||Number.isNaN(d)||Number.isNaN(h))break;let p=f+1<a?l[2*(f+1)+1]:void 0,g=i.slice(c+h,p!==void 0?c+p:void 0);r.has(d)||r.set(d,{num:d,dict:g,stream:null})}}return r}function Pt(e){let t=[...e.replace(/\s+/g,"")];if(t.length<40)return!1;let r=0,n=0;for(let s of t){let o=s.codePointAt(0)??0;o<32||o>=127&&o<=191||o===65533||o>=57344&&o<=63743?r+=1:/[\p{L}\p{N}]/u.test(s)&&(n+=1)}return r/t.length>.2||n/t.length<.25}function oo(e){let t=e.toString("latin1").replace(/\s/g,"");t.startsWith("<~")&&(t=t.slice(2));let r=t.indexOf("~>");r>=0&&(t=t.slice(0,r));let n=[],s=0,o=0;for(let i of t){if(i==="z"&&o===0){n.push(0,0,0,0);continue}let a=i.charCodeAt(0)-33;if(a<0||a>84)return null;s=s*85+a,o+=1,o===5&&(n.push(s>>>24&255,s>>>16&255,s>>>8&255,s&255),s=0,o=0)}if(o>0){for(let a=o;a<5;a+=1)s=s*85+84;let i=[s>>>24&255,s>>>16&255,s>>>8&255,s&255];for(let a=0;a<o-1;a+=1)n.push(i[a]??0)}return Buffer.from(n)}function io(e){let t=e.toString("latin1").replace(/\s/g,"").split(">")[0]??"",r=t.length%2?t+"0":t;return/^[0-9A-Fa-f]*$/.test(r)?Buffer.from(r,"hex"):null}function ao(e){let t=/\/Filter\s*(\[[^\]]*\]|\/\w+)/.exec(e);return!t||!t[1]?[]:[...t[1].matchAll(/\/(\w+)/g)].map(r=>r[1]??"")}function He(e,t){if(!e.stream)return null;let r=e.stream;for(let n of ao(e.dict)){let s=null;if(n==="FlateDecode")try{s=t!==void 0?zn(r,{maxOutputLength:Math.max(1,t)}):zn(r)}catch{return null}else if(n==="ASCII85Decode")s=oo(r);else if(n==="ASCIIHexDecode")s=io(r);else return null;if(s===null)return null;r=s}return r.toString("latin1")}function co(e){let t=new Map,r=1,n=/begincodespacerange([\s\S]*?)endcodespacerange/.exec(e);if(n&&n[1]){let c=/<([0-9A-Fa-f]+)>/.exec(n[1]);c&&c[1]&&c[1].length>=4&&(r=2)}let s=c=>{let l="";for(let f=0;f+3<c.length+1;f+=4){let d=parseInt(c.slice(f,f+4),16);Number.isFinite(d)&&d>0&&(l+=String.fromCharCode(d))}return l},o=/beginbfchar([\s\S]*?)endbfchar/g,i;for(;(i=o.exec(e))!==null;){let c=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,l;for(;(l=c.exec(i[1]??""))!==null;)t.set(parseInt(l[1]??"0",16),s(l[2]??""))}let a=/beginbfrange([\s\S]*?)endbfrange/g;for(;(i=a.exec(e))!==null;){let c=i[1]??"",l=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,f;for(;(f=l.exec(c))!==null;){let d=parseInt(f[1]??"0",16),h=parseInt(f[2]??"0",16),p=parseInt((f[3]??"0").slice(0,4)||"0",16);if(!(h-d>65535))for(let g=d;g<=h;g+=1)t.set(g,String.fromCharCode(p+(g-d)))}}return{map:t,bytes:r}}function lo(e){let t=new Map,r=[],n=[];for(let o of e.values()){for(let i of o.dict.matchAll(/\/Font\s*<<([\s\S]*?)>>/g))i[1]&&n.push(i[1]);for(let i of o.dict.matchAll(/\/Font\s+(\d+)\s+\d+\s+R/g)){let a=e.get(Number(i[1]));a&&n.push(a.dict)}}let s=new Set;for(let o of n){let i=/\/([^\s/<>[\]()]+)\s+(\d+)\s+\d+\s+R/g,a;for(;(a=i.exec(o))!==null;){let c=`${a[1]}#${a[2]}`;s.has(c)||(s.add(c),r.push([a[1]??"",Number(a[2])]))}}for(let[o,i]of r){let a=e.get(i);if(!a)continue;let c=null,l=/\/ToUnicode\s+(\d+)\s+\d+\s+R/.exec(a.dict);if(l){let d=e.get(Number(l[1])),h=d?He(d):null;h&&(c=co(h))}if(c||(c=po(a.dict,e)),!c)continue;let f=t.get(o)??[];f.push(c),t.set(o,f)}return t}var uo=["alef","bet","gimel","dalet","he","vav","zayin","het","tet","yod","finalkaf","kaf","lamed","finalmem","mem","finalnun","nun","samekh","ayin","finalpe","pe","finaltsadi","tsadi","qof","resh","shin","tav"];function fo(e){let t=/^uni([0-9A-Fa-f]{4})$/.exec(e)??/^u([0-9A-Fa-f]{4,6})$/.exec(e);if(t)return String.fromCodePoint(parseInt(t[1],16));let r=/^afii(\d{5})$/.exec(e);if(r){let o=Number(r[1]);if(o>=57664&&o<=57690)return String.fromCharCode(1488+(o-57664))}let n=uo.indexOf(e.replace(/hebrew$/,""));return n>=0?String.fromCharCode(1488+n):e==="space"?" ":/^[A-Za-z]$/.test(e)?e:{zero:"0",one:"1",two:"2",three:"3",four:"4",five:"5",six:"6",seven:"7",eight:"8",nine:"9",period:".",comma:",",hyphen:"-",colon:":",slash:"/",at:"@"}[e]??null}function po(e,t){let r=e,n=/\/Encoding\s+(\d+)\s+\d+\s+R/.exec(e);n&&(r=t.get(Number(n[1]))?.dict??"");let s=/\/Differences\s*\[([^\]]*)\]/.exec(r);if(!s?.[1])return null;let o=new Map,i=0;for(let a of s[1].match(/\d+|\/[^\s/[\]]+/g)??[]){if(/^\d+$/.test(a)){i=Number(a);continue}let c=fo(a.slice(1));c!==null&&o.set(i,c),i+=1}return o.size?{map:o,bytes:1}:null}function Zn(e){let t=[];for(let r=0;r<e.length;r+=1){let n=e[r];if(n!=="\\"){t.push(n.charCodeAt(0)&255);continue}let s=e[r+1];if(s===void 0)break;if(s>="0"&&s<="7"){let i="",a=r+1;for(;a<e.length&&i.length<3&&e[a]>="0"&&e[a]<="7";)i+=e[a],a+=1;t.push(parseInt(i,8)&255),r=a-1;continue}let o={n:10,r:13,t:9,b:8,f:12};t.push(o[s]??s.charCodeAt(0)&255),r+=1}return t}function Yn(e){if(e.length<2||e[0]!==254||e[1]!==255)return null;let t="";for(let r=2;r+1<e.length;r+=2)t+=String.fromCharCode((e[r]??0)<<8|(e[r+1]??0));return t}function Vn(e,t){let r=Yn(e);if(r!==null)return r;if(!t)return e.map(s=>String.fromCharCode(s)).join("");let n="";if(t.bytes===2)for(let s=0;s+1<e.length;s+=2){let o=(e[s]??0)<<8|(e[s+1]??0);n+=t.map.get(o)??""}else for(let s of e)n+=t.map.get(s)??String.fromCharCode(s);return n}function ho(e){let t=0;for(let r of e){let n=r.codePointAt(0)??0;/[\p{L}\p{N}]/u.test(r)?t+=1:(n<32||n>=127&&n<=191||n===65533)&&(t-=2)}return t}function Gn(e,t){if(!t||t.length<=1)return Vn(e,t?.[0]);let r="",n=-1/0;for(let s of t){let o=Vn(e,s),i=ho(o);i>n&&(r=o,n=i)}return r}function mo(e,t){let r="",n="",s,o=!1,i="",a=0,c=null,l=()=>{n.trim()&&(r+=n+`
|
|
4
|
+
`),n="",a=0},f=()=>{n&&!n.endsWith(" ")&&a>1&&(n+=" ")},d=/\/([^\s/<>[\]()]+)\s+-?[\d.]+\s+Tf|(-?[\d.]+)\s+(-?[\d.]+)\s+T[dD]\b|(?:-?[\d.]+\s+){5}(-?[\d.]+)\s+Tm\b|T\*|\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>|\[|\]|-?\d+(?:\.\d+)?|TJ|Tj|'|"/g,h;for(;(h=d.exec(e))!==null;){let p=h[0];if(h[1]!==void 0&&p.endsWith("Tf")){s=t.get(h[1]);continue}if(h[2]!==void 0){Math.abs(Number(h[3]))>.01?l():Number(h[2])!==0&&f();continue}if(h[4]!==void 0){let g=Number(h[4]);c!==null&&Math.abs(g-c)>.01?l():c!==null&&f(),c=g;continue}if(p==="T*"){l();continue}if(p==="["){o=!0;continue}if(p==="]"){o=!1;continue}if(p==="TJ"||p==="Tj"||p==="'"||p==='"'){(p==="'"||p==='"')&&l(),i&&(n+=i,a=i.trim().length,i="");continue}if(p.startsWith("("))i+=Gn(Zn(p.slice(1,-1)),s);else if(p.startsWith("<")){let g=p.slice(1,-1).replace(/\s+/g,""),u=[];for(let y=0;y+1<g.length;y+=2)u.push(parseInt(g.slice(y,y+2),16));i+=Gn(u,s)}else o&&Number(p)<-200&&i&&!i.endsWith(" ")&&(i+=" ")}return i&&(n+=i),l(),r}function go(e,t){let r=e.toString("latin1"),n=/\/Info\s+(\d+)\s+\d+\s+R/.exec(r),s=n?t.get(Number(n[1]))?.dict:void 0;if(!s)return"";let o=[],i=/\/(Author|Title|Subject|Keywords|Creator|Producer)\s*(\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>)/g,a;for(;(a=i.exec(s))!==null;){let c=a[2]??"";if(c.startsWith("(")){let l=Zn(c.slice(1,-1));o.push(Yn(l)??l.map(f=>String.fromCharCode(f)).join(""))}else{let l=c.slice(1,-1).replace(/\s+/g,""),f="";if(l.toUpperCase().startsWith("FEFF"))for(let d=4;d+3<l.length+1;d+=4)f+=String.fromCharCode(parseInt(l.slice(d,d+4),16));else for(let d=0;d+1<l.length;d+=2)f+=String.fromCharCode(parseInt(l.slice(d,d+2),16));o.push(f)}}return o.join(`
|
|
5
|
+
`)}var Xn="\u05DD\u05DF\u05E5\u05E3\u05DA";function Ue(e){let t=0,r=0;for(let n of e.match(/[\u05D0-\u05EA]{2,}/g)??[])Xn.includes(n[0])&&(t+=1),Xn.includes(n[n.length-1])&&(r+=1);return t>=3&&t>r*2}var yo={"(":")",")":"(","[":"]","]":"[","<":">",">":"<","{":"}","}":"{"};function Be(e){return/[\u05D0-\u05EA]/.test(e)?[...e].reverse().map(r=>yo[r]??r).join("").replace(/[A-Za-z0-9](?:[A-Za-z0-9@._\-/:+]*[A-Za-z0-9])?/g,r=>[...r].reverse().join("")):e}function Lt(e){if(!e.subarray(0,8).toString("latin1").startsWith("%PDF-")||e.toString("latin1",0,Math.min(e.length,4096)).includes("/Encrypt"))return null;let r=Kn(e);if(r.size===0)return null;let n=lo(r),s=[];s.push(go(e,r));let o=0,i=0,a=!1;for(let l of r.values()){if(!l.stream||!/\/Subtype\s*\/Form\b/.test(l.dict)&&/\/Subtype|\/Type\s*\/(XObject|Font|Metadata|ObjStm|XRef)|\/FontFile/.test(l.dict))continue;let d=He(l);if(d===null||!/(TJ|Tj)\b/.test(d))continue;let h=mo(d,n);if(h.trim().length!==0){if(i+=1,o+h.length>Wn){s.push(h.slice(0,Math.max(0,Wn-o))),a=!0;break}s.push(h),o+=h.length}}if(i===0)return null;let c=s.slice(1).join(`
|
|
6
|
+
`);return Pt(c)?null:(Ue(c)&&(c=c.split(`
|
|
7
|
+
`).map(Be).join(`
|
|
8
8
|
`)),{text:[s[0]??"",c].join(`
|
|
9
|
-
`),truncated:a,streams:
|
|
9
|
+
`),truncated:a,streams:i})}var sd=64*1024*1024;function Jn(e){if(!e.subarray(0,8).toString("latin1").startsWith("%PDF-"))return"not a valid PDF";if(e.toString("latin1",0,Math.min(e.length,4096)).includes("/Encrypt"))return"encrypted (password or copy protection)";let r=Kn(e),n=0,s=0,o=0;for(let i of r.values()){if(!i.stream)continue;if(/\/Subtype\s*\/Image\b/.test(i.dict)){s+=1;continue}let a=He(i);if(a===null){/\/Type\s*\/(Font|Metadata|XRef)|\/FontFile|\/Length1/.test(i.dict)||(o+=1);continue}/(TJ|Tj)\b/.test(a)&&(n+=1)}return n===0&&s>0?"no text layer \u2014 a scanned image (needs OCR, which NoData does not do)":n===0&&o>0?"its pages are compressed in a way NoData cannot open":n===0?"no text in it":"its fonts have no usable letter map \u2014 the text decodes to symbols"}import{execFileSync as bo}from"node:child_process";import{existsSync as _o,mkdtempSync as xo,readFileSync as Qn,readdirSync as Ve,rmSync as wo,statSync as ko,writeFileSync as er}from"node:fs";import{tmpdir as vo}from"node:os";import{delimiter as So,join as O}from"node:path";var ue="install the free tools once (they run only on this computer): winget install oschwartz10612.Poppler and winget install UB-Mannheim.TesseractOCR (tick Hebrew in its installer)",ze=null;function qn(e){try{return ko(e).isFile()}catch{return!1}}function Eo(){let e=[],t=[process.env.ProgramFiles,process.env["ProgramFiles(x86)"]].filter(Boolean),r=process.env.LOCALAPPDATA;for(let n of t)e.push(O(n,"Tesseract-OCR"));if(r){e.push(O(r,"Programs","Tesseract-OCR"),O(r,"Microsoft","WinGet","Links"));let n=O(r,"Microsoft","WinGet","Packages");try{for(let s of Ve(n))if(/^oschwartz10612\.Poppler/i.test(s))for(let o of Ve(O(n,s)))e.push(O(n,s,o,"Library","bin"))}catch{}}for(let n of t)try{for(let s of Ve(n))/^poppler/i.test(s)&&e.push(O(n,s,"Library","bin"),O(n,s,"bin"))}catch{}return e}function We(e,t){let r=process.env[t];if(r)return qn(r)?r:void 0;let n=process.platform==="win32",s=n?[`${e}.exe`,e]:[e],o=(process.env.PATH??"").split(So).filter(Boolean);n&&o.push(...Eo());for(let i of o)for(let a of s)if(qn(O(i,a)))return O(i,a)}function oe(e,t,r){try{return bo(e,t,{encoding:"utf8",timeout:r,maxBuffer:64*1024*1024,stdio:["ignore","pipe","ignore"],windowsHide:!0})}catch{return null}}function fe(){if(ze)return ze;if(/^(0|off|false|no)$/i.test(process.env.NODATA_PDF_TOOLS??""))return ze={ocrLangs:[],osd:!1};let e={pdftotext:We("pdftotext","NODATA_PDFTOTEXT"),pdftoppm:We("pdftoppm","NODATA_PDFTOPPM"),tesseract:We("tesseract","NODATA_TESSERACT"),ocrmypdf:We("ocrmypdf","NODATA_OCRMYPDF"),ocrLangs:[],osd:!1};if(e.tesseract){let t=new Set((oe(e.tesseract,["--list-langs"],15e3)??"").split(/\r?\n/).map(r=>r.trim()));e.ocrLangs=["heb","eng"].filter(r=>t.has(r)),e.osd=t.has("osd")}return ze=e}function Ot(e,t,r=".pdf"){let n=xo(O(vo(),"nd-read-"));try{let s=O(n,`in${r}`);return er(s,e,{mode:384}),t(n,s)}finally{wo(n,{recursive:!0,force:!0})}}function Dt(e){let t=e.replace(/[\u200E\u200F\u202A-\u202E\u2066-\u2069]/g,"").replace(/\f/g,`
|
|
10
10
|
`).replace(/[ \t]+\n/g,`
|
|
11
|
-
`).trim();return t.replace(/\s/g,"").length<2||
|
|
12
|
-
`).map(
|
|
13
|
-
`):t}function
|
|
11
|
+
`).trim();return t.replace(/\s/g,"").length<2||Pt(t)?null:Ue(t)?t.split(`
|
|
12
|
+
`).map(Be).join(`
|
|
13
|
+
`):t}function tr(e){let t=fe().pdftotext;if(!t)return null;let r=Ot(e,(n,s)=>oe(t,["-enc","UTF-8","-q",s,"-"],6e4));return r===null?null:Dt(r)}var Ao=()=>Math.max(1,Number(process.env.NODATA_OCR_MAX_PAGES)||10);function nr(e){let t=e.toString("latin1",0,64).match(/^P5\s+(\d+)\s+(\d+)\s+255\s/);return t?{w:Number(t[1]),h:Number(t[2]),at:t[0].length}:null}function $o(e,t){let r=nr(e);if(!r)return null;let{w:n,h:s,at:o}=r,i=e.subarray(o),[a,c]=t===180?[n,s]:[s,n],l=Buffer.alloc(a*c);for(let f=0;f<s;f++)for(let d=0;d<n;d++){let h=i[f*n+d];t===180?l[(s-1-f)*n+(n-1-d)]=h:t===90?l[d*a+(s-1-f)]=h:l[(n-1-d)*a+f]=h}return Buffer.concat([Buffer.from(`P5
|
|
14
14
|
${a} ${c}
|
|
15
15
|
255
|
|
16
|
-
`,"latin1"),l])}function
|
|
17
|
-
`))??
|
|
18
|
-
`).filter(f=>[...
|
|
19
|
-
`+
|
|
20
|
-
`),engine:"builtin",uncertain:l}}if(!e.subarray(0,8).toString("latin1").startsWith("%PDF-"))return null;if(n!==null)return{text:n,truncated:!1,streams:0,engine:"pdftotext",uncertain:!1};if(!t.ocr)return null;let s=
|
|
16
|
+
`,"latin1"),l])}function rr(e,t){if(!e.osd)return;let r=oe(e.tesseract,[t,"-","--psm","0"],6e4)??"",n=Number(r.match(/Rotate:\s*(\d+)/)?.[1]??0),s=Number(r.match(/Orientation confidence:\s*([\d.]+)/)?.[1]??0);if(!(n===90||n===180||n===270)||s<2)return;let o=$o(Qn(t),n);o&&er(t,o,{mode:384})}function Ro(e,t,r){if(!e.ocrmypdf||e.ocrLangs.length===0)return null;let n=O(t,"side.txt");return oe(e.ocrmypdf,["-q","-l",e.ocrLangs.join("+"),"--rotate-pages","--deskew","--force-ocr","--sidecar",n,r,O(t,"out.pdf")],3e5),_o(n)?Dt(Qn(n,"utf8")):null}function sr(e){let t=fe();if(!t.pdftoppm||!t.tesseract||t.ocrLangs.length===0)return null;let r=Ao();return Ot(e,(n,s)=>{if(oe(t.pdftoppm,["-r","300","-gray","-f","1","-l",String(r+1),s,O(n,"p")],12e4)===null)return null;let o=Ve(n).filter(l=>/^p-\d+\.pgm$/.test(l)).sort((l,f)=>Number(l.match(/\d+/)[0])-Number(f.match(/\d+/)[0])),i=o.length>r,a=[];for(let l of o.slice(0,r)){rr(t,O(n,l));let f=oe(t.tesseract,[O(n,l),"stdout","-l",t.ocrLangs.join("+"),"--psm","3"],12e4);f&&a.push(f)}let c=Dt(a.join(`
|
|
17
|
+
`))??Ro(t,n,s);return c===null?null:{text:c,truncated:i,pages:Math.min(o.length,r)}})}function Nt(e){return new Set(e.match(/[\p{L}\p{N}]{2,}/gu)??[])}function Ge(e,t={}){let r=Lt(e),n=tr(e);if(r){if(n===null)return{...r,engine:"builtin",uncertain:!1};let o=Nt(r.text),i=n.split(`
|
|
18
|
+
`).filter(f=>[...Nt(f)].some(d=>!o.has(d))),a=Nt(n),c=[...a].filter(f=>!o.has(f)),l=c.length>Math.max(3,a.size*.1)||c.some(f=>/^\d{5,}$/.test(f));return i.length===0?{...r,engine:"builtin",uncertain:!1}:{...r,text:r.text+`
|
|
19
|
+
`+i.join(`
|
|
20
|
+
`),engine:"builtin",uncertain:l}}if(!e.subarray(0,8).toString("latin1").startsWith("%PDF-"))return null;if(n!==null)return{text:n,truncated:!1,streams:0,engine:"pdftotext",uncertain:!1};if(!t.ocr)return null;let s=sr(e);return s?{text:s.text,truncated:s.truncated,streams:0,engine:"ocr",uncertain:!1}:null}function or(e){let t=Jn(e),r=fe();return/scanned image/.test(t)?r.tesseract&&r.pdftoppm&&r.ocrLangs.length?"no text layer \u2014 a scanned image; the folder scan reads it with OCR on this computer, the read gate does not wait for OCR":`no text layer \u2014 a scanned image. To read it: ${ue}`:/encrypted/.test(t)?t+(r.pdftotext?"":` \u2014 if it opens without a password, the second reader can read it: ${ue}`):/letter map|compressed/.test(t)&&!r.pdftotext?`${t}. A second reader may read it: ${ue}`:/letter map|compressed/.test(t)?`${t} (the second reader, pdftotext, could not read it either)`:t}var ir=[208,207,17,224,161,177,26,225],Ft=4294967294,Xe=4294967295,Io=64*1024*1024;function Ae(e){if(e.length<512)return!1;for(let t=0;t<ir.length;t+=1)if(e[t]!==ir[t])return!1;return!0}function Mt(e){if(!Ae(e))return null;try{let t=e.readUInt16LE(30),r=e.readUInt16LE(32);if(t!==9&&t!==12)return null;let n=1<<t,s=1<<r,o=e.readUInt32LE(44),i=e.readUInt32LE(48),a=e.readUInt32LE(56),c=e.readUInt32LE(60),l=e.readUInt32LE(68),f=e.readUInt32LE(72),d=Math.floor((e.length-n)/n)+1,h=x=>{let k=(x+1)*n;return x>=d||k>=e.length?null:e.subarray(k,Math.min(k+n,e.length))},p=[];for(let x=0;x<109&&p.length<o;x+=1){let k=e.readUInt32LE(76+x*4);k!==Xe&&p.push(k)}let g=l;for(let x=0;x<f&&g!==Ft&&g!==Xe;x+=1){let k=h(g);if(!k)return null;let I=n/4-1;for(let C=0;C<I&&p.length<o;C+=1){let A=k.readUInt32LE(C*4);A!==Xe&&p.push(A)}g=k.readUInt32LE(I*4)}let u=[];for(let x of p){let k=h(x);if(!k)return null;for(let I=0;I+4<=k.length;I+=4)u.push(k.readUInt32LE(I))}let y=(x,k,I)=>{let C=[],A=x;for(;A!==Ft&&A!==Xe;){if(A>=k.length||C.length>I)return null;C.push(A),A=k[A]}return C},m=(x,k)=>{let I=y(x,u,d);if(!I)return null;let C=[];for(let se of I){let ke=h(se);if(!ke)return null;C.push(ke)}let A=Buffer.concat(C);return k>=0?A.subarray(0,Math.min(k,A.length)):A},_=m(i,-1);if(!_)return null;let b=[],E=new Map;for(let x=0,k=0;x+128<=_.length;x+=128,k+=1){let I=_.readUInt16LE(x+64),C=_[x+66];if(C===0||I<2||I>64)continue;let A=_.subarray(x,x+I-2).toString("utf16le"),se={id:k,name:A,type:C,left:_.readUInt32LE(x+68),right:_.readUInt32LE(x+72),child:_.readUInt32LE(x+76),start:_.readUInt32LE(x+116),size:_.readUInt32LE(x+120),path:A};b.push(se),E.set(k,se)}let w=new Set,$=(x,k)=>{let I=[x];for(;I.length;){let C=I.pop(),A=E.get(C);!A||w.has(C)||(w.add(C),A.path=k?`${k}/${A.name}`:A.name,I.push(A.left,A.right),A.type===1&&$(A.child,A.path))}},M=b.find(x=>x.type===5);M&&$(M.child,"");let U=b.find(x=>x.type===5);if(!U)return null;let L=null,N=[];if(b.some(x=>x.type===2&&x.size<a&&x.size>0)){L=m(U.start,U.size);let x=c!==Ft?m(c,-1):null;if(x)for(let k=0;k+4<=x.length;k+=4)N.push(x.readUInt32LE(k));else N=[]}let F=new Map,z=new Map,B=(x,k)=>{F.has(x.name)||F.set(x.name,k),z.set(x.path,k)};for(let x of b)if(x.type===2&&!(x.size>Io)){if(x.size===0){B(x,Buffer.alloc(0));continue}if(x.size<a){if(!L)continue;let k=y(x.start,N,Math.ceil(L.length/s)+1);if(!k)continue;let I=k.map(C=>L.subarray(C*s,C*s+s));B(x,Buffer.concat(I).subarray(0,x.size))}else{let k=m(x.start,x.size);k&&B(x,k)}}return{streams:F,paths:z}}catch{return null}}import{TextDecoder as ar}from"node:util";var $e="password-protected: open it with its password, or check it by hand";function To(e){let t=e.streams;return t.has("EncryptionInfo")&&t.has("EncryptedPackage")?"encrypted-ooxml":t.has("WordDocument")?"doc":t.has("Workbook")||t.has("Book")?"xls":t.has("PowerPoint Document")?"ppt":[...t.keys()].some(r=>r.startsWith("__substg1.0_"))?"msg":null}var dr=e=>{try{return new ar(e)}catch{return new ar("latin1")}},pe=dr("windows-1252");function Re(e){return e.replace(/[\r\x07\x0b\x0c]/g,`
|
|
21
21
|
`).replace(/[\x13\x14\x15]/g," ").replace(/[\x00-\x08\x0e-\x1f]/g,"").replace(/\n{3,}/g,`
|
|
22
22
|
|
|
23
|
-
`)}function
|
|
24
|
-
`))}function
|
|
25
|
-
`))}function
|
|
26
|
-
`))}function
|
|
23
|
+
`)}function Co(e,t){return e.length>t?{text:e.slice(0,t),truncated:!0}:{text:e,truncated:!1}}function Po(e){let t=e.streams.get("WordDocument");if(t.length<512)return{kind:"doc",reason:"damaged Word file"};let r=t.readUInt16LE(10);if(r&256||r&32768)return{kind:"doc",reason:$e};if(t.readUInt16LE(2)<101){let g=t.readUInt32LE(24),u=t.readUInt32LE(28);return u<=g||u>t.length?{kind:"doc",reason:"damaged Word file"}:Re(pe.decode(t.subarray(g,u)))}let s=e.streams.get(r&512?"1Table":"0Table");if(!s)return{kind:"doc",reason:"damaged Word file (no table stream)"};let o=32;o+=2+t.readUInt16LE(o)*2,o+=2+t.readUInt16LE(o)*4;let i=o+2,a=t.readUInt32LE(i+264),c=t.readUInt32LE(i+264+4);if(!c||a+c>s.length)return{kind:"doc",reason:"damaged Word file (no piece table)"};let l=a,f=a+c,d=null;for(;l<f;){let g=s[l];if(g===1)l+=3+s.readInt16LE(l+1);else if(g===2){let u=s.readUInt32LE(l+1);d=s.subarray(l+5,Math.min(l+5+u,s.length));break}else break}if(!d||d.length<16)return{kind:"doc",reason:"damaged Word file (no piece table)"};let h=Math.floor((d.length-4)/12),p=[];for(let g=0;g<h;g+=1){let u=d.readUInt32LE(g*4),m=d.readUInt32LE((g+1)*4)-u;if(m<=0||m>t.length)continue;let _=d.readUInt32LE(4*(h+1)+g*8+2);if(_&1073741824){let b=(_&1073741823)/2;p.push(pe.decode(t.subarray(b,Math.min(b+m,t.length))))}else p.push(t.subarray(_,Math.min(_+m*2,t.length)).toString("utf16le"))}return Re(p.join(""))}var jt=class{segs;i=0;p=0;constructor(t){this.segs=t}here(){for(;this.i<this.segs.length&&this.p>=this.segs[this.i].length;)this.i+=1,this.p=0;return this.i<this.segs.length?this.segs[this.i]:null}get done(){return this.here()===null}atSeam(){return this.p===0&&this.i>0}u8(){let t=this.here();if(!t)throw new Error("eof");return t[this.p++]}u16(){return this.u8()|this.u8()<<8}u32(){return(this.u16()|this.u16()<<16)>>>0}skip(t){for(let r=0;r<t;r+=1)this.u8()}chars(t,r){let n="",s=t,o=r;for(;s>0&&this.here();){this.p===0&&n.length>0&&(o=(this.u8()&1)===1);let a=this.here();if(!a)break;let c=Math.floor((a.length-this.p)/(o?2:1)),l=Math.min(s,c);if(l<=0){this.p=a.length;continue}let f=a.subarray(this.p,this.p+l*(o?2:1));n+=o?f.toString("utf16le"):f.toString("latin1"),this.p+=f.length,s-=l}return n}};function Lo(e){let t=new jt(e),r=[];try{t.u32();let n=t.u32();for(let s=0;s<n&&!t.done;s+=1){let o=t.u16(),i=t.u8(),a=i&8?t.u16():0,c=i&4?t.u32():0;r.push(t.chars(o,(i&1)===1)),t.skip(a*4+c)}}catch{}return r}function cr(e,t,r,n){if(t+2>e.length)return"";let s=e.readUInt16LE(t);if(!r)return n.decode(e.subarray(t+2,t+2+s));let o=e[t+2],i=t+3;return o&8&&(i+=2),o&4&&(i+=4),o&1?e.subarray(i,i+s*2).toString("utf16le"):e.subarray(i,i+s).toString("latin1")}function Ie(e){let t;if(e&2)t=e>>2;else{let r=Buffer.alloc(8);r.writeUInt32LE(0,0),r.writeUInt32LE((e&4294967292)>>>0,4),t=r.readDoubleLE(0)}return e&1?t/100:t}var Ke=e=>Number.isFinite(e)?String(e):"";function No(e){let t=e.streams.get("Workbook")??e.streams.get("Book"),r=!0,n=pe,s=[],o=new Set,i=[],a=[],c=-1,l=null,f=0,d=(u,y,m)=>{if(c<0||!m)return;let _=a[c],b=_.get(u)??new Map;b.set(y,m),_.set(u,b)},h=0;for(;h+4<=t.length;){let u=t.readUInt16LE(h),y=t.readUInt16LE(h+2),m=t.subarray(h+4,Math.min(h+4+y,t.length)),_=h+4+y;switch(u){case 2057:f+=1,m.length>=4&&(r=m.readUInt16LE(0)===1536),f===1&&m.length>=4&&m.readUInt16LE(2)!==5&&(c=a.length,a.push(new Map));break;case 10:f=Math.max(0,f-1);break;case 47:return{kind:"xls",reason:$e};case 66:if(m.length>=2&&!r){let b=m.readUInt16LE(0);n=b===1200?pe:dr(`windows-${b}`)}break;case 133:if(m.length>6){let b=m[6];if(r){let E=m[7]&1;i.push(E?m.subarray(8,8+b*2).toString("utf16le"):m.subarray(8,8+b).toString("latin1"))}else i.push(n.decode(m.subarray(7,7+b)))}break;case 252:{let b=[m];for(;_+4<=t.length&&t.readUInt16LE(_)===60;){let E=t.readUInt16LE(_+2);b.push(t.subarray(_+4,Math.min(_+4+E,t.length))),_+=4+E}s=Lo(b);break}case 253:if(m.length>=10){let b=m.readUInt32LE(6);o.add(b),d(m.readUInt16LE(0),m.readUInt16LE(2),s[b]??"")}break;case 516:case 214:m.length>=8&&d(m.readUInt16LE(0),m.readUInt16LE(2),cr(m,6,r,n));break;case 515:m.length>=14&&d(m.readUInt16LE(0),m.readUInt16LE(2),Ke(m.readDoubleLE(6)));break;case 638:m.length>=10&&d(m.readUInt16LE(0),m.readUInt16LE(2),Ke(Ie(m.readUInt32LE(6))));break;case 189:{if(m.length>=6){let b=m.readUInt16LE(0),E=m.readUInt16LE(2);for(let w=4;w+6<=m.length-2;w+=6)d(b,E++,Ke(Ie(m.readUInt32LE(w+2))))}break}case 6:if(m.length>=14){let b=m.readUInt16LE(0),E=m.readUInt16LE(2);m.readUInt16LE(12)===65535?l=m[6]===0?[b,E]:null:d(b,E,Ke(m.readDoubleLE(6)))}break;case 519:l&&d(l[0],l[1],cr(m,0,r,n)),l=null;break}h=_}let p=[];a.forEach((u,y)=>{p.push(i[y]??"");for(let m of[...u.keys()].sort((_,b)=>_-b)){let _=u.get(m);p.push([..._.keys()].sort((b,E)=>b-E).map(b=>_.get(b)).join(" "))}p.push("")});let g=s.filter((u,y)=>!o.has(y));return g.length&&p.push(...g),Re(p.join(`
|
|
24
|
+
`))}function Oo(e){if(e.streams.has("EncryptedSummary"))return{kind:"ppt",reason:$e};let t=e.streams.get("PowerPoint Document"),r=[],n=0;for(;n+8<=t.length;){let s=t.readUInt16LE(n)&15,o=t.readUInt16LE(n+2),i=t.readUInt32LE(n+4);if(o===12052)return{kind:"ppt",reason:$e};if(s===15){n+=8;continue}let a=t.subarray(n+8,Math.min(n+8+i,t.length));o===4e3||o===4026?r.push(a.toString("utf16le")):o===4008&&r.push(pe.decode(a)),n+=8+i}return Re(r.join(`
|
|
25
|
+
`))}function Do(e){let t=[];for(let[r,n]of e.paths){if(r.startsWith("__attach_"))continue;let s=/(?:^|\/)__substg1\.0_([0-9A-F]{4})(001F|001E)$/i.exec(r);s&&t.push(s[2].toUpperCase()==="001F"?n.toString("utf16le"):pe.decode(n))}return Re(t.join(`
|
|
26
|
+
`))}function lr(e){let t=new Map;for(let[r,n]of e.paths){let s=/^(__attach_version1\.0_#[0-9A-F]{8})\/__substg1\.0_(3707|3704|3701)(001F|0102)$/i.exec(r);if(!s)continue;let o=t.get(s[1])??{};s[2]==="3701"&&s[3]==="0102"?o.data=n:s[2]==="3707"?o.name=n.toString("utf16le").replace(/\0+$/,""):s[2]==="3704"&&(o.short=n.toString("utf16le").replace(/\0+$/,"")),t.set(s[1],o)}return[...t.values()].filter(r=>r.data).map((r,n)=>({name:r.name||r.short||`attachment-${n+1}`,data:r.data}))}function Ht(e,t){let r=Mt(e);if(!r)return{kind:null,reason:"damaged Office 97-2003 file"};let n=To(r);if(!n)return{kind:null,reason:"a compound file that is not a Word, Excel, PowerPoint or Outlook file"};if(n==="encrypted-ooxml")return{kind:n,reason:$e};let s;try{s=n==="doc"?Po(r):n==="xls"?No(r):n==="ppt"?Oo(r):Do(r)}catch{s={kind:n,reason:"damaged Office 97-2003 file"}}if(typeof s!="string")return s;if(!s.trim()&&!(n==="msg"&&lr(r).length))return{kind:n,reason:"no text inside (an empty file, or only pictures)"};let o=Co(s,t),i=n==="msg"?lr(r):[];return{kind:n,text:o.text,truncated:o.truncated,parts:[`cfb:${n}`],...i.length?{attachments:i}:{}}}var Fo=0,Mo=2,jo=4,Ho=5,Uo=6,Bo=7,zo=8,Wo=9,Vo=10,Go=13,Xo=15,Ko=16,Zo=17,Yo=18,Jo=19,qo=156;function*Ut(e){let t=0,r=n=>{let s=0;for(let o=0;o<n;o++){if(t>=e.length)return null;let i=e[t++];if(s|=(i&127)<<7*o,!(i&128))return s>>>0}return s>>>0};for(;t<e.length;){let n=r(2),s=r(4);if(n===null||s===null||t+s>e.length)return;yield[n,e.subarray(t,t+s)],t+=s}}function Ze(e,t){if(t+4>e.length)return"";let r=e.readUInt32LE(t);return r===4294967295?"":e.subarray(t+4,Math.min(e.length,t+4+r*2)).toString("utf16le")}var Ye=e=>Number.isFinite(e)?String(e):"";function ur(e){let t=J(e);if(!t)return null;let r=new Map(t.map(f=>[f.name,f])),n=f=>{let d=r.get(f);return d?q(e,d):null},s=[],o=n("xl/sharedStrings.bin");if(o)for(let[f,d]of Ut(o))f===Jo&&s.push(Ze(d,1));let i=[],a=n("xl/workbook.bin");if(a)for(let[f,d]of Ut(a)){if(f!==qo||d.length<12)continue;let h=d.readUInt32LE(8),p=12+(h===4294967295?0:h*2);i.push(Ze(d,p))}let c=[...r.keys()].filter(f=>/^xl\/worksheets\/sheet\d+\.bin$/.test(f)).sort((f,d)=>Number(/(\d+)\.bin$/.exec(f)[1])-Number(/(\d+)\.bin$/.exec(d)[1])),l=[];return c.forEach((f,d)=>{let h=n(f);if(!h)return;let p=new Map,g=0,u=-1,y=E=>{if(!E)return;let w=p.get(g)??new Map;w.set(u,E),p.set(g,w)},m=(E,w)=>{E.length>=4&&(u=E.readUInt32LE(0),y(w))},_=E=>{u+=1,y(E)};for(let[E,w]of Ut(h))switch(E){case Fo:w.length>=4&&(g=w.readUInt32LE(0),u=-1);break;case Yo:_(w.length>=8?s[w.readUInt32LE(4)]??"":"");break;case Zo:_(Ze(w,4));break;case Ko:_(w.length>=12?Ye(w.readDoubleLE(4)):"");break;case Go:_(w.length>=8?Ye(Ie(w.readUInt32LE(4))):"");break;case Xo:_(w.length>=5?w[4]?"TRUE":"FALSE":"");break;case 12:case 14:u+=1;break;case Bo:w.length>=12&&m(w,s[w.readUInt32LE(8)]??"");break;case Uo:case zo:m(w,Ze(w,8));break;case Ho:case Wo:w.length>=16&&m(w,Ye(w.readDoubleLE(8)));break;case Mo:w.length>=12&&m(w,Ye(Ie(w.readUInt32LE(8))));break;case jo:case Vo:w.length>=9&&m(w,w[8]?"TRUE":"FALSE");break}let b=[...p.keys()].sort((E,w)=>E-w).map(E=>{let w=p.get(E),$=Math.max(...w.keys());return Array.from({length:Math.min($+1,1024)},(M,U)=>w.get(U)??"").join(" ")});b.length&&l.push([(i[d]||`Sheet${d+1}`).replace(/\s+/g," "),...b].join(`
|
|
27
27
|
`))}),l.length?l.join(`
|
|
28
28
|
|
|
29
|
-
`):null}import{TextDecoder as
|
|
30
|
-
`)):!
|
|
31
|
-
`){l+=1;continue}if(c>0){c-=1,l+=1;continue}
|
|
29
|
+
`):null}import{TextDecoder as fr}from"node:util";var Qo=new Set(["fonttbl","colortbl","stylesheet","listtable","listoverridetable","rsidtbl","generator","pict","object","objdata","themedata","colorschememapping","datastore","latentstyles","xmlnstbl","mmathpr","filetbl","revtbl","pgdsctbl","bkmkstart","bkmkend","fldinst","shppict","nonshppict","blipuid","panose","falt","wgrffmtfilter","defchp","defpap"]),pr=e=>{try{return new fr(e===65001?"utf-8":`windows-${e}`)}catch{return new fr("windows-1252")}};function Je(e){return e.length>=5&&e.subarray(0,5).toString("latin1")==="{\\rtf"}function Bt(e){let t=pr(1252),r=[],n=[],s=()=>{n.length&&(r.push(t.decode(Uint8Array.from(n))),n=[])},o=[],i=!1,a=1,c=0,l=0,f=e.length;for(;l<f;){let d=e[l];if(d==="{"){s(),o.push({skip:i,uc:a}),l+=1,e.startsWith("\\*",l)&&(i=!0);continue}if(d==="}"){s();let h=o.pop();h&&(i=h.skip,a=h.uc),l+=1;continue}if(d==="\\"){let h=e[l+1];if(h==="'"){let y=parseInt(e.substr(l+2,2),16);if(l+=4,c>0){c-=1;continue}!i&&Number.isFinite(y)&&n.push(y);continue}if(h==="\\"||h==="{"||h==="}"){i||(s(),r.push(h)),l+=2;continue}if(h==="~"){i||r.push(" "),l+=2;continue}let p=/^([a-zA-Z]+)(-?\d+)? ?/.exec(e.slice(l+1,l+40));if(!p){l+=2;continue}l+=1+p[0].length;let g=p[1].toLowerCase(),u=p[2]!==void 0?Number(p[2]):null;if(Qo.has(g)){i=!0;continue}g==="ansicpg"&&u?t=pr(u):g==="uc"&&u!==null?a=u:g==="u"&&u!==null?(s(),i||r.push(String.fromCharCode(u<0?u+65536:u)),c=a):!i&&(g==="par"||g==="line"||g==="row"||g==="sect"||g==="page")?(s(),r.push(`
|
|
30
|
+
`)):!i&&(g==="tab"||g==="cell")&&(s(),r.push(" "));continue}if(d==="\r"||d===`
|
|
31
|
+
`){l+=1;continue}if(c>0){c-=1,l+=1;continue}i||(s(),r.push(d)),l+=1}return s(),r.join("").replace(/\n{3,}/g,`
|
|
32
32
|
|
|
33
|
-
`)}var
|
|
33
|
+
`)}var zt=new Set([".xlsx",".xlsm",".xltx",".xltm",".docx",".docm",".dotx",".dotm",".pptx",".pptm",".ppsx",".ppsm",".potx"]),qe=new Set([".odt",".ods",".odp",".ott",".ots",".otp"]),Wt=new Set([".doc",".dot",".xls",".xlt",".ppt",".pps",".pot",".msg"]),hr=new Set([".rtf"]);function ti(e){return/^\.(xls[xm]|xlt[xm])$/.test(e)?".xlsx":/^\.(doc[xm]|dot[xm])$/.test(e)?".docx":/^\.(ppt[xm]|pps[xm]|potx)$/.test(e)?".pptx":e}var Q=8*1024*1024,ni=101010256,ri=33639248,si=67324752;function J(e){let t=Math.min(e.length,67584),r=-1;for(let i=e.length-22;i>=e.length-t&&i>=0;i-=1)if(e.readUInt32LE(i)===ni){r=i;break}if(r<0)return null;let n=e.readUInt16LE(r+10),s=e.readUInt32LE(r+16);if(s>=e.length)return null;let o=[];for(let i=0;i<n&&!(s+46>e.length||e.readUInt32LE(s)!==ri);i+=1){let a=e.readUInt16LE(s+8),c=e.readUInt16LE(s+10),l=e.readUInt32LE(s+20),f=e.readUInt32LE(s+24),d=e.readUInt16LE(s+28),h=e.readUInt16LE(s+30),p=e.readUInt16LE(s+32),g=e.readUInt32LE(s+42),u=e.subarray(s+46,s+46+d).toString("utf8");o.push({name:u,flags:a,method:c,compSize:l,uncompSize:f,localHeaderOffset:g}),s+=46+d+h+p}return o}function q(e,t,r=256*1024*1024){let n=t.localHeaderOffset;if(n+30>e.length||e.readUInt32LE(n)!==si)return null;let s=e.readUInt16LE(n+26),o=e.readUInt16LE(n+28),i=n+30+s+o,a=i+t.compSize;if(a>e.length)return null;let c=e.subarray(i,a);try{if(t.method===0)return c.length<=r?Buffer.from(c):null;if(t.method===8)return ei(c,{maxOutputLength:r})}catch{return null}return null}function oi(e,t){return q(e,t)?.toString("utf8")??null}var ii={"&":"&","<":"<",">":">",""":'"',"'":"'"};function X(e){return e.replace(/&(amp|lt|gt|quot|apos);/g,t=>ii[t]??t).replace(/&#(\d+);/g,(t,r)=>{let n=Number(r);return n>0&&n<1114112?String.fromCodePoint(n):""}).replace(/&#x([0-9a-fA-F]+);/g,(t,r)=>{let n=parseInt(r,16);return n>0&&n<1114112?String.fromCodePoint(n):""})}function ai(e){return X(e.replace(/<[^>]*>/g,`
|
|
34
34
|
`)).replace(/\n{2,}/g,`
|
|
35
|
-
`)}var
|
|
35
|
+
`)}var ci=new Set([".ods",".ots"]),li=64;function di(e){return X(e.replace(/<text:(?:tab|line-break)\b[^>]*\/>/g," ").replace(/<\/text:p>/g," ").replace(/<[^>]*>/g,"")).replace(/\s+/g," ").trim()}function ui(e){let t=[],r=/<table:table\b([^>]*)>([\s\S]*?)<\/table:table>/g;for(let n of e.matchAll(r)){let s=X(/table:name="([^"]*)"/.exec(n[1]??"")?.[1]??"")||"Sheet",o=[],i=/<table:table-row\b[^>]*?(?:\/>|>([\s\S]*?)<\/table:table-row>)/g;for(let a of(n[2]??"").matchAll(i)){let c=[],l=/<table:(?:covered-)?table-cell\b([^>]*?)(?:\/>|>([\s\S]*?)<\/table:(?:covered-)?table-cell>)/g;for(let f of(a[1]??"").matchAll(l)){let d=di(f[2]??""),h=Number(/table:number-columns-repeated="(\d+)"/.exec(f[1]??"")?.[1]??"1")||1;for(let p=0;p<(d?Math.min(h,1024):Math.min(h,li));p++)c.push(d)}for(;c.length&&!c[c.length-1];)c.pop();c.length&&o.push(c.join(" "))}o.length&&t.push([s.replace(/\s+/g," "),...o].join(`
|
|
36
36
|
`))}return t.length?t.join(`
|
|
37
37
|
|
|
38
|
-
`):null}function
|
|
38
|
+
`):null}function fi(e,t,r){let n=new RegExp(`<${t}\\b[^>]*\\b${r}="([^"]*)"`,"g"),s=[],o;for(;(o=n.exec(e))!==null;)o[1]&&s.push(X(o[1]));return s}function pi(e,t){let r=[];if(qe.has(e)){for(let n of t)(n==="content.xml"||n==="styles.xml"||n==="meta.xml")&&r.push(n);return r}e=ti(e);for(let n of t)(n==="docProps/core.xml"||n==="docProps/app.xml")&&r.push(n);if(e===".xlsx"||e===".xlsm")for(let n of t)(n==="xl/sharedStrings.xml"||n==="xl/workbook.xml"||/^xl\/worksheets\/sheet\d+\.xml$/.test(n)||/^xl\/comments\d*\.xml$/.test(n))&&r.push(n);else if(e===".docx")for(let n of t)(n==="word/document.xml"||/^word\/(header|footer|footnotes|endnotes|comments)\d*\.xml$/.test(n))&&r.push(n);else if(e===".pptx")for(let n of t)/^ppt\/(slides|notesSlides)\/(slide|notesSlide)\d+\.xml$/.test(n)&&r.push(n);return r}function hi(e,t){let r=J(e);if(!r||r.length===0)return null;let n=new Map(r.map(l=>[l.name,l])),s=pi(t,r.map(l=>l.name));if(s.length===0)return null;let o=[],i=[],a=0,c=!1;for(let l of s){if(a>=Q){c=!0;break}let f=n.get(l);if(!f)continue;let d=oi(e,f);if(d===null)continue;let h=ci.has(t)&&l==="content.xml"&&ui(d)||ai(d);if(l==="xl/workbook.xml"){let p=fi(d,"sheet","name");p.length&&(h+=`
|
|
39
39
|
`+p.join(`
|
|
40
|
-
`))}a+h.length>
|
|
41
|
-
`),truncated:c,parts:
|
|
42
|
-
`)?`"${e.replace(/"/g,'""')}"`:e}function
|
|
43
|
-
`),counts:o,columnsHidden:s.filter((p,g)=>i[g])}}var ao=/^xl\/(pivotCache|charts|externalLinks)\//,yr=10;function mr(e,t,r=1){e[t]=(e[t]??0)+r}function br(e){return e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""")}function _r(e){let t=e.replace(/<rPh\b[\s\S]*?<\/rPh>/g,""),r="";for(let n of t.matchAll(/<t(?:\s[^>]*)?>([\s\S]*?)<\/t>/g))r+=n[1];return G(r)}function co(e){return e?[...e.matchAll(/<si\b[^>]*>([\s\S]*?)<\/si>|<si\b[^>]*\/>/g)].map(t=>_r(t[1]??"")):[]}var xr=/<c\b([^>]*?)(?:\/>|>([\s\S]*?)<\/c>)/g;function Qe(e,t){let r=new RegExp(`\\b${t}="([^"]*)"`).exec(e);return r?r[1]:null}function me(e,t){if(e.type==="s"){let n=/<v>([^<]*)<\/v>/.exec(e.inner);return n?t[Number(n[1])]??null:null}if(e.type==="inlineStr"){let n=/<is>([\s\S]*?)<\/is>/.exec(e.inner);return n?_r(n[1]):null}if(e.type==="b"||e.type==="e")return null;let r=/<v>([^<]*)<\/v>/.exec(e.inner);return r?G(r[1]):null}function lo(e){let t=[];for(let r of e.matchAll(xr)){let n=Qe(r[1],"r"),s=n?/^([A-Z]+)(\d+)$/.exec(n):null;if(!s)return null;t.push({full:r[0],attrs:r[1],inner:r[2]??"",col:s[1],row:Number(s[2]),type:Qe(r[1],"t")??"n"})}return t}function uo(e,t){let r=[...new Set(e.map(n=>n.row))].sort((n,s)=>n-s).slice(0,yr);for(let n of r){let s=new Map;for(let i of e.filter(o=>o.row===n)){let o=me(i,t),a=o?Ee(o):null;a&&s.set(i.col,{type:a.type,header:o.trim()})}if(s.size>0)return{row:n,cols:s}}return{row:-1,cols:new Map}}var fo=/^xl\/worksheets\/sheet\d+\.xml$/,po=200;function ho(e){let t=e.trim();return/^[\d.,\-+/:%$₪€\s]+$/.test(t)||t.length>60}function mo(e,t){let r=[...new Set(e.map(i=>i.row))].sort((i,o)=>i-o).slice(0,yr),n=-1,s=-1/0;for(let i of r){let o=e.filter(l=>l.row===i).map(l=>(me(l,t)??"").trim()).filter(Boolean);if(o.length<2)continue;let a=o.filter(l=>!ho(l)).length,c=a*2-(o.length-a);c>s&&(s=c,n=i)}return n}function go(e,t,r){let n=uo(t,r),s=ve();if(!s)return n;let i=n.row>=0?n.row:mo(t,r);if(i<0)return n;let o=t.filter(d=>d.row===i).map(d=>({col:d.col,text:(me(d,r)??"").trim()})).filter(d=>d.text),a=new Map(o.map((d,h)=>[d.col,h])),c=new Map;for(let d of t){if(d.row<=i)continue;let h=a.get(d.col);if(h!==void 0){if(!c.has(d.row)){if(c.size>=po)continue;c.set(d.row,o.map(()=>""))}c.get(d.row)[h]=me(d,r)??""}}let l=new Map(i===n.row?n.cols:[]),f=o.map(d=>d.text);for(let d of s({name:e,headers:f,rows:[...c.values()]})){let h=f.indexOf(d.column);h<0||l.set(o[h].col,{type:d.type,header:d.column,category:d.category,severity:d.severity,how:d.how})}return{row:i,cols:l}}function Xt(e,t){return`<c${e.replace(/\s*\bt="[^"]*"/,"")} t="inlineStr"><is><t xml:space="preserve">${br(t)}</t></is></c>`}var yo=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t+=1){let r=t;for(let n=0;n<8;n+=1)r=r&1?3988292384^r>>>1:r>>>1;e[t]=r>>>0}return e})();function bo(e){let t=4294967295;for(let r=0;r<e.length;r+=1)t=yo[(t^e[r])&255]^t>>>8;return(t^4294967295)>>>0}var gr=33;function Kt(e){let t=[],r=[],n=0;for(let o of e){let a=Buffer.from(o.name,"utf8"),c=o.name.endsWith("/"),l=c?Buffer.alloc(0):oo(o.data),f=c?0:8,d=c?0:bo(o.data),h=Buffer.alloc(30);h.writeUInt32LE(67324752,0),h.writeUInt16LE(20,4),h.writeUInt16LE(2048,6),h.writeUInt16LE(f,8),h.writeUInt16LE(gr,12),h.writeUInt32LE(d,14),h.writeUInt32LE(l.length,18),h.writeUInt32LE(o.data.length,22),h.writeUInt16LE(a.length,26),t.push(h,a,l);let p=Buffer.alloc(46);p.writeUInt32LE(33639248,0),p.writeUInt16LE(20,4),p.writeUInt16LE(20,6),p.writeUInt16LE(2048,8),p.writeUInt16LE(f,10),p.writeUInt16LE(gr,14),p.writeUInt32LE(d,16),p.writeUInt32LE(l.length,20),p.writeUInt32LE(o.data.length,24),p.writeUInt16LE(a.length,28),p.writeUInt32LE(n,42),r.push(p,a),n+=h.length+a.length+l.length}let s=Buffer.concat(r),i=Buffer.alloc(22);return i.writeUInt32LE(101010256,0),i.writeUInt16LE(e.length,8),i.writeUInt16LE(e.length,10),i.writeUInt32LE(s.length,12),i.writeUInt32LE(n,16),Buffer.concat([...t,s,i])}function Zt(e,t){let r=Y(e);if(!r||r.length===0||r.some(m=>ao.test(m.name)))return null;let n=new Map;for(let m of r){if(m.name.endsWith("/")){n.set(m.name,Buffer.alloc(0));continue}let x=J(e,m);if(!x)return null;n.set(m.name,x)}let s=[...n.keys()].filter(m=>fo.test(m));if(s.length===0)return null;let i=n.get("xl/sharedStrings.xml")?.toString("utf8")??null,o=co(i),a=new Set,c={},l=new Set,f=Wt(),d=Et();for(let m of s){let x=n.get(m).toString("utf8"),_=lo(x);if(!_)return null;let E=go(m.replace(/^xl\/worksheets\//,"").replace(/\.xml$/,""),_,o),b=E.row,F=new Map;for(let N of _){if(N.type!=="n"||N.row<=b)continue;let L=me(N,o);L!==null&&F.set(N.col,[...F.get(N.col)??[],L])}let H=Gt(F),P=new Map;for(let[N,{type:L,header:j,how:U}]of E.cols)U==="header"&&H.has(N)||(P.set(N,L),l.add(j));let X=x.replace(xr,(N,L,j)=>{let U=Qe(L,"r"),[,Z,w]=/^([A-Z]+)(\d+)$/.exec(U),k={full:N,attrs:L,inner:j??"",col:Z,row:Number(w),type:Qe(L,"t")??"n"},$=me(k,o),I=()=>{if(k.type==="s"){let Ln=/<v>([^<]*)<\/v>/.exec(k.inner);Ln&&a.add(Number(Ln[1]))}return N};if($===null||$.trim()==="")return I();if(d&&k.type==="n"&&H.has(Z)&&k.row>b)return mr(c,"amount"),Xt(L,"[AMOUNT]");let A=P.get(Z);if(A&&k.row>b&&!qe($))return mr(c,`column:${A}`),Xt(L,f(A,$));if(k.type==="n"&&H.has(Z))return I();let re=B($,c),ke=t?.size?he(re.text,t,c):re.text;return ke===$?I():Xt(L,ke)});n.set(m,Buffer.from(X,"utf8"))}if(i){let m=-1,x=i.replace(/<si\b[^>]*>[\s\S]*?<\/si>|<si\b[^>]*\/>/g,_=>(m+=1,a.has(m)?_:"<si><t>[HIDDEN]</t></si>"));n.set("xl/sharedStrings.xml",Buffer.from(x,"utf8"))}for(let m of[...n.keys()].filter(x=>/^xl\/comments\d*\.xml$/.test(x))){let _=n.get(m).toString("utf8").replace(/(<t(?:\s[^>]*)?>)([\s\S]*?)(<\/t>)/g,(E,b,F,H)=>{let P=B(G(F),c);return`${b}${br(t?.size?he(P.text,t,c):P.text)}${H}`});n.set(m,Buffer.from(_,"utf8"))}let h=n.get("docProps/core.xml");if(h){let m=h.toString("utf8").replace(/(<dc:creator>)[\s\S]*?(<\/dc:creator>)/,"$1$2").replace(/(<cp:lastModifiedBy>)[\s\S]*?(<\/cp:lastModifiedBy>)/,"$1$2");n.set("docProps/core.xml",Buffer.from(m,"utf8"))}let p=n.get("xl/workbook.xml");if(p){let m=p.toString("utf8").replace(/<(\w+:)?absPath\b[^>]*\/>|<(\w+:)?absPath\b[^>]*>[\s\S]*?<\/(\w+:)?absPath>/g,"");n.set("xl/workbook.xml",Buffer.from(m,"utf8"))}let g=n.get("docProps/app.xml");if(g){let m=g.toString("utf8").replace(/(<Company>)[\s\S]*?(<\/Company>)/,"$1$2").replace(/(<Manager>)[\s\S]*?(<\/Manager>)/,"$1$2");n.set("docProps/app.xml",Buffer.from(m,"utf8"))}let u=n.has("xl/calcChain.xml"),y=r.map(m=>m.name).filter(m=>!(u&&m==="xl/calcChain.xml"));if(u)for(let m of["[Content_Types].xml","xl/_rels/workbook.xml.rels"]){let x=n.get(m);x&&n.set(m,Buffer.from(x.toString("utf8").replace(/<(Override|Relationship)\b[^>]*calcChain[^>]*\/>/g,""),"utf8"))}return{bytes:Kt(y.map(m=>({name:m,data:n.get(m)}))),counts:c,columnsHidden:[...l]}}var ge=/(^|\/)(\.env(\.[\w.-]+)?|[\w.-]+\.env(\.[\w.-]+)?)$/i,_o=/(SECRET|PASSWORD|PASSWD|PASS|PWD|TOKEN|PRIVATE|CREDENTIAL|API_?KEY|_KEY|KEY_ID|DSN|DATABASE_URL|_URI|POOLER_URL|SALT|PEPPER)$/i,xo=/(^NEXT_PUBLIC_|^VITE_|^EXPO_PUBLIC_|ANON_KEY$|PUBLISHABLE_KEY$|PUBLIC_KEY$)/i;function Yt(e){let t=0;for(let r of e.split(/\r?\n/)){let n=/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(r);if(!n||!_o.test(n[1])||xo.test(n[1]))continue;let s=n[2].trim().replace(/^(['"])(.*)\1$/,"$2");s.length>=8&&!/^\$\{?[A-Z_]+\}?$/.test(s)&&t++}return t}var ru=64*1024*1024,su=4*1024*1024;var iu=512*1024*1024,ou=1024*1024*1024;var au=256*1024*1024;var cu=new kr("utf-8",{fatal:!0}),lu=new kr("windows-1255");var du=new Set([".cache",".cargo",".rustup",".npm",".pnpm-store",".yarn",".gradle",".m2",".nuget",".conda",".pyenv",".rbenv",".nvm",".volta",".bun",".deno",".docker",".android",".vscode-server",".agents",".agent",".codeium",".continue","antigravity",".antigravity","__pycache__",".venv","venv","site-packages",".next",".turbo",".expo",".nx",".parcel-cache",".svelte-kit","appdata",".trash","$recycle.bin"].map(e=>e.toLowerCase()));var ku=Buffer.from("iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkYAAAAAYAAjCB0C8AAAAASUVORK5CYII=","base64");var Po=["Put the new key where the app reads it (for a developer machine: the NoData vault + nodata_run, not a .env file).","Check that the app still works with the new key.","Only then delete / revoke the OLD key \u2014 until you do, whoever copied it can still use it."],R=(e,t,r)=>({provider:e,url:t,steps:[...r,...Po]}),Lo={"aws-access-key":R("AWS","https://console.aws.amazon.com/iam/home#/security_credentials",["Open IAM \u2192 your user \u2192 Security credentials.","Create a NEW access key (you see its secret once \u2014 keep it only in the vault)."]),"aws-secret-key":R("AWS","https://console.aws.amazon.com/iam/home#/security_credentials",["Open IAM \u2192 your user \u2192 Security credentials.","Create a NEW access key (you see its secret once \u2014 keep it only in the vault).","Mark the old key Inactive before deleting it."]),"gcp-api-key":R("Google Cloud","https://console.cloud.google.com/apis/credentials",["Open APIs & Services \u2192 Credentials.","Pick the key \u2192 Regenerate key (or create a new one and restrict it to the APIs you use)."]),"gcp-service-account":R("Google Cloud (service account)","https://console.cloud.google.com/iam-admin/serviceaccounts",["Open IAM & Admin \u2192 Service accounts \u2192 the account \u2192 Keys.","Add key \u2192 Create new key (JSON). Keep the file out of Git and out of shared folders."]),"firebase-key":R("Firebase / Google Cloud","https://console.cloud.google.com/apis/credentials",["A Firebase web key is meant to be public \u2014 restrict it instead: Credentials \u2192 the key \u2192 Application restrictions (your domains only).","If it is not a web key, regenerate it."]),"github-token":R("GitHub","https://github.com/settings/tokens",["Open Settings \u2192 Developer settings \u2192 Personal access tokens.","Generate a new token with only the scopes you need."]),"github-fine-grained":R("GitHub","https://github.com/settings/tokens?type=beta",["Open Fine-grained tokens.","Regenerate the token (or create a new one for only the repositories you need)."]),"gitlab-token":R("GitLab","https://gitlab.com/-/user_settings/personal_access_tokens",["Open Access tokens.","Create a new token with only the scopes you need."]),"stripe-secret":R("Stripe","https://dashboard.stripe.com/apikeys",["Open Developers \u2192 API keys.","Roll the secret key (Stripe can keep the old one alive for a short overlap)."]),"stripe-restricted":R("Stripe","https://dashboard.stripe.com/apikeys",["Open Developers \u2192 API keys \u2192 Restricted keys.","Roll the key, or create a new restricted key."]),"slack-token":R("Slack","https://api.slack.com/apps",["Open your app \u2192 OAuth & Permissions.","Rotate / reinstall to get a new token."]),"slack-webhook":R("Slack","https://api.slack.com/apps",["Open your app \u2192 Incoming Webhooks.","Add a new webhook URL for the channel."]),"twilio-api-key":R("Twilio","https://console.twilio.com/us1/account/keys-credentials/api-keys",["Open Account \u2192 API keys & tokens.","Create a new API key."]),"sendgrid-api-key":R("SendGrid","https://app.sendgrid.com/settings/api_keys",["Open Settings \u2192 API Keys.","Create a new key with only the permissions you need."]),"openai-key":R("OpenAI","https://platform.openai.com/api-keys",["Open API keys.","Create a new secret key."]),"openai-project-key":R("OpenAI","https://platform.openai.com/api-keys",["Open API keys (per project).","Create a new secret key for the same project."]),"anthropic-key":R("Anthropic","https://console.anthropic.com/settings/keys",["Open Settings \u2192 API keys.","Create a new key."]),"supabase-key":R("Supabase","https://supabase.com/dashboard/project/_/settings/api-keys",["Open the project \u2192 Project Settings \u2192 API Keys.","Create a new SECRET key (a service_role / secret key bypasses every database rule \u2014 treat it like a root password).","Older projects with JWT keys: rotating the JWT secret replaces every key and signs everyone out \u2014 plan it."]),"supabase-access-token":R("Supabase (personal access token \u2014 reaches every project of the account)","https://supabase.com/dashboard/account/tokens",["Open Account \u2192 Access Tokens.","Revoke this token, then generate a new one only where it is needed (CLI, MCP) \u2014 prefer a read-only MCP."]),"supabase-secret-key":R("Supabase","https://supabase.com/dashboard/project/_/settings/api-keys",["Open the project \u2192 Project Settings \u2192 API Keys.","Create a new secret key, switch your servers to it, then delete this one."]),"postgres-uri":R("PostgreSQL (the password in the connection string)","https://supabase.com/dashboard/project/_/settings/database",["Change the database user's password: in Supabase \u2192 Project Settings \u2192 Database \u2192 Reset password; elsewhere, your host's console or ALTER USER \u2026 WITH PASSWORD.","Update the connection string with the new password."]),"mongodb-uri":R("MongoDB","https://cloud.mongodb.com/",["Open Atlas \u2192 Database Access \u2192 the user \u2192 Edit \u2192 Edit password.","Update the connection string."]),"redis-uri":R("Redis","",["Reset the password in your Redis host's console (or CONFIG SET requirepass on your own server).","Update the connection string."]),"private-key":R("Private key (SSH / TLS / signing)","",["Generate a new key pair.","Register the new PUBLIC key where the old one was trusted (server authorized_keys, certificate, service settings)."]),"jwt-secret":R("Your app's JWT secret","",["Set a new long random secret in the app's configuration.","Every signed-in user will be signed out \u2014 plan the moment."]),"password-in-code":R("A password in code","",["Change the password in the system it belongs to."]),"bearer-token":R("An access token","",["Revoke the token in the service that issued it and issue a new one."])},No=R("A credential","",["Find the service it belongs to and issue a new credential there."]);function Jt(e){return Lo[e]??No}var Ou=768*1024*1024;var Do=8*1024*1024;function Ar(e){return/\.ndc$/i.test(e)||/\.clean\.[A-Za-z0-9]+$/.test(e)||Fo(e)}function Fo(e){return/(^|[\\/])\.nodata[\\/]/.test(e)}import{existsSync as Mo,mkdirSync as Gf,readFileSync as jo,statSync as qt,writeFileSync as Vf}from"node:fs";import{homedir as Ho}from"node:os";import{join as Uo}from"node:path";var Bo=()=>Uo(Ho(),".nodata","flagged.json");var $r="unread";function Rr(e){let t=e.replace(/\\/g,"/");return process.platform==="win32"?t.toLowerCase():t}var Ie=null;function Tr(){let e=Bo();try{if(!Mo(e))return{};let t=qt(e).mtimeMs;if(Ie&&Ie.path===e&&Ie.mtimeMs===t)return Ie.store;let r=JSON.parse(jo(e,"utf8"));return Ie={path:e,mtimeMs:t,store:r},r}catch{return{}}}function et(e){let t=Tr()[Rr(e)];if(!t)return null;try{if(qt(e).mtimeMs>t.mtimeMs+1e3)return null}catch{return null}let r=Object.fromEntries(Object.entries(t.kinds).filter(([n])=>n!==$r));return Object.keys(r).length?r:null}function tt(e){let t=Tr()[Rr(e)];if(!t||!t.kinds[$r])return null;try{return{changed:qt(e).mtimeMs>t.mtimeMs+1e3}}catch{return null}}import{existsSync as Ir,mkdirSync as Jf,readFileSync as Cr,writeFileSync as qf}from"node:fs";import{homedir as zo}from"node:os";import{join as Wo}from"node:path";var nt=()=>Wo(zo(),".nodata","prefs.json");function Go(){try{let e=Ir(nt())?JSON.parse(Cr(nt(),"utf8")).lang:null;return e==="he"||e==="en"?e:null}catch{return null}}function Vo(){let t=process.env.LC_ALL||process.env.LC_MESSAGES||process.env.LANG||"";try{t||=Intl.DateTimeFormat().resolvedOptions().locale}catch{}return/^(he|iw)(?:[-_.@]|$)/i.test(t)?"he":"en"}function Q(){return Go()??Vo()}function Pr(){try{return Ir(nt())&&JSON.parse(Cr(nt(),"utf8")).amounts_sensitive===!0}catch{return!1}}function T(e,t,r=Q()){return r==="he"?e:t}import{createHmac as aa,randomBytes as ca}from"node:crypto";import{existsSync as nn,mkdirSync as la,readdirSync as da,readFileSync as rn,writeFileSync as ua}from"node:fs";import{homedir as dt}from"node:os";import{basename as fa,extname as pa,isAbsolute as ha,join as ut,relative as ma,resolve as ga}from"node:path";function ae(e){return typeof e=="number"&&Number.isFinite(e)?e:typeof e=="string"&&e.trim()!==""&&!Number.isNaN(Number(e))?Number(e):null}function Xo(e,t,r){return t===null||r===null?!1:t<=r?e>=t&&e<=r:e>=t||e<=r}function Lr(e,t,r){switch(t){case"eq":return e===r;case"ne":return e!==r;case"in":return Array.isArray(r)&&r.includes(e);case"not_in":return Array.isArray(r)&&!r.includes(e);case"prefix":return typeof e=="string"&&typeof r=="string"&&e.toLowerCase().startsWith(r.toLowerCase());case"gte":{let n=ae(e),s=ae(r);return n!==null&&s!==null&&n>=s}case"lte":{let n=ae(e),s=ae(r);return n!==null&&s!==null&&n<=s}case"between":{let n=ae(e);return n!==null&&Array.isArray(r)&&r.length===2&&Xo(n,ae(r[0]),ae(r[1]))}default:return!1}}function Nr(e,t,r){switch(t){case"in":return Array.isArray(r)&&e.some(n=>r.includes(n));case"not_in":return Array.isArray(r)&&!e.some(n=>r.includes(n));default:return!1}}import{existsSync as rt,mkdirSync as sp,readdirSync as Or,readFileSync as Ko,rmSync as ip,writeFileSync as op,chmodSync as ap}from"node:fs";import{homedir as Dr}from"node:os";import{basename as dp,isAbsolute as Zo,join as ce,relative as Yo,resolve as Jo}from"node:path";var ot=()=>ce(Dr(),".nodata"),qo=()=>ce(ot(),"credentials.json"),st=()=>ce(ot(),"orgs"),Qo=()=>ce(ot(),"bindings.json"),ea=/^[A-Za-z0-9_.-]{1,80}$/,Qt=e=>ea.test(e)&&e!=="."&&e!=="..";function Fr(e){try{return rt(e)?JSON.parse(Ko(e,"utf8")):null}catch{return null}}function ta(e){return e?e.device?.org_id?e.device.org_id:e.api_key?`key-${(e.key_prefix??e.api_key.slice(0,12)).replace(/[^A-Za-z0-9_-]/g,"")}`:null:null}function Mr(){return ta(Fr(qo()))}function en(){let e=[],t=Mr();t&&e.push(t);try{for(let r of Or(st()))Qt(r)&&!e.includes(r)&&rt(ce(st(),r,"credentials.json"))&&e.push(r)}catch{}return e}var na=e=>process.platform==="win32"||process.platform==="darwin"?e.toLowerCase():e,it=e=>na(Jo(e.replace(/^~(?=[\\/]|$)/,Dr())));function ra(e,t){let r=Yo(it(e),it(t));return r===""||!r.startsWith("..")&&!Zo(r)}function ee(){let e=Fr(Qo());return(Array.isArray(e?.bindings)?e.bindings:[]).filter(r=>!!r&&typeof r.folder=="string"&&typeof r.org_id=="string"&&Qt(r.org_id)).map(r=>r.project===void 0||oa(r.project)===r.project?r:{...r,project:void 0}).map(r=>r.client===void 0||typeof r.client?.org_id=="string"&&sa.test(r.client.org_id)?r:{...r,client:void 0})}var sa=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function jr(e,t=ee()){let r=null;for(let n of t)ra(n.folder,e)&&(!r||it(n.folder).length>it(r.folder).length)&&(r=n);return r}function ia(e,t=en(),r=ee()){if(t.length===0)return{kind:"none"};let n=jr(e,r.filter(s=>t.includes(s.org_id)));return n?{kind:"bound",org_id:n.org_id,folder:n.folder}:t.length===1?{kind:"only",org_id:t[0]}:{kind:"unbound",orgs:t}}function Hr(e){let t=ia(e);return t.kind==="bound"||t.kind==="only"?t.org_id:null}function oa(e){if(typeof e!="string")return null;let t=e.trim();return t&&t.length<=120&&!/[\u0000-\u001f\\/]/.test(t)?t:null}function Ur(){let e=[],t=ce(ot(),"org-mandate.json");rt(t)&&e.push({owner:Mr(),file:t});try{for(let r of Or(st())){let n=ce(st(),r,"org-mandate.json");Qt(r)&&rt(n)&&e.push({owner:r,file:n})}}catch{}return e}function at(e,t,r=ee()){if(!e)return!0;let n=jr(t,r);return!n||n.org_id===e}var Br=()=>ut(dt(),".nodata","rules.json"),ct=()=>ut(dt(),".nodata","rules-key"),le={allow:0,ask:1,clean_copy:2,deny:3},ya=["claude-code","cursor","windsurf","codex","gemini","vscode","claude-desktop"],tn=e=>typeof e=="string"&&e.trim()?e.trim().toLowerCase():void 0,ba={action:{cardinality:"scalar",ops:["eq","ne","in","not_in"],enumValues:["read","search","run","write","browse","interact"],label:"what the agent does (read, search, run, write; on a site: browse, interact)",extract:e=>e.action},"time.hour":{cardinality:"scalar",ops:["between","gte","lte","eq"],label:"hour on this computer (0-23; 18..6 wraps overnight)",extract:e=>e.now.getHours()},"time.weekday":{cardinality:"scalar",ops:["in","not_in","between","eq"],label:"weekday on this computer (0 Sunday \u2026 6 Saturday)",extract:e=>e.now.getDay()},"file.ext":{cardinality:"scalar",ops:["eq","ne","in","not_in"],label:"file type (.xlsx, .pdf, .env \u2026)",extract:e=>pa(e.path).toLowerCase()||void 0},"file.name":{cardinality:"scalar",ops:["eq","in","prefix"],label:"file name",extract:e=>fa(e.path).toLowerCase()},agent:{cardinality:"scalar",ops:["eq","ne","in","not_in"],agentScope:!0,label:`which agent (${ya.join(", ")} \u2026)`,extract:e=>tn(e.who?.host)},"agent.type":{cardinality:"scalar",ops:["eq","ne","in","not_in"],agentScope:!0,label:"sub-agent type inside the agent (main = the main conversation; general-purpose, explore \u2026)",extract:e=>tn(e.who?.type)},org:{cardinality:"scalar",ops:["eq","ne","in","not_in"],agentScope:!0,label:"which organisation the agent works for (the one its folder is bound to)",extract:e=>tn(e.who?.org)}};function _a(){try{if(nn(ct())){let t=rn(ct(),"utf8").trim();if(/^[0-9a-f]{64}$/.test(t))return Buffer.from(t,"hex")}}catch{}let e=ca(32);return la(ut(dt(),".nodata"),{recursive:!0}),ua(ct(),e.toString("hex")+`
|
|
44
|
-
`,{mode:384}),e}var
|
|
45
|
-
`,{mode:384})}function yn(e){try{let t=Yr(),r=t[e.id];t[e.id]={...r,...e,at:r&&!r.passed_at?r.at:Date.now()},Jr(t)}catch{}}function bn(e){try{let t=Yr();return t[e]?.passed_at?(delete t[e],Jr(t),!0):!1}catch{return!1}}function _n(){try{if(!ja(Xr()))return!1;let e=JSON.parse(Kr(Xr(),"utf8")).state;return e==="connected"||e==="reconnecting"||e==="restart"}catch{return!1}}var S=(e,t,r)=>e==="he"?t:r,qr={safe:0,review:1,destructive:2},Qr=(e,t)=>qr[t]>qr[e]?t:e;function Va(e){let t=e.replace(/\/\*[\s\S]*?\*\//g," ");return t=t.replace(/--[^\n]*/g," "),t=t.replace(/\$([A-Za-z_]*)\$[\s\S]*?\$\1\$/g," $$body$$ "),t.split(";").map(r=>r.replace(/\s+/g," ").trim()).filter(Boolean)}var V='("?[\\w.]+"?)',v=e=>e.replace(/"/g,"").replace(/^public\./i,"");function Xa(e,t,r=!1){let n=[],s=[],i=[],o=[],a=new Set,c=new Set,l=new Set,f=new Map;for(let p of Va(e)){let g=p.toUpperCase(),u;if(u=p.match(new RegExp(`^CREATE (?:UNLOGGED )?TABLE (?:IF NOT EXISTS )?${V}`,"i"))){a.add(v(u[1]).toLowerCase()),i.push(S(t,`\u05D8\u05D1\u05DC\u05D4 \u05D7\u05D3\u05E9\u05D4 ${v(u[1])}`,`new table ${v(u[1])}`));continue}if(u=p.match(new RegExp(`^DROP TABLE (?:IF EXISTS )?${V}`,"i"))){n.push(S(t,`\u05DE\u05D5\u05D7\u05E7 \u05D0\u05EA \u05D4\u05D8\u05D1\u05DC\u05D4 ${v(u[1])} \u05D5\u05DB\u05DC \u05D4\u05E9\u05D5\u05E8\u05D5\u05EA \u05E9\u05D1\u05D4`,`deletes table ${v(u[1])} and every row in it`));continue}if(/^TRUNCATE/i.test(p)){n.push(S(t,"\u05DE\u05E8\u05D5\u05E7\u05DF \u05D8\u05D1\u05DC\u05D4 (TRUNCATE): \u05DB\u05DC \u05D4\u05E9\u05D5\u05E8\u05D5\u05EA \u05E0\u05DE\u05D7\u05E7\u05D5\u05EA","empties a table (TRUNCATE): every row is deleted"));continue}if(u=p.match(new RegExp(`^ALTER TABLE (?:IF EXISTS )?(?:ONLY )?${V} (.*)$`,"i"))){let y=v(u[1]),m=u[2];for(let _ of m.matchAll(/DROP COLUMN (?:IF EXISTS )?("?[\w]+"?)/gi))n.push(S(t,`\u05DE\u05D5\u05D7\u05E7 \u05D0\u05EA \u05D4\u05E2\u05DE\u05D5\u05D3\u05D4 ${y}.${v(_[1])} \u05D5\u05D4\u05DE\u05D9\u05D3\u05E2 \u05E9\u05D1\u05D4`,`deletes column ${y}.${v(_[1])} and its data`));for(let _ of m.matchAll(/ADD COLUMN (?:IF NOT EXISTS )?("?[\w]+"?)\s+([^,]*)/gi)){let E=/NOT NULL/i.test(_[2])&&!/DEFAULT/i.test(_[2])&&!a.has(y.toLowerCase());(E?s:i).push(E?S(t,`\u05E2\u05DE\u05D5\u05D3\u05D4 \u05D7\u05D3\u05E9\u05D4 ${y}.${v(_[1])} \u05D7\u05D5\u05D1\u05D4 \u05D5\u05D1\u05DC\u05D9 \u05D1\u05E8\u05D9\u05E8\u05EA \u05DE\u05D7\u05D3\u05DC: \u05D9\u05D9\u05DB\u05E9\u05DC \u05D0\u05DD \u05D9\u05E9 \u05DB\u05D1\u05E8 \u05E9\u05D5\u05E8\u05D5\u05EA`,`new required column ${y}.${v(_[1])} with no default: fails if rows exist`):S(t,`\u05E2\u05DE\u05D5\u05D3\u05D4 \u05D7\u05D3\u05E9\u05D4 ${y}.${v(_[1])}`,`new column ${y}.${v(_[1])}`))}for(let _ of m.matchAll(/ALTER COLUMN ("?[\w]+"?) (?:SET DATA )?TYPE/gi))s.push(S(t,`\u05DE\u05E9\u05E0\u05D4 \u05D0\u05EA \u05D4\u05E1\u05D5\u05D2 \u05E9\u05DC ${y}.${v(_[1])}: \u05DE\u05D9\u05D3\u05E2 \u05E7\u05D9\u05D9\u05DD \u05DE\u05D5\u05DE\u05E8`,`changes the type of ${y}.${v(_[1])}: existing data is converted`));for(let _ of m.matchAll(/RENAME (?:COLUMN )?("?[\w]+"?) TO ("?[\w]+"?)/gi))s.push(S(t,`\u05DE\u05E9\u05E0\u05D4 \u05E9\u05DD ${y}.${v(_[1])} \u05DC-${v(_[2])}: \u05E7\u05D5\u05D3 \u05E9\u05DE\u05E9\u05EA\u05DE\u05E9 \u05D1\u05E9\u05DD \u05D4\u05D9\u05E9\u05DF \u05D9\u05D9\u05E9\u05D1\u05E8`,`renames ${y}.${v(_[1])} to ${v(_[2])}: code using the old name breaks`));/DISABLE ROW LEVEL SECURITY/i.test(m)&&n.push(S(t,`\u05DE\u05DB\u05D1\u05D4 \u05D0\u05EA \u05D4\u05D4\u05D2\u05E0\u05D4 \u05E2\u05DC \u05D4\u05E9\u05D5\u05E8\u05D5\u05EA (RLS) \u05D1\u05D8\u05D1\u05DC\u05D4 ${y}: \u05DB\u05DC \u05DE\u05D9 \u05E9\u05DE\u05D7\u05D5\u05D1\u05E8 \u05E8\u05D5\u05D0\u05D4 \u05D4\u05DB\u05DC`,`turns off row security (RLS) on ${y}: anyone connected sees everything`)),/ENABLE ROW LEVEL SECURITY/i.test(m)&&i.push(S(t,`\u05DE\u05D3\u05DC\u05D9\u05E7 \u05D4\u05D2\u05E0\u05D4 \u05E2\u05DC \u05D4\u05E9\u05D5\u05E8\u05D5\u05EA (RLS) \u05D1\u05D8\u05D1\u05DC\u05D4 ${y}`,`turns on row security (RLS) on ${y}`));let x=y.toLowerCase();/DROP CONSTRAINT/i.test(m)&&f.set(x,{table:y,drop:!0,add:f.get(x)?.add??!1}),/ADD CONSTRAINT/i.test(m)&&f.set(x,{table:y,drop:f.get(x)?.drop??!1,add:!0});continue}if(u=p.match(new RegExp(`^DELETE FROM (?:ONLY )?${V}(.*)$`,"i"))){let y=/\bWHERE\b/i.test(u[2]);(y?s:n).push(y?S(t,`\u05DE\u05D5\u05D7\u05E7 \u05E9\u05D5\u05E8\u05D5\u05EA \u05DE\u05D4\u05D8\u05D1\u05DC\u05D4 ${v(u[1])} (\u05DC\u05E4\u05D9 \u05EA\u05E0\u05D0\u05D9)`,`deletes rows from ${v(u[1])} (by a condition)`):S(t,`\u05DE\u05D5\u05D7\u05E7 \u05D0\u05EA \u05DB\u05DC \u05D4\u05E9\u05D5\u05E8\u05D5\u05EA \u05D1\u05D8\u05D1\u05DC\u05D4 ${v(u[1])}`,`deletes every row in ${v(u[1])}`));continue}if(u=p.match(new RegExp(`^UPDATE (?:ONLY )?${V}(.*)$`,"i"))){let y=/\bWHERE\b/i.test(u[2]);(y?s:n).push(y?S(t,`\u05DE\u05E9\u05E0\u05D4 \u05E9\u05D5\u05E8\u05D5\u05EA \u05E7\u05D9\u05D9\u05DE\u05D5\u05EA \u05D1\u05D8\u05D1\u05DC\u05D4 ${v(u[1])} (\u05DC\u05E4\u05D9 \u05EA\u05E0\u05D0\u05D9)`,`changes existing rows in ${v(u[1])} (by a condition)`):S(t,`\u05DE\u05E9\u05E0\u05D4 \u05D0\u05EA \u05DB\u05DC \u05D4\u05E9\u05D5\u05E8\u05D5\u05EA \u05D1\u05D8\u05D1\u05DC\u05D4 ${v(u[1])}`,`changes every row in ${v(u[1])}`));continue}if(u=p.match(new RegExp(`^INSERT INTO ${V}`,"i"))){o.push(S(t,`\u05DE\u05D5\u05E1\u05D9\u05E3 \u05E9\u05D5\u05E8\u05D5\u05EA \u05DC\u05D8\u05D1\u05DC\u05D4 ${v(u[1])}`,`adds rows to ${v(u[1])}`));continue}if(u=p.match(new RegExp(`^DROP POLICY (?:IF EXISTS )?("[^"]+"|\\S+) ON ${V}`,"i"))){c.add(v(u[2]).toLowerCase());continue}if(u=p.match(new RegExp(`^CREATE POLICY ("[^"]+"|\\S+) ON ${V}`,"i"))){l.add(v(u[2]).toLowerCase()),/\bTO (anon|public)\b/i.test(p)&&/USING \(\s*true\s*\)/i.test(p)&&s.push(S(t,`\u05DB\u05DC\u05DC \u05D2\u05D9\u05E9\u05D4 \u05D1-${v(u[2])} \u05E9\u05E4\u05D5\u05EA\u05D7 \u05D4\u05DB\u05DC \u05DC\u05D0\u05D5\u05E8\u05D7\u05D9\u05DD (anon)`,`an access rule on ${v(u[2])} that opens everything to guests (anon)`));continue}if((u=p.match(/^GRANT (.+) ON (?:TABLE |ALL TABLES IN SCHEMA )?(\S+) TO (.+)$/i))&&/\b(anon|public|authenticated)\b/i.test(u[3])){s.push(S(t,`\u05E0\u05D5\u05EA\u05DF \u05D4\u05E8\u05E9\u05D0\u05D4 (${u[1].trim()}) \u05E2\u05DC ${v(u[2])} \u05DC-${u[3].trim()}`,`grants ${u[1].trim()} on ${v(u[2])} to ${u[3].trim()}`));continue}if(u=p.match(new RegExp(`^DROP (FUNCTION|VIEW|TYPE|TRIGGER|INDEX)(?: IF EXISTS)? ${V}`,"i"))){s.push(S(t,`\u05DE\u05D5\u05D7\u05E7 ${u[1].toLowerCase()} ${v(u[2])}: \u05E7\u05D5\u05D3 \u05E9\u05DE\u05E9\u05EA\u05DE\u05E9 \u05D1\u05D5 \u05D9\u05D9\u05E9\u05D1\u05E8`,`drops ${u[1].toLowerCase()} ${v(u[2])}: code using it breaks`));continue}if(u=p.match(new RegExp(`^CREATE (?:UNIQUE )?INDEX (?:CONCURRENTLY )?(?:IF NOT EXISTS )?\\S+ ON (?:ONLY )?${V}`,"i"))){i.push(S(t,`\u05D0\u05D9\u05E0\u05D3\u05E7\u05E1 \u05E2\u05DC ${v(u[1])}`,`index on ${v(u[1])}`));continue}if(/^CREATE (OR REPLACE )?(FUNCTION|PROCEDURE)/i.test(p)){let y=p.match(/(?:FUNCTION|PROCEDURE) ("?[\w.]+"?)/i)?.[1];(/SECURITY DEFINER/i.test(g)?s:i).push(/SECURITY DEFINER/i.test(g)?S(t,`\u05E4\u05D5\u05E0\u05E7\u05E6\u05D9\u05D4 ${v(y??"")} \u05E9\u05E8\u05E6\u05D4 \u05D1\u05D4\u05E8\u05E9\u05D0\u05D5\u05EA \u05E9\u05DC \u05D4\u05D1\u05E2\u05DC\u05D9\u05DD (SECURITY DEFINER)`,`function ${v(y??"")} that runs with its owner's rights (SECURITY DEFINER)`):S(t,`\u05E4\u05D5\u05E0\u05E7\u05E6\u05D9\u05D4 ${v(y??"")}`,`function ${v(y??"")}`));continue}/^CREATE (OR REPLACE )?(VIEW|TRIGGER|TYPE|SCHEMA|EXTENSION)/i.test(p)&&i.push(S(t,p.split(" ").slice(0,4).join(" ").toLowerCase(),p.split(" ").slice(0,4).join(" ").toLowerCase()))}for(let p of c)l.has(p)||s.push(S(t,`\u05DE\u05D5\u05D7\u05E7 \u05DB\u05DC\u05DC \u05D2\u05D9\u05E9\u05D4 \u05D1\u05D8\u05D1\u05DC\u05D4 ${p} \u05D1\u05DC\u05D9 \u05DC\u05D9\u05E6\u05D5\u05E8 \u05D7\u05D3\u05E9`,`drops an access rule on ${p} without creating a new one`));c.size&&[...c].every(p=>l.has(p))&&i.push(S(t,`\u05DE\u05D7\u05DC\u05D9\u05E3 \u05DB\u05DC\u05DC\u05D9 \u05D2\u05D9\u05E9\u05D4 (${[...c].join(", ")})`,`replaces access rules (${[...c].join(", ")})`));for(let{table:p,drop:g,add:u}of f.values())s.push(g&&u?S(t,`\u05DE\u05D7\u05DC\u05D9\u05E3 \u05D0\u05D9\u05DC\u05D5\u05E5 \u05D1\u05D8\u05D1\u05DC\u05D4 ${p}: \u05D9\u05D9\u05DB\u05E9\u05DC \u05D0\u05DD \u05DE\u05D9\u05D3\u05E2 \u05E7\u05D9\u05D9\u05DD \u05DC\u05D0 \u05E2\u05D5\u05DE\u05D3 \u05D1\u05D7\u05D3\u05E9`,`replaces a constraint on ${p}: fails if existing data does not meet the new one`):g?S(t,`\u05DE\u05E1\u05D9\u05E8 \u05D0\u05D9\u05DC\u05D5\u05E5 \u05DE\u05D4\u05D8\u05D1\u05DC\u05D4 ${p}: \u05DE\u05D9\u05D3\u05E2 \u05DC\u05D0 \u05EA\u05E7\u05D9\u05DF \u05D9\u05D5\u05DB\u05DC \u05DC\u05D4\u05D9\u05DB\u05E0\u05E1`,`removes a constraint from ${p}: invalid data can get in`):S(t,`\u05DE\u05D5\u05E1\u05D9\u05E3 \u05D0\u05D9\u05DC\u05D5\u05E5 \u05DC\u05D8\u05D1\u05DC\u05D4 ${p}: \u05D9\u05D9\u05DB\u05E9\u05DC \u05D0\u05DD \u05DE\u05D9\u05D3\u05E2 \u05E7\u05D9\u05D9\u05DD \u05DC\u05D0 \u05E2\u05D5\u05DE\u05D3 \u05D1\u05D5`,`adds a constraint to ${p}: fails if existing data does not meet it`));r&&s.unshift(S(t,"\u05DE\u05E9\u05E0\u05D4 \u05E7\u05D5\u05D1\u05E5 \u05DE\u05D9\u05D2\u05E8\u05E6\u05D9\u05D4 \u05E7\u05D9\u05D9\u05DD: \u05D0\u05DD \u05D4\u05D5\u05D0 \u05DB\u05D1\u05E8 \u05D4\u05D5\u05E8\u05E5 \u05D1\u05E4\u05E8\u05D5\u05D3\u05E7\u05E9\u05DF, \u05D4\u05E9\u05D9\u05E0\u05D5\u05D9 \u05DC\u05D0 \u05D9\u05E8\u05D5\u05E5 \u05E9\u05D5\u05D1","edits an existing migration file: if it already ran in production, the change will not run again")),/--\s*Rollback/i.test(e)||s.push(S(t,"\u05D0\u05D9\u05DF \u05D4\u05E2\u05E8\u05EA Rollback (\u05D0\u05D9\u05DA \u05D7\u05D5\u05D6\u05E8\u05D9\u05DD \u05D0\u05D7\u05D5\u05E8\u05D4)","no Rollback note (how to undo it)"));let d="safe";s.length&&(d=Qr(d,"review")),n.length&&(d=Qr(d,"destructive"));let h=[...new Set([...n,...s,...o,...i])];return{risk:d,lines:h.length?h:[S(t,"\u05DC\u05D0 \u05D6\u05D5\u05D4\u05D5 \u05E4\u05E7\u05D5\u05D3\u05D5\u05EA \u05DE\u05D5\u05DB\u05E8\u05D5\u05EA \u05D1\u05E7\u05D5\u05D1\u05E5","no known statements found in the file")]}}function Ka(e,t){let r=[],n="review",s=[...new Set([...e.matchAll(/secrets\.([A-Z0-9_]+)/g)].map(o=>o[1]).filter(o=>o!=="GITHUB_TOKEN"))];/\bpull_request_target\b/.test(e)&&(n="destructive",r.push(S(t,"\u05E8\u05E5 \u05E2\u05DC pull_request_target: \u05E7\u05D5\u05D3 \u05DE-PR \u05D6\u05E8 \u05D9\u05DB\u05D5\u05DC \u05DC\u05E8\u05D5\u05E5 \u05E2\u05DD \u05D4\u05E1\u05D5\u05D3\u05D5\u05EA","runs on pull_request_target: code from an outside PR can run with the secrets"))),s.length&&r.push(S(t,`\u05DE\u05E9\u05EA\u05DE\u05E9 \u05D1\u05E1\u05D5\u05D3\u05D5\u05EA: ${s.join(", ")}`,`uses secrets: ${s.join(", ")}`)),/permissions:\s*write-all|contents:\s*write/.test(e)&&r.push(S(t,"\u05DE\u05E7\u05D1\u05DC \u05D4\u05E8\u05E9\u05D0\u05EA \u05DB\u05EA\u05D9\u05D1\u05D4 \u05DC\u05E8\u05D9\u05E4\u05D5","gets write access to the repository"));let i=[...e.matchAll(/uses:\s*([^\s@#]+)@([^\s#]+)/g)].filter(o=>!/^[0-9a-f]{40}$/.test(o[2])&&!o[1].startsWith("./"));return i.length&&r.push(S(t,`${i.length} \u05E8\u05DB\u05D9\u05D1\u05D9\u05DD \u05D7\u05D9\u05E6\u05D5\u05E0\u05D9\u05D9\u05DD \u05DC\u05D0 \u05E0\u05E2\u05D5\u05DC\u05D9\u05DD \u05DC\u05D2\u05E8\u05E1\u05D4 \u05DE\u05D3\u05D5\u05D9\u05E7\u05EA`,`${i.length} outside actions not pinned to an exact version`)),r.length||r.push(S(t,"\u05E9\u05D9\u05E0\u05D5\u05D9 \u05D1-CI \u05D1\u05DC\u05D9 \u05E1\u05D5\u05D3\u05D5\u05EA \u05D5\u05D1\u05DC\u05D9 \u05D4\u05E8\u05E9\u05D0\u05D5\u05EA \u05DB\u05EA\u05D9\u05D1\u05D4","a CI change with no secrets and no write access")),{risk:n,lines:r}}function es(e,t,r,n){let s=e.replace(/\\/g,"/"),i=typeof t.content=="string"?t.content:typeof t.new_string=="string"?t.new_string:Array.isArray(t.edits)?t.edits.map(c=>typeof c?.new_string=="string"?c.new_string:"").join(`
|
|
46
|
-
`):null;if(
|
|
40
|
+
`))}a+h.length>Q&&(h=h.slice(0,Math.max(0,Q-a)),c=!0),h.trim().length!==0&&(o.push(h),i.push(l),a+=h.length)}return o.length===0?null:{text:o.join(`
|
|
41
|
+
`),truncated:c,parts:i}}function mr(e,t,r={}){if(Ae(e)){let n=Ht(e,Q);return"text"in n?{ok:!0,result:{text:n.text,truncated:n.truncated,parts:n.parts,attachments:n.attachments}}:{ok:!1,reason:n.reason}}if(Je(e)){let n=Bt(e.toString("latin1"));if(!n.trim())return{ok:!1,reason:"no text inside (an empty file, or only pictures)"};let s=n.length>Q;return{ok:!0,result:{text:s?n.slice(0,Q):n,truncated:s,parts:["rtf"]}}}if(t===".xlsb"){let n=ur(e);if(!n)return{ok:!1,reason:"damaged, or an Excel binary workbook with no cells to read"};let s=n.length>Q;return{ok:!0,result:{text:s?n.slice(0,Q):n,truncated:s,parts:["xlsb"]}}}if(zt.has(t)||qe.has(t)){let n=hi(e,t);return n?{ok:!0,result:n}:{ok:!1,reason:"damaged, or not really an Office file"}}if(je.has(t)){let n=Ge(e,r);return n?{ok:!0,result:{text:n.text,truncated:n.truncated,parts:[`pdf:${n.engine}`],engine:n.engine,uncertain:n.uncertain}}:{ok:!1,reason:or(e)}}return Wt.has(t)?{ok:!1,reason:"not a Word, Excel, PowerPoint or Outlook file inside, despite its name"}:{ok:!1,reason:"unsupported format"}}function Vt(e,t,r={}){let n=mr(e,t,r);return n.ok?n.result:null}var Gt=new Set([...zt,...qe,...Wt,...hr,...je,".xlsb"]);var Id=5*6e4,Td=2*6e4;import{deflateRawSync as xi}from"node:zlib";var gr={israeli_id:"[ID]",credit_card:"[CARD]",iban:"[IBAN]",israeli_phone:"[PHONE]",email:"[EMAIL]"},mi=/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g,gi=[...Ct].sort((e,t)=>+(t.subkind==="iban")-+(e.subkind==="iban"));function ie(e,t,r=1){e[t]=(e[t]??0)+r}var yr=null,ae=e=>{let t=e.trim();yr&&t&&yr.add(t)};function W(e,t={},r){let n=e;for(let o of Se()){let i=new RegExp(o.pattern.source,o.pattern.flags.includes("g")?o.pattern.flags:o.pattern.flags+"g");n=n.replace(i,a=>(ie(t,"secret"),ae(a),"[SECRET]"))}for(let o of gi)o.pattern.lastIndex=0,n=n.replace(o.pattern,i=>o.validate(i)?(ie(t,o.subkind),ae(i),gr[o.subkind]??`[${o.subkind.toUpperCase()}]`):i);n=n.replace(mi,o=>(ie(t,"email"),ae(o),gr.email));let s=r??new Set;for(let o of De()){let i=o.find(n).sort((a,c)=>c.start-a.start);for(let a of i){let c=n.slice(a.start,a.end);ae(c),o.kind==="name"&&s.add(c.trim()),n=n.slice(0,a.start)+`[${o.kind.toUpperCase()}]`+n.slice(a.end),ie(t,o.kind)}}return s.size&&(n=bi(n,s,t)),{text:n,counts:t,columnsHidden:[]}}var yi=e=>e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");function bi(e,t,r){let n=new Set;for(let o of t){n.add(o);let i=o.split(/\s+/)[0]??"";i.length>=3&&i!==o&&n.add(i)}let s=e;for(let o of[...n].sort((i,a)=>a.length-i.length)){let i=new RegExp(`(?<![\\p{L}\\p{N}@.\\[-])${yi(o)}(?![\\p{L}\\p{N}@\\]-])`,"gu");s=s.replace(i,a=>(ie(r,"name"),ae(a),"[NAME]"))}return s}function he(e,t,r={}){let n=e;for(let[s,o]of[...t].sort((i,a)=>a[0].length-i[0].length))n.includes(s)&&(n=n.split(s).join(`[${o.toUpperCase()}]`),ie(r,o),ae(s));return n}function Xt(){let e=new Map,t={};return(r,n)=>{ae(n);let s=`${r}\0${n.trim()}`,o=e.get(s);return o===void 0&&(o=t[r]=(t[r]??0)+1,e.set(s,o)),`[${r.toUpperCase()}-${o}]`}}function Qe(e){let t=e.trim();return/^\[[A-Z_]+(?:-\d+)?\]$/.test(t)||/^[\d]{0,4}[*•xX]{3,}[\d]{0,4}$/.test(t)}var _r=/^\s*-?\d+(?:\.\d+)?\s*$/;function Kt(e){let t=new Set;for(let[r,n]of e){let s=n.filter(i=>_r.test(i));if(s.length<3)continue;s.filter(i=>W(i).text!==i).length/s.length<.5&&t.add(r)}return t}function br(e,t){return e.includes(t)||e.includes('"')||e.includes(`
|
|
42
|
+
`)?`"${e.replace(/"/g,'""')}"`:e}function _i(e){let t=(e.match(/\t/g)??[]).length,r=(e.match(/;/g)??[]).length,n=(e.match(/,/g)??[]).length;return t>n&&t>=r?" ":r>n?";":","}function Zt(e,t){let r=e.split(/\r?\n/),n=t??_i(r[0]??""),s=Me(r[0]??"",n),o=s.map(p=>Ee(p)),i={},a=Xt(),c=r.slice(1).map(p=>p===""?null:Me(p,n)),l=new Map;for(let p of c)p?.forEach((g,u)=>l.set(u,[...l.get(u)??[],g]));let f=Kt(l),d=ve();if(d){let p=c.filter(g=>g!==null).slice(0,200);for(let g of d({name:"table",headers:s,rows:p})){let u=s.indexOf(g.column);u>=0&&!(g.how==="header"&&f.has(u))&&(o[u]={type:g.type,label:g.category})}}let h=[s.map(p=>br(p,n)).join(n)];for(let p of c){if(p===null){h.push("");continue}let g=p.map((u,y)=>{let m=o[y];return m&&u.trim()!==""&&!Qe(u)?(ie(i,`column:${m.type}`),a(m.type,u)):f.has(y)&&_r.test(u)?u:W(u,i).text});h.push(g.map(u=>br(u,n)).join(n))}return{text:h.join(`
|
|
43
|
+
`),counts:i,columnsHidden:s.filter((p,g)=>o[g])}}var wi=/^xl\/(pivotCache|charts|externalLinks)\//,kr=10;function xr(e,t,r=1){e[t]=(e[t]??0)+r}function vr(e){return e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""")}function Sr(e){let t=e.replace(/<rPh\b[\s\S]*?<\/rPh>/g,""),r="";for(let n of t.matchAll(/<t(?:\s[^>]*)?>([\s\S]*?)<\/t>/g))r+=n[1];return X(r)}function ki(e){return e?[...e.matchAll(/<si\b[^>]*>([\s\S]*?)<\/si>|<si\b[^>]*\/>/g)].map(t=>Sr(t[1]??"")):[]}var Er=/<c\b([^>]*?)(?:\/>|>([\s\S]*?)<\/c>)/g;function et(e,t){let r=new RegExp(`\\b${t}="([^"]*)"`).exec(e);return r?r[1]:null}function me(e,t){if(e.type==="s"){let n=/<v>([^<]*)<\/v>/.exec(e.inner);return n?t[Number(n[1])]??null:null}if(e.type==="inlineStr"){let n=/<is>([\s\S]*?)<\/is>/.exec(e.inner);return n?Sr(n[1]):null}if(e.type==="b"||e.type==="e")return null;let r=/<v>([^<]*)<\/v>/.exec(e.inner);return r?X(r[1]):null}function vi(e){let t=[];for(let r of e.matchAll(Er)){let n=et(r[1],"r"),s=n?/^([A-Z]+)(\d+)$/.exec(n):null;if(!s)return null;t.push({full:r[0],attrs:r[1],inner:r[2]??"",col:s[1],row:Number(s[2]),type:et(r[1],"t")??"n"})}return t}function Si(e,t){let r=[...new Set(e.map(n=>n.row))].sort((n,s)=>n-s).slice(0,kr);for(let n of r){let s=new Map;for(let o of e.filter(i=>i.row===n)){let i=me(o,t),a=i?Ee(i):null;a&&s.set(o.col,{type:a.type,header:i.trim()})}if(s.size>0)return{row:n,cols:s}}return{row:-1,cols:new Map}}var Ei=/^xl\/worksheets\/sheet\d+\.xml$/,Ai=200;function $i(e){let t=e.trim();return/^[\d.,\-+/:%$₪€\s]+$/.test(t)||t.length>60}function Ri(e,t){let r=[...new Set(e.map(o=>o.row))].sort((o,i)=>o-i).slice(0,kr),n=-1,s=-1/0;for(let o of r){let i=e.filter(l=>l.row===o).map(l=>(me(l,t)??"").trim()).filter(Boolean);if(i.length<2)continue;let a=i.filter(l=>!$i(l)).length,c=a*2-(i.length-a);c>s&&(s=c,n=o)}return n}function Ii(e,t,r){let n=Si(t,r),s=ve();if(!s)return n;let o=n.row>=0?n.row:Ri(t,r);if(o<0)return n;let i=t.filter(d=>d.row===o).map(d=>({col:d.col,text:(me(d,r)??"").trim()})).filter(d=>d.text),a=new Map(i.map((d,h)=>[d.col,h])),c=new Map;for(let d of t){if(d.row<=o)continue;let h=a.get(d.col);if(h!==void 0){if(!c.has(d.row)){if(c.size>=Ai)continue;c.set(d.row,i.map(()=>""))}c.get(d.row)[h]=me(d,r)??""}}let l=new Map(o===n.row?n.cols:[]),f=i.map(d=>d.text);for(let d of s({name:e,headers:f,rows:[...c.values()]})){let h=f.indexOf(d.column);h<0||l.set(i[h].col,{type:d.type,header:d.column,category:d.category,severity:d.severity,how:d.how})}return{row:o,cols:l}}function Yt(e,t){return`<c${e.replace(/\s*\bt="[^"]*"/,"")} t="inlineStr"><is><t xml:space="preserve">${vr(t)}</t></is></c>`}var Ti=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t+=1){let r=t;for(let n=0;n<8;n+=1)r=r&1?3988292384^r>>>1:r>>>1;e[t]=r>>>0}return e})();function Ci(e){let t=4294967295;for(let r=0;r<e.length;r+=1)t=Ti[(t^e[r])&255]^t>>>8;return(t^4294967295)>>>0}var wr=33;function Jt(e){let t=[],r=[],n=0;for(let i of e){let a=Buffer.from(i.name,"utf8"),c=i.name.endsWith("/"),l=c?Buffer.alloc(0):xi(i.data),f=c?0:8,d=c?0:Ci(i.data),h=Buffer.alloc(30);h.writeUInt32LE(67324752,0),h.writeUInt16LE(20,4),h.writeUInt16LE(2048,6),h.writeUInt16LE(f,8),h.writeUInt16LE(wr,12),h.writeUInt32LE(d,14),h.writeUInt32LE(l.length,18),h.writeUInt32LE(i.data.length,22),h.writeUInt16LE(a.length,26),t.push(h,a,l);let p=Buffer.alloc(46);p.writeUInt32LE(33639248,0),p.writeUInt16LE(20,4),p.writeUInt16LE(20,6),p.writeUInt16LE(2048,8),p.writeUInt16LE(f,10),p.writeUInt16LE(wr,14),p.writeUInt32LE(d,16),p.writeUInt32LE(l.length,20),p.writeUInt32LE(i.data.length,24),p.writeUInt16LE(a.length,28),p.writeUInt32LE(n,42),r.push(p,a),n+=h.length+a.length+l.length}let s=Buffer.concat(r),o=Buffer.alloc(22);return o.writeUInt32LE(101010256,0),o.writeUInt16LE(e.length,8),o.writeUInt16LE(e.length,10),o.writeUInt32LE(s.length,12),o.writeUInt32LE(n,16),Buffer.concat([...t,s,o])}function qt(e,t){let r=J(e);if(!r||r.length===0||r.some(m=>wi.test(m.name)))return null;let n=new Map;for(let m of r){if(m.name.endsWith("/")){n.set(m.name,Buffer.alloc(0));continue}let _=q(e,m);if(!_)return null;n.set(m.name,_)}let s=[...n.keys()].filter(m=>Ei.test(m));if(s.length===0)return null;let o=n.get("xl/sharedStrings.xml")?.toString("utf8")??null,i=ki(o),a=new Set,c={},l=new Set,f=Xt(),d=Rt();for(let m of s){let _=n.get(m).toString("utf8"),b=vi(_);if(!b)return null;let E=Ii(m.replace(/^xl\/worksheets\//,"").replace(/\.xml$/,""),b,i),w=E.row,$=new Map;for(let N of b){if(N.type!=="n"||N.row<=w)continue;let j=me(N,i);j!==null&&$.set(N.col,[...$.get(N.col)??[],j])}let M=Kt($),U=new Map;for(let[N,{type:j,header:F,how:z}]of E.cols)z==="header"&&M.has(N)||(U.set(N,j),l.add(F));let L=_.replace(Er,(N,j,F)=>{let z=et(j,"r"),[,B,x]=/^([A-Z]+)(\d+)$/.exec(z),k={full:N,attrs:j,inner:F??"",col:B,row:Number(x),type:et(j,"t")??"n"},I=me(k,i),C=()=>{if(k.type==="s"){let Mn=/<v>([^<]*)<\/v>/.exec(k.inner);Mn&&a.add(Number(Mn[1]))}return N};if(I===null||I.trim()==="")return C();if(d&&k.type==="n"&&M.has(B)&&k.row>w)return xr(c,"amount"),Yt(j,"[AMOUNT]");let A=U.get(B);if(A&&k.row>w&&!Qe(I))return xr(c,`column:${A}`),Yt(j,f(A,I));if(k.type==="n"&&M.has(B))return C();let se=W(I,c),ke=t?.size?he(se.text,t,c):se.text;return ke===I?C():Yt(j,ke)});n.set(m,Buffer.from(L,"utf8"))}if(o){let m=-1,_=o.replace(/<si\b[^>]*>[\s\S]*?<\/si>|<si\b[^>]*\/>/g,b=>(m+=1,a.has(m)?b:"<si><t>[HIDDEN]</t></si>"));n.set("xl/sharedStrings.xml",Buffer.from(_,"utf8"))}for(let m of[...n.keys()].filter(_=>/^xl\/comments\d*\.xml$/.test(_))){let b=n.get(m).toString("utf8").replace(/(<t(?:\s[^>]*)?>)([\s\S]*?)(<\/t>)/g,(E,w,$,M)=>{let U=W(X($),c);return`${w}${vr(t?.size?he(U.text,t,c):U.text)}${M}`});n.set(m,Buffer.from(b,"utf8"))}let h=n.get("docProps/core.xml");if(h){let m=h.toString("utf8").replace(/(<dc:creator>)[\s\S]*?(<\/dc:creator>)/,"$1$2").replace(/(<cp:lastModifiedBy>)[\s\S]*?(<\/cp:lastModifiedBy>)/,"$1$2");n.set("docProps/core.xml",Buffer.from(m,"utf8"))}let p=n.get("xl/workbook.xml");if(p){let m=p.toString("utf8").replace(/<(\w+:)?absPath\b[^>]*\/>|<(\w+:)?absPath\b[^>]*>[\s\S]*?<\/(\w+:)?absPath>/g,"");n.set("xl/workbook.xml",Buffer.from(m,"utf8"))}let g=n.get("docProps/app.xml");if(g){let m=g.toString("utf8").replace(/(<Company>)[\s\S]*?(<\/Company>)/,"$1$2").replace(/(<Manager>)[\s\S]*?(<\/Manager>)/,"$1$2");n.set("docProps/app.xml",Buffer.from(m,"utf8"))}let u=n.has("xl/calcChain.xml"),y=r.map(m=>m.name).filter(m=>!(u&&m==="xl/calcChain.xml"));if(u)for(let m of["[Content_Types].xml","xl/_rels/workbook.xml.rels"]){let _=n.get(m);_&&n.set(m,Buffer.from(_.toString("utf8").replace(/<(Override|Relationship)\b[^>]*calcChain[^>]*\/>/g,""),"utf8"))}return{bytes:Jt(y.map(m=>({name:m,data:n.get(m)}))),counts:c,columnsHidden:[...l]}}var ge=/(^|\/)(\.env(\.[\w.-]+)?|[\w.-]+\.env(\.[\w.-]+)?)$/i,Pi=/(SECRET|PASSWORD|PASSWD|PASS|PWD|TOKEN|PRIVATE|CREDENTIAL|API_?KEY|_KEY|KEY_ID|DSN|DATABASE_URL|_URI|POOLER_URL|SALT|PEPPER)$/i,Li=/(^NEXT_PUBLIC_|^VITE_|^EXPO_PUBLIC_|ANON_KEY$|PUBLISHABLE_KEY$|PUBLIC_KEY$)/i;function Qt(e){let t=0;for(let r of e.split(/\r?\n/)){let n=/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(r);if(!n||!Pi.test(n[1])||Li.test(n[1]))continue;let s=n[2].trim().replace(/^(['"])(.*)\1$/,"$2");s.length>=8&&!/^\$\{?[A-Z_]+\}?$/.test(s)&&t++}return t}var ku=64*1024*1024,vu=4*1024*1024;var Su=512*1024*1024,Eu=1024*1024*1024;var Au=256*1024*1024;var $u=new $r("utf-8",{fatal:!0}),Ru=new $r("windows-1255");var Iu=new Set([".cache",".cargo",".rustup",".npm",".pnpm-store",".yarn",".gradle",".m2",".nuget",".conda",".pyenv",".rbenv",".nvm",".volta",".bun",".deno",".docker",".android",".vscode-server",".agents",".agent",".codeium",".continue","antigravity",".antigravity","__pycache__",".venv","venv","site-packages",".next",".turbo",".expo",".nx",".parcel-cache",".svelte-kit","appdata",".trash","$recycle.bin"].map(e=>e.toLowerCase()));var Uu=Buffer.from("iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkYAAAAAYAAjCB0C8AAAAASUVORK5CYII=","base64");var Vi=["Put the new key where the app reads it (for a developer machine: the NoData vault + nodata_run, not a .env file).","Check that the app still works with the new key.","Only then delete / revoke the OLD key \u2014 until you do, whoever copied it can still use it."],T=(e,t,r)=>({provider:e,url:t,steps:[...r,...Vi]}),Gi={"aws-access-key":T("AWS","https://console.aws.amazon.com/iam/home#/security_credentials",["Open IAM \u2192 your user \u2192 Security credentials.","Create a NEW access key (you see its secret once \u2014 keep it only in the vault)."]),"aws-secret-key":T("AWS","https://console.aws.amazon.com/iam/home#/security_credentials",["Open IAM \u2192 your user \u2192 Security credentials.","Create a NEW access key (you see its secret once \u2014 keep it only in the vault).","Mark the old key Inactive before deleting it."]),"gcp-api-key":T("Google Cloud","https://console.cloud.google.com/apis/credentials",["Open APIs & Services \u2192 Credentials.","Pick the key \u2192 Regenerate key (or create a new one and restrict it to the APIs you use)."]),"gcp-service-account":T("Google Cloud (service account)","https://console.cloud.google.com/iam-admin/serviceaccounts",["Open IAM & Admin \u2192 Service accounts \u2192 the account \u2192 Keys.","Add key \u2192 Create new key (JSON). Keep the file out of Git and out of shared folders."]),"firebase-key":T("Firebase / Google Cloud","https://console.cloud.google.com/apis/credentials",["A Firebase web key is meant to be public \u2014 restrict it instead: Credentials \u2192 the key \u2192 Application restrictions (your domains only).","If it is not a web key, regenerate it."]),"github-token":T("GitHub","https://github.com/settings/tokens",["Open Settings \u2192 Developer settings \u2192 Personal access tokens.","Generate a new token with only the scopes you need."]),"github-fine-grained":T("GitHub","https://github.com/settings/tokens?type=beta",["Open Fine-grained tokens.","Regenerate the token (or create a new one for only the repositories you need)."]),"gitlab-token":T("GitLab","https://gitlab.com/-/user_settings/personal_access_tokens",["Open Access tokens.","Create a new token with only the scopes you need."]),"stripe-secret":T("Stripe","https://dashboard.stripe.com/apikeys",["Open Developers \u2192 API keys.","Roll the secret key (Stripe can keep the old one alive for a short overlap)."]),"stripe-restricted":T("Stripe","https://dashboard.stripe.com/apikeys",["Open Developers \u2192 API keys \u2192 Restricted keys.","Roll the key, or create a new restricted key."]),"slack-token":T("Slack","https://api.slack.com/apps",["Open your app \u2192 OAuth & Permissions.","Rotate / reinstall to get a new token."]),"slack-webhook":T("Slack","https://api.slack.com/apps",["Open your app \u2192 Incoming Webhooks.","Add a new webhook URL for the channel."]),"twilio-api-key":T("Twilio","https://console.twilio.com/us1/account/keys-credentials/api-keys",["Open Account \u2192 API keys & tokens.","Create a new API key."]),"sendgrid-api-key":T("SendGrid","https://app.sendgrid.com/settings/api_keys",["Open Settings \u2192 API Keys.","Create a new key with only the permissions you need."]),"openai-key":T("OpenAI","https://platform.openai.com/api-keys",["Open API keys.","Create a new secret key."]),"openai-project-key":T("OpenAI","https://platform.openai.com/api-keys",["Open API keys (per project).","Create a new secret key for the same project."]),"anthropic-key":T("Anthropic","https://console.anthropic.com/settings/keys",["Open Settings \u2192 API keys.","Create a new key."]),"supabase-key":T("Supabase","https://supabase.com/dashboard/project/_/settings/api-keys",["Open the project \u2192 Project Settings \u2192 API Keys.","Create a new SECRET key (a service_role / secret key bypasses every database rule \u2014 treat it like a root password).","Older projects with JWT keys: rotating the JWT secret replaces every key and signs everyone out \u2014 plan it."]),"supabase-access-token":T("Supabase (personal access token \u2014 reaches every project of the account)","https://supabase.com/dashboard/account/tokens",["Open Account \u2192 Access Tokens.","Revoke this token, then generate a new one only where it is needed (CLI, MCP) \u2014 prefer a read-only MCP."]),"supabase-secret-key":T("Supabase","https://supabase.com/dashboard/project/_/settings/api-keys",["Open the project \u2192 Project Settings \u2192 API Keys.","Create a new secret key, switch your servers to it, then delete this one."]),"postgres-uri":T("PostgreSQL (the password in the connection string)","https://supabase.com/dashboard/project/_/settings/database",["Change the database user's password: in Supabase \u2192 Project Settings \u2192 Database \u2192 Reset password; elsewhere, your host's console or ALTER USER \u2026 WITH PASSWORD.","Update the connection string with the new password."]),"mongodb-uri":T("MongoDB","https://cloud.mongodb.com/",["Open Atlas \u2192 Database Access \u2192 the user \u2192 Edit \u2192 Edit password.","Update the connection string."]),"redis-uri":T("Redis","",["Reset the password in your Redis host's console (or CONFIG SET requirepass on your own server).","Update the connection string."]),"private-key":T("Private key (SSH / TLS / signing)","",["Generate a new key pair.","Register the new PUBLIC key where the old one was trusted (server authorized_keys, certificate, service settings)."]),"jwt-secret":T("Your app's JWT secret","",["Set a new long random secret in the app's configuration.","Every signed-in user will be signed out \u2014 plan the moment."]),"password-in-code":T("A password in code","",["Change the password in the system it belongs to."]),"bearer-token":T("An access token","",["Revoke the token in the service that issued it and issue a new one."])},Xi=T("A credential","",["Find the service it belongs to and issue a new credential there."]);function en(e){return Gi[e]??Xi}var ef=768*1024*1024;var Zi=8*1024*1024;function Cr(e){return/\.ndc$/i.test(e)||/\.clean\.[A-Za-z0-9]+$/.test(e)||Yi(e)}function Yi(e){return/(^|[\\/])\.nodata[\\/]/.test(e)}import{existsSync as Ji,mkdirSync as dp,readFileSync as qi,statSync as tn,writeFileSync as up}from"node:fs";import{homedir as Qi}from"node:os";import{join as ea}from"node:path";var ta=()=>ea(Qi(),".nodata","flagged.json");var Pr="unread";function Lr(e){let t=e.replace(/\\/g,"/");return process.platform==="win32"?t.toLowerCase():t}var Te=null;function Nr(){let e=ta();try{if(!Ji(e))return{};let t=tn(e).mtimeMs;if(Te&&Te.path===e&&Te.mtimeMs===t)return Te.store;let r=JSON.parse(qi(e,"utf8"));return Te={path:e,mtimeMs:t,store:r},r}catch{return{}}}function tt(e){let t=Nr()[Lr(e)];if(!t)return null;try{if(tn(e).mtimeMs>t.mtimeMs+1e3)return null}catch{return null}let r=Object.fromEntries(Object.entries(t.kinds).filter(([n])=>n!==Pr));return Object.keys(r).length?r:null}function nt(e){let t=Nr()[Lr(e)];if(!t||!t.kinds[Pr])return null;try{return{changed:tn(e).mtimeMs>t.mtimeMs+1e3}}catch{return null}}import{existsSync as Or,mkdirSync as gp,readFileSync as Dr,writeFileSync as yp}from"node:fs";import{homedir as na}from"node:os";import{join as ra}from"node:path";var rt=()=>ra(na(),".nodata","prefs.json");function sa(){try{let e=Or(rt())?JSON.parse(Dr(rt(),"utf8")).lang:null;return e==="he"||e==="en"?e:null}catch{return null}}function oa(){let t=process.env.LC_ALL||process.env.LC_MESSAGES||process.env.LANG||"";try{t||=Intl.DateTimeFormat().resolvedOptions().locale}catch{}return/^(he|iw)(?:[-_.@]|$)/i.test(t)?"he":"en"}function ee(){return sa()??oa()}function Fr(){try{return Or(rt())&&JSON.parse(Dr(rt(),"utf8")).amounts_sensitive===!0}catch{return!1}}function R(e,t,r=ee()){return r==="he"?e:t}import{createHmac as Xr,randomBytes as xa}from"node:crypto";import{existsSync as ut,mkdirSync as wa,readdirSync as ka,readFileSync as on,writeFileSync as va}from"node:fs";import{homedir as pt}from"node:os";import{basename as Sa,extname as Ea,isAbsolute as Aa,join as ht,relative as $a,resolve as Ra}from"node:path";function ce(e){return typeof e=="number"&&Number.isFinite(e)?e:typeof e=="string"&&e.trim()!==""&&!Number.isNaN(Number(e))?Number(e):null}function ia(e,t,r){return t===null||r===null?!1:t<=r?e>=t&&e<=r:e>=t||e<=r}function Mr(e,t,r){switch(t){case"eq":return e===r;case"ne":return e!==r;case"in":return Array.isArray(r)&&r.includes(e);case"not_in":return Array.isArray(r)&&!r.includes(e);case"prefix":return typeof e=="string"&&typeof r=="string"&&e.toLowerCase().startsWith(r.toLowerCase());case"gte":{let n=ce(e),s=ce(r);return n!==null&&s!==null&&n>=s}case"lte":{let n=ce(e),s=ce(r);return n!==null&&s!==null&&n<=s}case"between":{let n=ce(e);return n!==null&&Array.isArray(r)&&r.length===2&&ia(n,ce(r[0]),ce(r[1]))}default:return!1}}function jr(e,t,r){switch(t){case"in":return Array.isArray(r)&&e.some(n=>r.includes(n));case"not_in":return Array.isArray(r)&&!e.some(n=>r.includes(n));default:return!1}}import{existsSync as st,mkdirSync as vp,readdirSync as Hr,readFileSync as aa,rmSync as Sp,writeFileSync as Ep,chmodSync as Ap}from"node:fs";import{homedir as Ur}from"node:os";import{basename as Ip,isAbsolute as ca,join as le,relative as la,resolve as da}from"node:path";var at=()=>le(Ur(),".nodata"),ua=()=>le(at(),"credentials.json"),ot=()=>le(at(),"orgs"),fa=()=>le(at(),"bindings.json"),pa=/^[A-Za-z0-9_.-]{1,80}$/,nn=e=>pa.test(e)&&e!=="."&&e!=="..";function Br(e){try{return st(e)?JSON.parse(aa(e,"utf8")):null}catch{return null}}function ha(e){return e?e.device?.org_id?e.device.org_id:e.api_key?`key-${(e.key_prefix??e.api_key.slice(0,12)).replace(/[^A-Za-z0-9_-]/g,"")}`:null:null}function zr(){return ha(Br(ua()))}function rn(){let e=[],t=zr();t&&e.push(t);try{for(let r of Hr(ot()))nn(r)&&!e.includes(r)&&st(le(ot(),r,"credentials.json"))&&e.push(r)}catch{}return e}var ma=e=>process.platform==="win32"||process.platform==="darwin"?e.toLowerCase():e,it=e=>ma(da(e.replace(/^~(?=[\\/]|$)/,Ur())));function ga(e,t){let r=la(it(e),it(t));return r===""||!r.startsWith("..")&&!ca(r)}function te(){let e=Br(fa());return(Array.isArray(e?.bindings)?e.bindings:[]).filter(r=>!!r&&typeof r.folder=="string"&&typeof r.org_id=="string"&&nn(r.org_id)).map(r=>r.project===void 0||_a(r.project)===r.project?r:{...r,project:void 0}).map(r=>r.client===void 0||typeof r.client?.org_id=="string"&&ya.test(r.client.org_id)?r:{...r,client:void 0})}var ya=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function Wr(e,t=te()){let r=null;for(let n of t)ga(n.folder,e)&&(!r||it(n.folder).length>it(r.folder).length)&&(r=n);return r}function ba(e,t=rn(),r=te()){if(t.length===0)return{kind:"none"};let n=Wr(e,r.filter(s=>t.includes(s.org_id)));return n?{kind:"bound",org_id:n.org_id,folder:n.folder}:t.length===1?{kind:"only",org_id:t[0]}:{kind:"unbound",orgs:t}}function ct(e){let t=ba(e);return t.kind==="bound"||t.kind==="only"?t.org_id:null}function _a(e){if(typeof e!="string")return null;let t=e.trim();return t&&t.length<=120&&!/[\u0000-\u001f\\/]/.test(t)?t:null}function lt(){let e=[],t=le(at(),"org-mandate.json");st(t)&&e.push({owner:zr(),file:t});try{for(let r of Hr(ot())){let n=le(ot(),r,"org-mandate.json");nn(r)&&st(n)&&e.push({owner:r,file:n})}}catch{}return e}function dt(e,t,r=te()){if(!e)return!0;let n=Wr(t,r);return!n||n.org_id===e}var Vr=()=>ht(pt(),".nodata","rules.json"),Ce=()=>ht(pt(),".nodata","rules-key"),de={allow:0,ask:1,clean_copy:2,deny:3},Ia=["claude-code","cursor","windsurf","codex","gemini","vscode","claude-desktop"],sn=e=>typeof e=="string"&&e.trim()?e.trim().toLowerCase():void 0,Ta={action:{cardinality:"scalar",ops:["eq","ne","in","not_in"],enumValues:["read","search","run","write","browse","interact"],label:"what the agent does (read, search, run, write; on a site: browse, interact)",extract:e=>e.action},"time.hour":{cardinality:"scalar",ops:["between","gte","lte","eq"],label:"hour on this computer (0-23; 18..6 wraps overnight)",extract:e=>e.now.getHours()},"time.weekday":{cardinality:"scalar",ops:["in","not_in","between","eq"],label:"weekday on this computer (0 Sunday \u2026 6 Saturday)",extract:e=>e.now.getDay()},"file.ext":{cardinality:"scalar",ops:["eq","ne","in","not_in"],label:"file type (.xlsx, .pdf, .env \u2026)",extract:e=>Ea(e.path).toLowerCase()||void 0},"file.name":{cardinality:"scalar",ops:["eq","in","prefix"],label:"file name",extract:e=>Sa(e.path).toLowerCase()},agent:{cardinality:"scalar",ops:["eq","ne","in","not_in"],agentScope:!0,label:`which agent (${Ia.join(", ")} \u2026)`,extract:e=>sn(e.who?.host)},"agent.type":{cardinality:"scalar",ops:["eq","ne","in","not_in"],agentScope:!0,label:"sub-agent type inside the agent (main = the main conversation; general-purpose, explore \u2026)",extract:e=>sn(e.who?.type)},org:{cardinality:"scalar",ops:["eq","ne","in","not_in"],agentScope:!0,label:"which organisation the agent works for (the one its folder is bound to)",extract:e=>sn(e.who?.org)}};function Kr(){try{if(ut(Ce())){let t=on(Ce(),"utf8").trim();if(/^[0-9a-f]{64}$/.test(t))return Buffer.from(t,"hex")}}catch{}let e=xa(32);return wa(ht(pt(),".nodata"),{recursive:!0}),va(Ce(),e.toString("hex")+`
|
|
44
|
+
`,{mode:384}),e}var Ca=(e,t)=>Xr("sha256",t).update(JSON.stringify(e)).digest("hex");function Zr(e,t){return Xr("sha256",Kr()).update(e).update("\0").update(JSON.stringify(t)).digest("hex")}function Yr(e,t,r){return ut(Ce())&&typeof r=="string"&&r===Zr(e,t)}function an(){if(!ut(Vr()))return{rules:[],tampered:!1};try{let e=JSON.parse(on(Vr(),"utf8")),t=Array.isArray(e.rules)?e.rules:[],r=ut(Ce())&&typeof e.mac=="string"&&e.mac===Ca(t,Kr());return{rules:t,tampered:!r}}catch{return{rules:[],tampered:!0}}}var Pe=e=>{let t=Ra(e.replace(/^~(?=[\\/]|$)/,pt())).replace(/\\/g,"/");return process.platform==="win32"?t.toLowerCase():t};function Z(e,t){if(Gr(e)||Gr(t))return!1;if(e.startsWith("**/")){let n=e.slice(3).replace(/\\/g,"/").replace(/\/+$/,"").toLowerCase(),s=Pe(t).toLowerCase();return s.endsWith("/"+n)||s.includes("/"+n+"/")}let r=$a(Pe(e),Pe(t));return r===""||!r.startsWith("..")&&!Aa(r)}var Pa="site:",Gr=e=>e.startsWith(Pa);function cn(e){try{let t=new URL(e.trim());return(t.protocol==="http:"||t.protocol==="https:")&&t.hostname.toLowerCase().replace(/\.$/,"")||null}catch{return null}}function ln(e,t){return e==="*"?!0:t===e||t.endsWith("."+e)}function ft(e,t,r){let n=Ta[e.field];if(!n)return!1;let s=n.extract(t);return n.agentScope&&s===void 0?r!=="allow":e.op==="exists"?s!==void 0&&s!=="":s===void 0?!1:n.cardinality==="set"?jr(Array.isArray(s)?s:[],e.op,e.value):Mr(s,e.op,e.value)}function mt(e,t){let r=e.map((n,s)=>({rule:n,n:s+1})).filter(n=>Z(n.rule.path,t.path)).sort((n,s)=>Pe(s.rule.path).length-Pe(n.rule.path).length||n.n-s.n);for(let n of r)if((n.rule.when??[]).every(s=>ft(s,t,n.rule.effect)))return{...n,touched:t.path};return null}function gt(e,t,r,n,s){let o=null;for(let[i,a]of e.entries())Z(a.path,t)||(a.path.startsWith("**/")?!La(t,a.path):!Z(t,a.path))||(a.when??[]).every(c=>ft(c,{action:r,path:a.path,now:n,who:s},a.effect))&&(!o||de[a.effect]>de[o.rule.effect])&&(o={rule:a,n:i+1,touched:a.path});return o}function dn(e,t){let r=o=>o==="*"?0:o.length,n=t.site,s=e.map((o,i)=>({rule:o,n:i+1})).filter(o=>o.rule.site&&(n===void 0||ln(o.rule.site,n))).sort((o,i)=>r(i.rule.site)-r(o.rule.site)||o.n-i.n);if(n===void 0){let o=null;for(let i of s)i.rule.effect==="allow"||!(i.rule.when??[]).every(a=>ft(a,t,i.rule.effect))||(!o||de[i.rule.effect]>de[o.rule.effect])&&(o=i);return o?{...o,touched:""}:null}for(let o of s)if((o.rule.when??[]).every(i=>ft(i,t,o.rule.effect)))return{...o,touched:n};return null}function La(e,t){let r=0,n=(s,o)=>{if(o>5||r>4e3)return!1;let i;try{i=ka(s,{withFileTypes:!0})}catch{return!1}for(let a of i){if(++r>4e3||!a.isDirectory()||a.name==="node_modules"||a.name===".git")continue;let c=ht(s,a.name);if(Z(t,c)||n(c,o+1))return!0}return!1};return n(e,0)}var Na={allow:["allowed","\u05DE\u05D5\u05EA\u05E8"],ask:["ask the person","\u05DC\u05E9\u05D0\u05D5\u05DC \u05D0\u05D5\u05EA\u05DA"],clean_copy:["clean copy only","\u05E8\u05E7 \u05E2\u05D5\u05EA\u05E7 \u05E0\u05E7\u05D9"],deny:["not allowed","\u05D0\u05E1\u05D5\u05E8"]};function Jr(e,t=!1){return e.site?e.site==="*"?t?"\u05DB\u05DC \u05D0\u05EA\u05E8":"every site":`${t?"\u05D0\u05EA\u05E8":"site"} ${e.site}`:e.path}var qr=(e,t=!1)=>Na[e][t?1:0];function un(){let e=[];for(let{owner:t,file:r}of lt())try{let n=JSON.parse(on(r,"utf8"));Array.isArray(n?.folder_rules)&&n.folder_rules.length&&e.push({owner:t,rules:n.folder_rules})}catch{}return e}function Qr(){let e=rn();return e.length<2?[]:te().filter(t=>e.includes(t.org_id)).map(t=>({path:t.folder,effect:"deny",when:[{field:"org",op:"ne",value:t.org_id.toLowerCase()}],note:`works for organisation ${t.org_id}; another organisation's agent does not touch it`}))}import{closeSync as Oa,mkdirSync as Da,openSync as Fa,readdirSync as Ma,readFileSync as ja,rmSync as Ha,statSync as Ua,writeSync as Ba}from"node:fs";import{createHash as za}from"node:crypto";import{homedir as Wa}from"node:os";import{join as fn}from"node:path";var Va=()=>fn(Wa(),".nodata","gate-calls"),Ga=5e3,Xa=600*1e3;function Ka(e){try{let t=Date.now();for(let r of Ma(e)){let n=fn(e,r);t-Ua(n).mtimeMs>Xa&&Ha(n,{force:!0})}}catch{}}async function pn(e,t,r){if(!e)return{value:r(),first:!0};let n=Va(),s=fn(n,za("sha256").update(`${t}\0${e}`).digest("hex").slice(0,32)+".json"),o;try{Da(n,{recursive:!0,mode:448}),o=Fa(s,"wx",384)}catch{let a=Date.now()+Ga;for(;Date.now()<a;){try{let c=ja(s,"utf8");if(c)return{value:JSON.parse(c),first:!1}}catch{}await new Promise(c=>setTimeout(c,40))}return{value:r(),first:!0}}let i=r();try{Ba(o,JSON.stringify(i??null))}finally{Oa(o)}return Math.random()<.05&&Ka(n),{value:i,first:!0}}import{createHash as Za}from"node:crypto";import{existsSync as Ya,mkdirSync as Ja,readFileSync as ts,writeFileSync as qa}from"node:fs";import{homedir as mn}from"node:os";import{join as gn}from"node:path";var ns=()=>gn(mn(),".nodata","checkpoints.json"),es=()=>gn(mn(),".nodata","connection.json"),Qa=900*1e3,ec=300*1e3,tc=100;function hn(e){return Array.isArray(e)?e.map(hn):e&&typeof e=="object"?Object.fromEntries(Object.keys(e).sort().map(t=>[t,hn(e[t])])):e}function yn(e,t,r,n){return Za("sha256").update(JSON.stringify([e,t,r,hn(n)])).digest("hex").slice(0,12)}var nc=/^(element|selector|ref|uid|target|name|label|button|key|role|title|description|link|url|href|uri|startUrl|start_url|page_url)$/i;function bn(e){let t=[];for(let[r,n]of Object.entries(e)){if(!nc.test(r)||typeof n!="string"&&typeof n!="number")continue;let s=String(n);if(/^https?:\/\//i.test(s))try{let o=new URL(s);s=`${o.origin}${o.pathname}`}catch{continue}if(t.push(`${r}: ${s.replace(/[\r\n]+/g," ").slice(0,120)}`),t.length>=4)break}return t.join(" \xB7 ").slice(0,300)}function rs(){try{let e=JSON.parse(ts(ns(),"utf8")),t=Date.now(),r={};for(let[n,s]of Object.entries(e??{})){if(!s||typeof s.at!="number")continue;(s.passed_at?t-s.passed_at<ec:t-s.at<Qa)&&(r[n]=s)}return r}catch{return{}}}function ss(e){let t=Object.entries(e).sort((r,n)=>n[1].at-r[1].at).slice(0,tc);Ja(gn(mn(),".nodata"),{recursive:!0}),qa(ns(),JSON.stringify(Object.fromEntries(t))+`
|
|
45
|
+
`,{mode:384})}function _n(e){try{let t=rs(),r=t[e.id];t[e.id]={...r,...e,at:r&&!r.passed_at?r.at:Date.now()},ss(t)}catch{}}function xn(e){try{let t=rs();return t[e]?.passed_at?(delete t[e],ss(t),!0):!1}catch{return!1}}function wn(){try{if(!Ya(es()))return!1;let e=JSON.parse(ts(es(),"utf8")).state;return e==="connected"||e==="reconnecting"||e==="restart"}catch{return!1}}var S=(e,t,r)=>e==="he"?t:r,os={safe:0,review:1,destructive:2},is=(e,t)=>os[t]>os[e]?t:e;function rc(e){let t=e.replace(/\/\*[\s\S]*?\*\//g," ");return t=t.replace(/--[^\n]*/g," "),t=t.replace(/\$([A-Za-z_]*)\$[\s\S]*?\$\1\$/g," $$body$$ "),t.split(";").map(r=>r.replace(/\s+/g," ").trim()).filter(Boolean)}var K='("?[\\w.]+"?)',v=e=>e.replace(/"/g,"").replace(/^public\./i,"");function sc(e,t,r=!1){let n=[],s=[],o=[],i=[],a=new Set,c=new Set,l=new Set,f=new Map;for(let p of rc(e)){let g=p.toUpperCase(),u;if(u=p.match(new RegExp(`^CREATE (?:UNLOGGED )?TABLE (?:IF NOT EXISTS )?${K}`,"i"))){a.add(v(u[1]).toLowerCase()),o.push(S(t,`\u05D8\u05D1\u05DC\u05D4 \u05D7\u05D3\u05E9\u05D4 ${v(u[1])}`,`new table ${v(u[1])}`));continue}if(u=p.match(new RegExp(`^DROP TABLE (?:IF EXISTS )?${K}`,"i"))){n.push(S(t,`\u05DE\u05D5\u05D7\u05E7 \u05D0\u05EA \u05D4\u05D8\u05D1\u05DC\u05D4 ${v(u[1])} \u05D5\u05DB\u05DC \u05D4\u05E9\u05D5\u05E8\u05D5\u05EA \u05E9\u05D1\u05D4`,`deletes table ${v(u[1])} and every row in it`));continue}if(/^TRUNCATE/i.test(p)){n.push(S(t,"\u05DE\u05E8\u05D5\u05E7\u05DF \u05D8\u05D1\u05DC\u05D4 (TRUNCATE): \u05DB\u05DC \u05D4\u05E9\u05D5\u05E8\u05D5\u05EA \u05E0\u05DE\u05D7\u05E7\u05D5\u05EA","empties a table (TRUNCATE): every row is deleted"));continue}if(u=p.match(new RegExp(`^ALTER TABLE (?:IF EXISTS )?(?:ONLY )?${K} (.*)$`,"i"))){let y=v(u[1]),m=u[2];for(let b of m.matchAll(/DROP COLUMN (?:IF EXISTS )?("?[\w]+"?)/gi))n.push(S(t,`\u05DE\u05D5\u05D7\u05E7 \u05D0\u05EA \u05D4\u05E2\u05DE\u05D5\u05D3\u05D4 ${y}.${v(b[1])} \u05D5\u05D4\u05DE\u05D9\u05D3\u05E2 \u05E9\u05D1\u05D4`,`deletes column ${y}.${v(b[1])} and its data`));for(let b of m.matchAll(/ADD COLUMN (?:IF NOT EXISTS )?("?[\w]+"?)\s+([^,]*)/gi)){let E=/NOT NULL/i.test(b[2])&&!/DEFAULT/i.test(b[2])&&!a.has(y.toLowerCase());(E?s:o).push(E?S(t,`\u05E2\u05DE\u05D5\u05D3\u05D4 \u05D7\u05D3\u05E9\u05D4 ${y}.${v(b[1])} \u05D7\u05D5\u05D1\u05D4 \u05D5\u05D1\u05DC\u05D9 \u05D1\u05E8\u05D9\u05E8\u05EA \u05DE\u05D7\u05D3\u05DC: \u05D9\u05D9\u05DB\u05E9\u05DC \u05D0\u05DD \u05D9\u05E9 \u05DB\u05D1\u05E8 \u05E9\u05D5\u05E8\u05D5\u05EA`,`new required column ${y}.${v(b[1])} with no default: fails if rows exist`):S(t,`\u05E2\u05DE\u05D5\u05D3\u05D4 \u05D7\u05D3\u05E9\u05D4 ${y}.${v(b[1])}`,`new column ${y}.${v(b[1])}`))}for(let b of m.matchAll(/ALTER COLUMN ("?[\w]+"?) (?:SET DATA )?TYPE/gi))s.push(S(t,`\u05DE\u05E9\u05E0\u05D4 \u05D0\u05EA \u05D4\u05E1\u05D5\u05D2 \u05E9\u05DC ${y}.${v(b[1])}: \u05DE\u05D9\u05D3\u05E2 \u05E7\u05D9\u05D9\u05DD \u05DE\u05D5\u05DE\u05E8`,`changes the type of ${y}.${v(b[1])}: existing data is converted`));for(let b of m.matchAll(/RENAME (?:COLUMN )?("?[\w]+"?) TO ("?[\w]+"?)/gi))s.push(S(t,`\u05DE\u05E9\u05E0\u05D4 \u05E9\u05DD ${y}.${v(b[1])} \u05DC-${v(b[2])}: \u05E7\u05D5\u05D3 \u05E9\u05DE\u05E9\u05EA\u05DE\u05E9 \u05D1\u05E9\u05DD \u05D4\u05D9\u05E9\u05DF \u05D9\u05D9\u05E9\u05D1\u05E8`,`renames ${y}.${v(b[1])} to ${v(b[2])}: code using the old name breaks`));/DISABLE ROW LEVEL SECURITY/i.test(m)&&n.push(S(t,`\u05DE\u05DB\u05D1\u05D4 \u05D0\u05EA \u05D4\u05D4\u05D2\u05E0\u05D4 \u05E2\u05DC \u05D4\u05E9\u05D5\u05E8\u05D5\u05EA (RLS) \u05D1\u05D8\u05D1\u05DC\u05D4 ${y}: \u05DB\u05DC \u05DE\u05D9 \u05E9\u05DE\u05D7\u05D5\u05D1\u05E8 \u05E8\u05D5\u05D0\u05D4 \u05D4\u05DB\u05DC`,`turns off row security (RLS) on ${y}: anyone connected sees everything`)),/ENABLE ROW LEVEL SECURITY/i.test(m)&&o.push(S(t,`\u05DE\u05D3\u05DC\u05D9\u05E7 \u05D4\u05D2\u05E0\u05D4 \u05E2\u05DC \u05D4\u05E9\u05D5\u05E8\u05D5\u05EA (RLS) \u05D1\u05D8\u05D1\u05DC\u05D4 ${y}`,`turns on row security (RLS) on ${y}`));let _=y.toLowerCase();/DROP CONSTRAINT/i.test(m)&&f.set(_,{table:y,drop:!0,add:f.get(_)?.add??!1}),/ADD CONSTRAINT/i.test(m)&&f.set(_,{table:y,drop:f.get(_)?.drop??!1,add:!0});continue}if(u=p.match(new RegExp(`^DELETE FROM (?:ONLY )?${K}(.*)$`,"i"))){let y=/\bWHERE\b/i.test(u[2]);(y?s:n).push(y?S(t,`\u05DE\u05D5\u05D7\u05E7 \u05E9\u05D5\u05E8\u05D5\u05EA \u05DE\u05D4\u05D8\u05D1\u05DC\u05D4 ${v(u[1])} (\u05DC\u05E4\u05D9 \u05EA\u05E0\u05D0\u05D9)`,`deletes rows from ${v(u[1])} (by a condition)`):S(t,`\u05DE\u05D5\u05D7\u05E7 \u05D0\u05EA \u05DB\u05DC \u05D4\u05E9\u05D5\u05E8\u05D5\u05EA \u05D1\u05D8\u05D1\u05DC\u05D4 ${v(u[1])}`,`deletes every row in ${v(u[1])}`));continue}if(u=p.match(new RegExp(`^UPDATE (?:ONLY )?${K}(.*)$`,"i"))){let y=/\bWHERE\b/i.test(u[2]);(y?s:n).push(y?S(t,`\u05DE\u05E9\u05E0\u05D4 \u05E9\u05D5\u05E8\u05D5\u05EA \u05E7\u05D9\u05D9\u05DE\u05D5\u05EA \u05D1\u05D8\u05D1\u05DC\u05D4 ${v(u[1])} (\u05DC\u05E4\u05D9 \u05EA\u05E0\u05D0\u05D9)`,`changes existing rows in ${v(u[1])} (by a condition)`):S(t,`\u05DE\u05E9\u05E0\u05D4 \u05D0\u05EA \u05DB\u05DC \u05D4\u05E9\u05D5\u05E8\u05D5\u05EA \u05D1\u05D8\u05D1\u05DC\u05D4 ${v(u[1])}`,`changes every row in ${v(u[1])}`));continue}if(u=p.match(new RegExp(`^INSERT INTO ${K}`,"i"))){i.push(S(t,`\u05DE\u05D5\u05E1\u05D9\u05E3 \u05E9\u05D5\u05E8\u05D5\u05EA \u05DC\u05D8\u05D1\u05DC\u05D4 ${v(u[1])}`,`adds rows to ${v(u[1])}`));continue}if(u=p.match(new RegExp(`^DROP POLICY (?:IF EXISTS )?("[^"]+"|\\S+) ON ${K}`,"i"))){c.add(v(u[2]).toLowerCase());continue}if(u=p.match(new RegExp(`^CREATE POLICY ("[^"]+"|\\S+) ON ${K}`,"i"))){l.add(v(u[2]).toLowerCase()),/\bTO (anon|public)\b/i.test(p)&&/USING \(\s*true\s*\)/i.test(p)&&s.push(S(t,`\u05DB\u05DC\u05DC \u05D2\u05D9\u05E9\u05D4 \u05D1-${v(u[2])} \u05E9\u05E4\u05D5\u05EA\u05D7 \u05D4\u05DB\u05DC \u05DC\u05D0\u05D5\u05E8\u05D7\u05D9\u05DD (anon)`,`an access rule on ${v(u[2])} that opens everything to guests (anon)`));continue}if((u=p.match(/^GRANT (.+) ON (?:TABLE |ALL TABLES IN SCHEMA )?(\S+) TO (.+)$/i))&&/\b(anon|public|authenticated)\b/i.test(u[3])){s.push(S(t,`\u05E0\u05D5\u05EA\u05DF \u05D4\u05E8\u05E9\u05D0\u05D4 (${u[1].trim()}) \u05E2\u05DC ${v(u[2])} \u05DC-${u[3].trim()}`,`grants ${u[1].trim()} on ${v(u[2])} to ${u[3].trim()}`));continue}if(u=p.match(new RegExp(`^DROP (FUNCTION|VIEW|TYPE|TRIGGER|INDEX)(?: IF EXISTS)? ${K}`,"i"))){s.push(S(t,`\u05DE\u05D5\u05D7\u05E7 ${u[1].toLowerCase()} ${v(u[2])}: \u05E7\u05D5\u05D3 \u05E9\u05DE\u05E9\u05EA\u05DE\u05E9 \u05D1\u05D5 \u05D9\u05D9\u05E9\u05D1\u05E8`,`drops ${u[1].toLowerCase()} ${v(u[2])}: code using it breaks`));continue}if(u=p.match(new RegExp(`^CREATE (?:UNIQUE )?INDEX (?:CONCURRENTLY )?(?:IF NOT EXISTS )?\\S+ ON (?:ONLY )?${K}`,"i"))){o.push(S(t,`\u05D0\u05D9\u05E0\u05D3\u05E7\u05E1 \u05E2\u05DC ${v(u[1])}`,`index on ${v(u[1])}`));continue}if(/^CREATE (OR REPLACE )?(FUNCTION|PROCEDURE)/i.test(p)){let y=p.match(/(?:FUNCTION|PROCEDURE) ("?[\w.]+"?)/i)?.[1];(/SECURITY DEFINER/i.test(g)?s:o).push(/SECURITY DEFINER/i.test(g)?S(t,`\u05E4\u05D5\u05E0\u05E7\u05E6\u05D9\u05D4 ${v(y??"")} \u05E9\u05E8\u05E6\u05D4 \u05D1\u05D4\u05E8\u05E9\u05D0\u05D5\u05EA \u05E9\u05DC \u05D4\u05D1\u05E2\u05DC\u05D9\u05DD (SECURITY DEFINER)`,`function ${v(y??"")} that runs with its owner's rights (SECURITY DEFINER)`):S(t,`\u05E4\u05D5\u05E0\u05E7\u05E6\u05D9\u05D4 ${v(y??"")}`,`function ${v(y??"")}`));continue}/^CREATE (OR REPLACE )?(VIEW|TRIGGER|TYPE|SCHEMA|EXTENSION)/i.test(p)&&o.push(S(t,p.split(" ").slice(0,4).join(" ").toLowerCase(),p.split(" ").slice(0,4).join(" ").toLowerCase()))}for(let p of c)l.has(p)||s.push(S(t,`\u05DE\u05D5\u05D7\u05E7 \u05DB\u05DC\u05DC \u05D2\u05D9\u05E9\u05D4 \u05D1\u05D8\u05D1\u05DC\u05D4 ${p} \u05D1\u05DC\u05D9 \u05DC\u05D9\u05E6\u05D5\u05E8 \u05D7\u05D3\u05E9`,`drops an access rule on ${p} without creating a new one`));c.size&&[...c].every(p=>l.has(p))&&o.push(S(t,`\u05DE\u05D7\u05DC\u05D9\u05E3 \u05DB\u05DC\u05DC\u05D9 \u05D2\u05D9\u05E9\u05D4 (${[...c].join(", ")})`,`replaces access rules (${[...c].join(", ")})`));for(let{table:p,drop:g,add:u}of f.values())s.push(g&&u?S(t,`\u05DE\u05D7\u05DC\u05D9\u05E3 \u05D0\u05D9\u05DC\u05D5\u05E5 \u05D1\u05D8\u05D1\u05DC\u05D4 ${p}: \u05D9\u05D9\u05DB\u05E9\u05DC \u05D0\u05DD \u05DE\u05D9\u05D3\u05E2 \u05E7\u05D9\u05D9\u05DD \u05DC\u05D0 \u05E2\u05D5\u05DE\u05D3 \u05D1\u05D7\u05D3\u05E9`,`replaces a constraint on ${p}: fails if existing data does not meet the new one`):g?S(t,`\u05DE\u05E1\u05D9\u05E8 \u05D0\u05D9\u05DC\u05D5\u05E5 \u05DE\u05D4\u05D8\u05D1\u05DC\u05D4 ${p}: \u05DE\u05D9\u05D3\u05E2 \u05DC\u05D0 \u05EA\u05E7\u05D9\u05DF \u05D9\u05D5\u05DB\u05DC \u05DC\u05D4\u05D9\u05DB\u05E0\u05E1`,`removes a constraint from ${p}: invalid data can get in`):S(t,`\u05DE\u05D5\u05E1\u05D9\u05E3 \u05D0\u05D9\u05DC\u05D5\u05E5 \u05DC\u05D8\u05D1\u05DC\u05D4 ${p}: \u05D9\u05D9\u05DB\u05E9\u05DC \u05D0\u05DD \u05DE\u05D9\u05D3\u05E2 \u05E7\u05D9\u05D9\u05DD \u05DC\u05D0 \u05E2\u05D5\u05DE\u05D3 \u05D1\u05D5`,`adds a constraint to ${p}: fails if existing data does not meet it`));r&&s.unshift(S(t,"\u05DE\u05E9\u05E0\u05D4 \u05E7\u05D5\u05D1\u05E5 \u05DE\u05D9\u05D2\u05E8\u05E6\u05D9\u05D4 \u05E7\u05D9\u05D9\u05DD: \u05D0\u05DD \u05D4\u05D5\u05D0 \u05DB\u05D1\u05E8 \u05D4\u05D5\u05E8\u05E5 \u05D1\u05E4\u05E8\u05D5\u05D3\u05E7\u05E9\u05DF, \u05D4\u05E9\u05D9\u05E0\u05D5\u05D9 \u05DC\u05D0 \u05D9\u05E8\u05D5\u05E5 \u05E9\u05D5\u05D1","edits an existing migration file: if it already ran in production, the change will not run again")),/--\s*Rollback/i.test(e)||s.push(S(t,"\u05D0\u05D9\u05DF \u05D4\u05E2\u05E8\u05EA Rollback (\u05D0\u05D9\u05DA \u05D7\u05D5\u05D6\u05E8\u05D9\u05DD \u05D0\u05D7\u05D5\u05E8\u05D4)","no Rollback note (how to undo it)"));let d="safe";s.length&&(d=is(d,"review")),n.length&&(d=is(d,"destructive"));let h=[...new Set([...n,...s,...i,...o])];return{risk:d,lines:h.length?h:[S(t,"\u05DC\u05D0 \u05D6\u05D5\u05D4\u05D5 \u05E4\u05E7\u05D5\u05D3\u05D5\u05EA \u05DE\u05D5\u05DB\u05E8\u05D5\u05EA \u05D1\u05E7\u05D5\u05D1\u05E5","no known statements found in the file")]}}function oc(e,t){let r=[],n="review",s=[...new Set([...e.matchAll(/secrets\.([A-Z0-9_]+)/g)].map(i=>i[1]).filter(i=>i!=="GITHUB_TOKEN"))];/\bpull_request_target\b/.test(e)&&(n="destructive",r.push(S(t,"\u05E8\u05E5 \u05E2\u05DC pull_request_target: \u05E7\u05D5\u05D3 \u05DE-PR \u05D6\u05E8 \u05D9\u05DB\u05D5\u05DC \u05DC\u05E8\u05D5\u05E5 \u05E2\u05DD \u05D4\u05E1\u05D5\u05D3\u05D5\u05EA","runs on pull_request_target: code from an outside PR can run with the secrets"))),s.length&&r.push(S(t,`\u05DE\u05E9\u05EA\u05DE\u05E9 \u05D1\u05E1\u05D5\u05D3\u05D5\u05EA: ${s.join(", ")}`,`uses secrets: ${s.join(", ")}`)),/permissions:\s*write-all|contents:\s*write/.test(e)&&r.push(S(t,"\u05DE\u05E7\u05D1\u05DC \u05D4\u05E8\u05E9\u05D0\u05EA \u05DB\u05EA\u05D9\u05D1\u05D4 \u05DC\u05E8\u05D9\u05E4\u05D5","gets write access to the repository"));let o=[...e.matchAll(/uses:\s*([^\s@#]+)@([^\s#]+)/g)].filter(i=>!/^[0-9a-f]{40}$/.test(i[2])&&!i[1].startsWith("./"));return o.length&&r.push(S(t,`${o.length} \u05E8\u05DB\u05D9\u05D1\u05D9\u05DD \u05D7\u05D9\u05E6\u05D5\u05E0\u05D9\u05D9\u05DD \u05DC\u05D0 \u05E0\u05E2\u05D5\u05DC\u05D9\u05DD \u05DC\u05D2\u05E8\u05E1\u05D4 \u05DE\u05D3\u05D5\u05D9\u05E7\u05EA`,`${o.length} outside actions not pinned to an exact version`)),r.length||r.push(S(t,"\u05E9\u05D9\u05E0\u05D5\u05D9 \u05D1-CI \u05D1\u05DC\u05D9 \u05E1\u05D5\u05D3\u05D5\u05EA \u05D5\u05D1\u05DC\u05D9 \u05D4\u05E8\u05E9\u05D0\u05D5\u05EA \u05DB\u05EA\u05D9\u05D1\u05D4","a CI change with no secrets and no write access")),{risk:n,lines:r}}function as(e,t,r,n){let s=e.replace(/\\/g,"/"),o=typeof t.content=="string"?t.content:typeof t.new_string=="string"?t.new_string:Array.isArray(t.edits)?t.edits.map(c=>typeof c?.new_string=="string"?c.new_string:"").join(`
|
|
46
|
+
`):null;if(o===null)return null;if(/\/migrations\/[^/]+\.sql$/i.test(s))return sc(o,r,n);if(/\/\.github\/workflows\/[^/]+\.ya?ml$/i.test(s))return oc(o,r);let i=o.split(`
|
|
47
47
|
`).length,a=typeof t.old_string=="string"?t.old_string.split(`
|
|
48
|
-
`).length:0;return{risk:"review",lines:[S(r,`${n?"\u05DE\u05E9\u05E0\u05D4":"\u05D9\u05D5\u05E6\u05E8"} \u05E7\u05D5\u05D1\u05E5: +${
|
|
49
|
-
`)}var qa=new Set([".csv",".tsv",".txt",".md",".json",".log",".xml",".sql",".yaml",".yml",".eml",...zt]),Qa=50*1024*1024,ns=8,ec={israeli_id:"Israeli ID",credit_card:"card",iban:"IBAN",israeli_phone:"phone",email:"email",secret:"secret"};function An(e){let t=bt(e).toLowerCase();return qa.has(us(t))||ge.test(t)}var ps=/^(reports|receipts)(\/|$)|^(prefs|consent|flagged|statusline-prev|key-backup|connection)\.json$|^(gate|status)\.mjs$|^(gate|answers)\.log$/i,tc=/\.nodata[\\/]+(device-key\.json|secrets\.json|credentials\.json|issuer-ed25519\.json|capsule\.json|capsule-key|shares|approvals|fabric-key\.json|machine-salt|pending-link\.json|api-shares\.json|secret-shares\.json|quarantine|bindings\.json|orgs)\b/i;function be(e){let t=_e(K(),".nodata").replace(/\\/g,"/").toLowerCase();if(!e.replace(/\\/g,"/").toLowerCase().startsWith(t+"/"))return!1;let n=e.replace(/\\/g,"/").slice(t.length+1);return n!==""&&!ps.test(n)}var nc=["~","$home","${home}","%userprofile%","$env:userprofile","${env:userprofile}","$env:home","%homedrive%%homepath%"],rc=/\.nodata(?=$|[\\/\s"'`|;&<>()])(?:[\\/]+([^\s"'`|;&<>()]*))?/gi,sc=/^\s*(ls|dir|tree|Get-ChildItem|gci)\b[^|;&]*$/i;function ic(e){let t=(e.split(/[\s"'`=(|;&<>]/).pop()??"").replace(/\\/g,"/").replace(/\/+$/,"").toLowerCase(),r=K().replace(/\\/g,"/").replace(/\/+$/,"").toLowerCase();return t===r||nc.includes(t)}function oc(e){if(tc.test(e))return!0;for(let t of e.matchAll(rc)){if(!ic(e.slice(0,t.index).replace(/[\\/]+$/,"")))continue;let r=(t[1]??"").replace(/\\/g,"/").replace(/\/+$/,"");if(r===""){if(!sc.test(e))return!0;continue}if(/[*?[\]{}]/.test(r)||!ps.test(r))return!0}return!1}var ne=e=>e.startsWith("mcp__"),$n=e=>/^mcp__.+__nodata_[a-z0-9_]+$/i.test(e),ac=/(path|file|dir|folder|root|uri|target|source|destination|cwd)/i,cc=/(write|edit|create|save|update|delete|remove|move|rename|append|put|upload|patch|insert|mkdir)/i,lc=/(search|grep|find|glob|list|tree|director|query)/i,rs=16;function _t(e){let t=e.split("__").slice(2).join("__");return cc.test(t)?"write":lc.test(t)?"search":"read"}function Le(e,t){let r=[],n=(i,o)=>{let a=i.trim();if(/^file:\/\//i.test(a))try{a=decodeURIComponent(new URL(a).pathname).replace(/^\/([a-zA-Z]:)/,"$1")}catch{return}else if(!(o||/^(~[\\/]|\/|[a-zA-Z]:[\\/])/.test(a)))return;if(!a||a.length>1024||/[\n\r]/.test(a)||/^[a-z][a-z0-9+.-]*:\/\//i.test(a))return;let c=D(t,a.replace(/^~(?=[\\/]|$)/,K()));!r.includes(c)&&r.length<rs&&r.push(c)},s=(i,o,a)=>{if(!(a>3||r.length>=rs)){if(typeof i=="string")n(i,ac.test(o));else if(Array.isArray(i))for(let c of i.slice(0,50))s(c,o,a+1);else if(i&&typeof i=="object")for(let[c,l]of Object.entries(i))s(l,c,a+1)}};return s(e,"",0),r}var xn=/(\.claude[\\/]+settings(\.local)?\.json|node_modules[\\/]+@nodatachat[\\/])/i,dc=/(>|\bsed\s+-i|\btee\b|\b(rm|del|erase|mv|move|cp|copy|ren|rename)\b|Set-Content|Add-Content|Out-File|Remove-Item|Move-Item|Copy-Item|Rename-Item|WriteAllText|writeFileSync|unlinkSync)/i;function uc(e,t,r){if(e==="Bash"||e==="PowerShell"){let s=typeof t.command=="string"?t.command:"";return xn.test(s)&&dc.test(s)}if(ne(e))return _t(e)==="write"&&Le(t,r).some(s=>xn.test(s.replace(/\\/g,"/")));let n=typeof t.file_path=="string"?t.file_path:typeof t.notebook_path=="string"?t.notebook_path:"";return n?xn.test((te(n)?n:D(r,n)).replace(/\\/g,"/")):!1}function fc(e){return An(e)||et(e)!==null||tt(e)!==null}var mt=class extends Error{};function pc(e){let t=us(e).toLowerCase(),r=En(e),n,s;if(t===".csv"||t===".tsv")s=r.toString("utf8"),n=Vt(s,t===".tsv"?" ":void 0).counts;else if(zt.has(t)){let o=t===".xlsx"||t===".xlsm"?Zt(r):null,a=Bt(r,t);if(!a&&!o)throw new mt;s=a?.text??"",n=o?o.counts:B(s).counts}else s=r.toString("utf8"),n=B(s).counts;let i=De.filter(o=>o.pattern.test(s)).length;return ge.test(bt(e).toLowerCase())&&(i=Math.max(i,Yt(s))),i&&(n.secret=Math.max(n.secret??0,i)),n}var hc={israeli_id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",credit_card:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9",iban:"IBAN",israeli_phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",email:'\u05D3\u05D5\u05D0"\u05DC',secret:"\u05E1\u05D5\u05D3",name:"\u05E9\u05DD",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",financial:"\u05DE\u05D9\u05D3\u05E2 \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",bank_account:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7",plate:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"};function hs(e){let t=Q()==="he",r=n=>(t?hc[n]:ec[n])??n;return Object.entries(e).sort((n,s)=>s[1]-n[1]).map(([n,s])=>`${s} ${n.startsWith("column:")?`${r(n.slice(7))} (${t?"\u05E2\u05DE\u05D5\u05D3\u05D4":"column"})`:r(n)}`).join(", ")}function mc(e){return hs(e)}function ms(e,t,r){let n=i=>te(i)?i:D(r,i),s=i=>{try{return yt(i).isFile()}catch{return!1}};if(e==="Read"&&typeof t.file_path=="string")return[n(t.file_path)];if(e==="Grep"&&typeof t.path=="string"&&s(n(t.path)))return[n(t.path)];if(ne(e))return _t(e)==="write"?[]:Le(t,r).filter(s).slice(0,ns);if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"){let i=t.command,o=[...[...i.matchAll(/"([^"]*)"/g)].map(c=>c[1]),...[...i.matchAll(/'([^']*)'/g)].map(c=>c[1]),...i.split(/[\s|;&<>(),=`]+/)],a=[];for(let c of o){let l=c.trim().replace(/^['"]|['"]$/g,"").replace(/\\\\/g,"\\").replace(/^~(?=[\\/])/,K()).replace(/^\/([a-zA-Z])\//,(d,h)=>process.platform==="win32"?`${h}:/`:d);if(!l)continue;let f=n(l);if(!(!An(l)&&!be(f)&&et(f)===null&&tt(f)===null)&&(s(f)&&!a.includes(f)&&a.push(f),a.length>=ns))break}return a}return[]}function z(e){return e.replace(/\\+/g,"/")}function gc(e){let t=e.trim();return/[;|&\n]|`|\$\(/.test(t.replace(/^cmd(?:\.exe)?\s+\/c\s+/i,""))?!1:/^(?:cmd(?:\.exe)?\s+\/c\s+)?(?:explorer(?:\.exe)?|start|invoke-item|ii|start-process|open|xdg-open)\b/i.test(t)}function ss(e,t){return`${z(e)}: ${t?T("\u05D4\u05E1\u05E8\u05D9\u05E7\u05D4 \u05D4\u05D0\u05D7\u05E8\u05D5\u05E0\u05D4 \u05DC\u05D0 \u05D4\u05E6\u05DC\u05D9\u05D7\u05D4 \u05DC\u05E7\u05E8\u05D5\u05D0 \u05D0\u05D5\u05EA\u05D5, \u05D5\u05D4\u05D5\u05D0 \u05D4\u05E9\u05EA\u05E0\u05D4 \u05DE\u05D0\u05D6 \u2014 \u05DC\u05D0 \u05E0\u05D1\u05D3\u05E7, \u05D4\u05EA\u05D9\u05D9\u05D7\u05E1 \u05D0\u05DC\u05D9\u05D5 \u05DB\u05E8\u05D2\u05D9\u05E9","your last scan could not read it, and it changed since \u2014 NOT checked, treat it as sensitive"):T("\u05D4\u05E1\u05E8\u05D9\u05E7\u05D4 \u05D4\u05D0\u05D7\u05E8\u05D5\u05E0\u05D4 \u05DC\u05D0 \u05D4\u05E6\u05DC\u05D9\u05D7\u05D4 \u05DC\u05E7\u05E8\u05D5\u05D0 \u05D0\u05D5\u05EA\u05D5 \u2014 \u05DC\u05D0 \u05E0\u05D1\u05D3\u05E7, \u05D4\u05EA\u05D9\u05D9\u05D7\u05E1 \u05D0\u05DC\u05D9\u05D5 \u05DB\u05E8\u05D2\u05D9\u05E9","your last scan could not read it \u2014 NOT checked, treat it as sensitive")}`}function gs(e,t,r){let n=[];if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"&&gc(t.command))return n;for(let s of ms(e,t,r)){if(!fc(s)||Ar(s)||!Sn(s))continue;let i=tt(s);if(!An(s)){let o=et(s);o?n.push({line:`${z(s)}: ${T("\u05E7\u05D5\u05D3 \u05E9\u05D4\u05E1\u05E8\u05D9\u05E7\u05D4 \u05D4\u05D0\u05D7\u05E8\u05D5\u05E0\u05D4 \u05E1\u05D9\u05DE\u05E0\u05D4","code your last scan flagged")} \u2014 ${mc(o)}`,kind:"flagged_code"}):i&&n.push({line:ss(s,i.changed),kind:"unread"});continue}try{if(yt(s).size>Qa)n.push({line:`${z(s)}: too large to check here (over 50 MB)`,kind:"too_large"});else{let o=pc(s);Object.keys(o).length?n.push({line:`${z(s)}: ${hs(o)}`,kind:"data_file"}):i&&!i.changed&&n.push({line:ss(s,!1),kind:"unread"})}}catch(o){n.push(o instanceof mt?{line:`${z(s)}: ${T("\u05DC\u05D0 \u05E0\u05D9\u05EA\u05DF \u05DC\u05E7\u05E8\u05D5\u05D0 \u05D0\u05EA \u05D4\u05D8\u05E7\u05E1\u05D8 (\u05E1\u05E8\u05D9\u05E7\u05D4, \u05D4\u05E6\u05E4\u05E0\u05D4 \u05D0\u05D5 \u05D2\u05D5\u05E4\u05DF \u05DC\u05D0 \u05E0\u05EA\u05DE\u05DA) \u2014 \u05DC\u05D0 \u05E0\u05D1\u05D3\u05E7, \u05D4\u05EA\u05D9\u05D9\u05D7\u05E1 \u05D0\u05DC\u05D9\u05D5 \u05DB\u05E8\u05D2\u05D9\u05E9","its text could not be read (a scan, encryption or an unsupported font) \u2014 NOT checked, treat it as sensitive")}`,kind:"unreadable"}:{line:`${z(s)}: could not be checked`,kind:"unreadable"})}}return n}var kn=/(?:\.aws[\\/]+credentials|\.npmrc|\.yarnrc\.yml|\.pypirc|[._]netrc|\.git-credentials|\.pgpass|\.docker[\\/]+config\.json|\.kube[\\/]+config|gh[\\/]+hosts\.yml|\.supabase[\\/]+access-token|application_default_credentials\.json|gcloud[\\/]+(?:credentials|access_tokens)\.db|\.azure[\\/]+(?:msal_token_cache|accessTokens)|com\.vercel\.cli[\\/]+auth\.json|\.ssh[\\/]+id_(?:rsa|ed25519|ecdsa|dsa)(?![\w.]))/i,gt=/(?:TOKEN|SECRET|PASSW(?:OR)?D|API_?KEY|PRIVATE_?KEY|ACCESS_?KEY|CREDENTIAL|SERVICE_ROLE|_KEY$)/i,ys="the vault's secrets, outside nodata_run's per-command approval",yc=/(?:^|[^\w.@-])(?:npx|pnpx|bunx|npm|pnpm|yarn|bun|node|nodejs|deno|nodata-mcp)(?:\.cmd|\.exe|\.ps1|\.js)?(?![\w-])[\s\S]*?(?<![\w-])secrets-(?:run|login|set|import|share)(?![\w-])/i;function bc(e){return yc.test(e)}var _c=[[/^(?:env|set|export\s+-p|declare\s+-x|get-childitem\s+env:\S*|gci\s+env:\S*|dir\s+env:\S*|ls\s+env:\S*)\s*$/i,"every environment variable"],[/^gh\s+auth\s+(?:token\b|status\b.*(?:\s-t\b|--show-token))/i,"the GitHub login token"],[/^gcloud\s+auth\s+(?:application-default\s+)?print-(?:access|identity)-token\b/i,"a Google Cloud access token"],[/^az\s+account\s+get-access-token\b/i,"an Azure access token"],[/^aws\s+(?:configure\s+(?:get\s+\S*(?:secret|token)\S*|export-credentials)|sts\s+get-session-token|ecr\s+get-login-password)\b/i,"AWS credentials"],[/^supabase\s+projects\s+api-keys\b/i,"the project's Supabase keys (incl. service_role)"],[/^heroku\s+auth:token\b/i,"the Heroku login token"],[/^op\s+(?:read|item\s+get)\b/i,"a 1Password secret"],[/^vault\s+(?:kv\s+get|read)\b/i,"a Vault secret"],[/^doppler\s+secrets\b/i,"Doppler secrets"],[/^security\s+find-(?:generic|internet)-password\b.*\s-w\b/i,"a keychain password"],[/^git\s+credential\s+fill\b/i,"a saved Git password"],[/^node\s+\S*nodata-pull\.mjs\b/i,ys],[/^kubectl\s+get\s+secrets?\b.*\s-o\b/i,"Kubernetes secrets"]],xc=/^(?:echo|printf|print|write-output|write-host|say)\b/i,bs=/^(?:cat|type|get-content|gc|more|less|head|tail|bat|nl|strings|xxd|od|hexdump|grep|egrep|rg|select-string|sls|awk|sed|jq|yq|python\d*|py|node|ruby|perl)\b/i,wc=/\$\{?env:([A-Za-z_][\w]*)|\$\{?([A-Za-z_][\w]*)|%([A-Za-z_][\w]*)%|GetEnvironmentVariable\(\s*['"]([^'"]+)['"]/g;function kc(e,t,r){let n=e==="Read"&&typeof t.file_path=="string"?t.file_path:e==="Grep"&&typeof t.path=="string"?t.path:"";if(n&&kn.test((te(n)?n:D(r,n)).replace(/\\/g,"/")))return`a saved login (${bt(n)})`;if(e!=="Bash"&&e!=="PowerShell"||typeof t.command!="string")return null;let s=t.command.split(/(\|\||&&|[;|\n])/);for(let i=0;i<s.length;i+=2){let o=s[i+1]==="|",a=s[i].trim().replace(/^(?:sudo\s+|cmd(?:\.exe)?\s+\/c\s+|powershell(?:\.exe)?\s+(?:-command\s+)?|pwsh\s+(?:-c(?:ommand)?\s+)?)+/i,"").replace(/^["']|["']$/g,"");if(bs.test(a)&&kn.test(a))return"a saved login file";if(bc(a))return ys;for(let[l,f]of _c)if(l.test(a))return f;let c=a.match(/^printenv(?:\s+(\S+))?\s*$/i);if(c&&(!c[1]||gt.test(c[1])))return c[1]?`the variable ${c[1]}`:"every environment variable";if(!o&&(xc.test(a)||/GetEnvironmentVariable/i.test(a)))for(let l of a.matchAll(wc)){let f=l[1]??l[2]??l[3]??l[4]??"";if(gt.test(f))return`the variable ${f}`}}return null}var _s=/^(?:grep|egrep|fgrep|rg|ag|ack|git\s+grep|findstr|select-string|sls)\b/i,vc=/(?:^|\s)(?:-[a-zA-Z]*[rR][a-zA-Z]*|--recursive|--dereference-recursive|\/s|-recurse)(?=\s|$)/i,Sc=new Set(["node_modules",".git",".next","dist","build",".venv","venv","__pycache__",".cache"]),is=4e3,Ec=5;function Ac(e){let t=0,r=0,n=(s,i)=>{if(i>Ec||t>is)return;let o;try{o=Ya(s,{withFileTypes:!0})}catch{return}for(let a of o){if(++t>is)return;let c=_e(s,a.name);a.isDirectory()?Sc.has(a.name)||n(c,i+1):(ge.test(a.name.toLowerCase())||kn.test(c.replace(/\\/g,"/"))||be(c))&&r++}};return n(e,0),r}var Pe=e=>{try{return yt(e).isDirectory()}catch{return!1}};function $c(e,t){let r=fs(D(t),D(e));return r===""||!r.startsWith("..")&&!te(r)}function Rc(e,t,r){let n=i=>D(r,i.replace(/^~(?=[\\/]|$)/,K())),s=[];if(e==="Grep"){let i=typeof t.path=="string"&&t.path?n(t.path):D(r);if(Pe(i)){let o=[t.pattern,t.glob,t.type].filter(a=>typeof a=="string").join(" ");s.push({roots:[i],bySecret:gt.test(o)||/\.env|env\b/i.test(String(t.glob??""))})}}else if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string")for(let i of t.command.split(/\|\||&&|[;|\n]/)){let o=i.trim().replace(/^(?:sudo\s+|xargs\s+(?:-\S+\s+)*)/i,"");if(!/^find\b.*-exec\s+(?:grep|egrep|rg|cat)\b/i.test(o)&&!(_s.test(o)&&(vc.test(o)||/^(?:rg|ag|ack|git\s+grep)\b/i.test(o))))continue;let l=o.split(/\s+/).slice(1).map(f=>f.replace(/^['"]|['"]$/g,"")).filter(f=>f&&!f.startsWith("-")&&!/^\/[a-z]$/i.test(f)).map(n).filter(Pe);s.push({roots:l.length?l:[D(r)],bySecret:gt.test(o)||/\.env\b/i.test(o)})}for(let i of s)for(let o of i.roots){if(!i.bySecret&&$c(o,r))continue;let a=Ac(o);if(a>0)return{why:i.bySecret?"by_name":"outside",root:o,keyFiles:a}}return null}var xs=new Set(["Write","Edit","MultiEdit","NotebookEdit"]),ht=e=>xs.has(e)||ne(e)&&_t(e)==="write";function Rn(e,t,r){let n=s=>D(r,s.replace(/^~(?=[\\/]|$)/,K()));if(e==="Read"&&typeof t.file_path=="string")return{action:"read",paths:[n(t.file_path)],roots:[]};if(xs.has(e)){let s=typeof t.file_path=="string"?t.file_path:typeof t.notebook_path=="string"?t.notebook_path:"";return s?{action:"write",paths:[n(s)],roots:[]}:null}if(e==="Grep"||e==="Glob"){let s=typeof t.path=="string"&&t.path?n(t.path):D(r);return{action:"search",paths:[s],roots:Pe(s)?[s]:[]}}if(ne(e)){let s=Le(t,r);if(!s.length)return null;let i=_t(e);return{action:i,paths:s,roots:i==="search"?s.filter(Pe):[]}}if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"){let s=t.command,o=[...[...s.matchAll(/"([^"]*)"/g)].map(l=>l[1]),...[...s.matchAll(/'([^']*)'/g)].map(l=>l[1]),...s.split(/[\s|;&<>(),=`]+/)].map(l=>l.trim()).filter(l=>l&&!l.startsWith("-")&&/[\\/.~]/.test(l)).filter(l=>e==="PowerShell"||!/^\\+$/.test(l)).map(n).filter(l=>Sn(l)),a=s.split(/\|\||&&|[;|\n]/).some(l=>_s.test(l.trim())||/^find\b/i.test(l.trim())),c=o.filter(Pe);return{action:a?"search":bs.test(s.trim())?"read":"run",paths:[D(r),...o],roots:a?c.length?c:[D(r)]:[]}}return null}var Tc=/(browser|playwright|puppeteer|chrome|chromium|stagehand|browserbase|selenium|webdriver)/i,Ic=/(click|type|fill|press|select|submit|hover|drag|drop|upload|form|key|input|check|scroll|evaluate|dialog|tap|act\b|execute)/i,Cc=/^(url|uri|href|link|address|page_?url|start_?url)$/i,ws=()=>_e(K(),".nodata","gate-sites.json"),Pc=720*60*1e3,Lc=50;function Nc(e,t){let r,n,s=(i,o,a)=>{if(!(a>3||r)){if(typeof i=="string"){let c=i.trim();if(!/^https?:\/\//i.test(c)||c.length>4096)return;Cc.test(o)?r=c:n??=c}else if(Array.isArray(i))for(let c of i.slice(0,50))s(c,o,a+1);else if(i&&typeof i=="object")for(let[c,l]of Object.entries(i))s(l,c,a+1)}};return s(e,"",0),r??(t?n:void 0)}function Tn(e,t){if(e==="WebFetch")return typeof t.url=="string"?{action:"browse",url:t.url}:null;if(!ne(e)||$n(e))return null;let r=e.split("__").slice(2).join("__"),n=Tc.test(e),s=Nc(t,n);return!s&&!n?null:{action:Ic.test(r)?"interact":"browse",...s?{url:s}:{}}}function ks(){try{let e=JSON.parse(En(ws(),"utf8")),t=Date.now(),r={};for(let[n,s]of Object.entries(e??{}))typeof s?.host=="string"&&typeof s.at=="number"&&t-s.at<Pc&&(r[n]={host:s.host,at:s.at});return r}catch{return{}}}function Oc(e){return e?ks()[e]?.host:void 0}function Dc(e,t,r,n){if(!e||t==="WebFetch")return;let s=Tn(t,r);if(!s)return;let i="";try{i=typeof n=="string"?n:JSON.stringify(n??"")}catch{}let o=/Page URL:\s*(https?:\/\/[^\s"\\]+)/i.exec(i)?.[1]??/"(?:url|pageUrl|page_url)"\s*:\s*"(https?:\/\/[^"\\]+)"/i.exec(i)?.[1],a=on(o??s.url??"");if(a)try{let c=ks();c[e]={host:a,at:Date.now()};let l=Object.entries(c).sort((f,d)=>d[1].at-f[1].at).slice(0,Lc);ds(_e(K(),".nodata"),{recursive:!0}),Ja(ws(),JSON.stringify(Object.fromEntries(l))+`
|
|
50
|
-
`,{mode:384})}catch{}}function Fc(e,t,r,n=new Date,s,i){let o=Tn(e,t);if(!o)return null;let a;if(o.url){let y=on(o.url);if(!y)return null;a=y}else a=Oc(i);let{rules:c,tampered:l}=sn(),f=ln(),d={allow:0,ask:1,clean_copy:2,deny:3},h={action:o.action,path:"",now:n,who:s,site:a},p=ee(),g=null;for(let{owner:y,rules:m}of f){if(!at(y,D(r),p))continue;let x=cn(m,h);x&&(!g||d[x.rule.effect]>d[g.rule.effect])&&(g={...x,org:!0})}let u=null;if(l){let y=c.find(m=>m.site&&(a===void 0||an(m.site,a)));y&&(u={rule:{...y,effect:"deny",when:[]},n:c.indexOf(y)+1,touched:a??"",tampered:!0})}else u=cn(c,h);return g&&(!u||d[g.rule.effect]>=d[u.rule.effect])?g:u}function os(e,t,r,n=new Date,s){let i=Rn(e,t,r);if(!i)return null;let{rules:o,tampered:a}=sn(),c=ln();if(!o.length&&!c.length)return null;let l={allow:0,ask:1,clean_copy:2,deny:3},f=ee(),d=null;for(let{owner:p,rules:g}of c){for(let u of i.paths){if(!at(p,u,f))continue;let y=ft(g,{action:i.action,path:u,now:n,who:s});y&&(!d||l[y.rule.effect]>l[d.rule.effect])&&(d={...y,org:!0})}for(let u of i.roots){if(!at(p,u,f))continue;let y=pt(g,u,i.action,n,s);y&&y.rule.effect!=="allow"&&(!d||l[y.rule.effect]>l[d.rule.effect])&&(d={...y,org:!0})}}let h=Mc(o,a,i,n,l,s);return d&&(!h||l[d.rule.effect]>=l[h.rule.effect])?d:h}function Mc(e,t,r,n,s,i){if(!e.length)return null;if(t){for(let a of r.paths){let c=e.find(l=>de(l.path,a)||de(a,l.path));if(c)return{rule:{...c,effect:"deny",when:[]},n:e.indexOf(c)+1,touched:a,tampered:!0}}return null}let o=null;for(let a of r.paths){let c=ft(e,{action:r.action,path:a,now:n,who:i});c&&(!o||s[c.rule.effect]>s[o.rule.effect])&&(o=c)}for(let a of r.roots){let c=pt(e,a,r.action,n,i);c&&c.rule.effect!=="allow"&&(!o||s[c.rule.effect]>s[o.rule.effect])&&(o=c)}return o}function jc(e){let t;try{t=typeof e=="string"?e:JSON.stringify(e??"")}catch{return{}}if(!t)return{};t=t.slice(0,2*1024*1024);let r={};for(let n of Se()){let s=new RegExp(n.pattern.source,n.pattern.flags.includes("g")?n.pattern.flags:n.pattern.flags+"g"),i=(t.match(s)??[]).length;i&&(r[n.id]=(r[n.id]??0)+i)}return r}function Hc(e){let t=Object.keys(e);if(t.length===0)return null;let r=t.reduce((s,i)=>s+e[i],0),n=[...new Set(t.map(s=>{let i=Jt(s);return i.url?`${i.provider}: ${i.url}`:i.provider}))];return`NoData \xB7 A CREDENTIAL IS IN THIS OUTPUT (${r}: ${t.join(", ")}). It is now in this conversation and was sent to the AI model. Do not repeat, quote, shorten, mask-by-hand or reuse it \u2014 not in your answer, not in a command, not in a file. Tell the user in one line that a key was shown here and should be replaced at its provider (${n.join(" \xB7 ")}); nodata_scan_folder gives the full steps. Next time, run commands that need secrets through nodata_run: the output comes back with every value blanked.`+(Q()==="he"?" Answer the user in Hebrew.":"")}function Uc(e,t,r,n){let s=Vr();if(!s.length)return null;let i=Rn(e,t,r);if(!i)return null;let o=new Date,a=i.paths.map(l=>ft(s,{action:i.action,path:l,now:o,who:n})).find(Boolean)??i.roots.map(l=>pt(s,l,i.action,o,n)).find(Boolean);if(!a)return null;let c=String(a.rule.when?.[0]?.value??"");return T(`NoData \u05D7\u05E1\u05DD: ${z(a.rule.path)} \u05E2\u05D5\u05D1\u05D3\u05EA \u05E2\u05D1\u05D5\u05E8 \u05D0\u05E8\u05D2\u05D5\u05DF \u05D0\u05D7\u05E8 (${c}) \u05DE\u05D6\u05D4 \u05E9\u05DC \u05D4\u05EA\u05D9\u05E7\u05D9\u05D9\u05D4 \u05D4\u05D6\u05D5. \u05E1\u05D5\u05DB\u05DF \u05E9\u05E2\u05D5\u05D1\u05D3 \u05DB\u05D0\u05DF \u05E2\u05D1\u05D5\u05E8 \u05D0\u05E8\u05D2\u05D5\u05DF \u05D0\u05D7\u05D3 \u05DC\u05D0 \u05E0\u05D5\u05D2\u05E2 \u05D1\u05E7\u05D1\u05E6\u05D9\u05DD \u05E9\u05DC \u05D0\u05E8\u05D2\u05D5\u05DF \u05D0\u05D7\u05E8 \u2014 \u05D2\u05DD \u05DC\u05D0 \u05D1\u05D0\u05D9\u05E9\u05D5\u05E8. \u05DC\u05E2\u05D1\u05D5\u05D3\u05D4 \u05E9\u05DD: \u05DC\u05E4\u05EA\u05D5\u05D7 \u05D0\u05EA \u05D4\u05E1\u05D5\u05DB\u05DF \u05D1\u05EA\u05D5\u05DA \u05D4\u05EA\u05D9\u05E7\u05D9\u05D9\u05D4 \u05D4\u05D4\u05D9\u05D0.`,`NoData refused: ${z(a.rule.path)} works for another organisation (${c}) than this folder. An agent working here for one organisation does not touch another organisation's files \u2014 not even with approval. To work there, start the agent inside that folder.`)}function Bc(e,t,r){let n=(e==="Bash"||e==="PowerShell")&&typeof t.command=="string"?t.command:"",s=(e==="Grep"||e==="Glob")&&typeof t.path=="string"?t.path:e==="Read"&&typeof t.file_path=="string"?t.file_path:"";return n&&oc(n)||s&&be(te(s)?s:D(r,s))||ne(e)&&Le(t,r).some(be)||ms(e,t,r).some(be)?T("NoData \u05D7\u05E1\u05DD: \u05D6\u05D4 \u05E7\u05D5\u05D1\u05E5 \u05DE\u05E4\u05EA\u05D7 \u05E9\u05DC NoData (\u05DE\u05E4\u05EA\u05D7 \u05D4\u05DE\u05DB\u05E9\u05D9\u05E8, \u05D4\u05DB\u05E1\u05E4\u05EA \u05D0\u05D5 \u05D4\u05D0\u05E8\u05D2\u05D5\u05DF). \u05DE\u05D9 \u05E9\u05E7\u05D5\u05E8\u05D0 \u05D0\u05D5\u05EA\u05D5 \u05D9\u05DB\u05D5\u05DC \u05DC\u05E4\u05EA\u05D5\u05D7 \u05DB\u05DC \u05E7\u05D5\u05D1\u05E5 \u05E0\u05E2\u05D5\u05DC, \u05D5\u05DC\u05DB\u05DF \u05D0\u05E3 \u05E1\u05D5\u05DB\u05DF \u05DC\u05D0 \u05E7\u05D5\u05E8\u05D0 \u05D0\u05D5\u05EA\u05D5 \u2014 \u05D2\u05DD \u05DC\u05D0 \u05D1\u05D0\u05D9\u05E9\u05D5\u05E8. \u05DC-NoData \u05D0\u05D9\u05DF \u05E2\u05D5\u05EA\u05E7 \u05E9\u05DC \u05D4\u05DE\u05E4\u05EA\u05D7 \u05D5\u05D0\u05D9\u05DF \u05D3\u05E8\u05DA \u05DC\u05E9\u05D7\u05D6\u05E8 \u05D0\u05D5\u05EA\u05D5: \u05D4\u05D2\u05D9\u05D1\u05D5\u05D9 \u05E9\u05DC\u05DA \u05D4\u05D5\u05D0 \u05D4\u05D3\u05E8\u05DA \u05D4\u05D9\u05D7\u05D9\u05D3\u05D4. \u05DC\u05D2\u05D9\u05D1\u05D5\u05D9, \u05D1\u05D8\u05E8\u05DE\u05D9\u05E0\u05DC \u05D5\u05DC\u05D0 \u05D1\u05E6'\u05D0\u05D8: npx -y @nodatachat/mcp@latest key-backup E: (E: = \u05D4\u05D3\u05D9\u05E1\u05E7-\u05D0\u05D5\u05DF-\u05E7\u05D9).","NoData refused: this is one of NoData's own key files (the device key, the vault login or the org credential). Whoever reads it can open every sealed file, so no agent reads it \u2014 not even with approval. NoData holds no copy of this key and cannot recover it: your backup is the only recovery. To back it up, in a terminal (not the chat): npx -y @nodatachat/mcp@latest key-backup E: (E: = your USB drive). Do not suggest other recovery routes \u2014 there are none."):null}var In="unreported",zc=new Set(["auto","bypassPermissions",In]),wn=e=>!!e&&zc.has(e);function ye(e){return e===In?T("\u05D4\u05E1\u05E9\u05DF \u05D4\u05D6\u05D4 \u05DC\u05D0 \u05DE\u05D3\u05D5\u05D5\u05D7 \u05D0\u05DD \u05D0\u05D3\u05DD \u05E2\u05D5\u05E0\u05D4 \u05D1\u05D5 \u05E2\u05DC \u05D1\u05E7\u05E9\u05EA \u05D0\u05D9\u05E9\u05D5\u05E8 (\u05DB\u05DA \u05D1-Claude Desktop \u05D5-Cowork), \u05D5\u05DC\u05DB\u05DF NoData \u05DC\u05D0 \u05E1\u05D5\u05DE\u05DB\u05EA \u05E2\u05DC \u05D7\u05DC\u05D5\u05DF \u05D4\u05D0\u05D9\u05E9\u05D5\u05E8 \u05E9\u05DC\u05D5","this session does not report whether a person answers its approval dialog (as in Claude Desktop and Cowork), so NoData does not rely on that dialog"):T(`\u05D4\u05E1\u05E9\u05DF \u05D4\u05D6\u05D4 \u05E8\u05E5 \u05D1\u05DE\u05E6\u05D1 ${e}, \u05E9\u05D1\u05D5 Claude Code \u05E2\u05D5\u05E0\u05D4 \u05D1\u05E2\u05E6\u05DE\u05D5 \u05E2\u05DC \u05D1\u05E7\u05E9\u05EA \u05D0\u05D9\u05E9\u05D5\u05E8`,`this session runs in ${e} mode, where Claude Code answers its own approval dialog`)}var vn=e=>e.charAt(0).toUpperCase()+e.slice(1);function as(e,t){let r=fs(t,e);return r&&!r.startsWith("..")&&!te(r)?z(r):bt(e)}function cs(e,t,r){if(!ht(t)||ne(t))return"";let n=Sn(e),s=r;if(n&&(t==="Edit"||t==="MultiEdit"))try{let o=yt(e).size<=1e6?En(e,"utf8"):null,a=t==="Edit"?[r]:Array.isArray(r.edits)?r.edits:[];for(let c of a)o!==null&&typeof c.old_string=="string"&&typeof c.new_string=="string"&&(o=c.replace_all?o.split(c.old_string).join(c.new_string):o.replace(c.old_string,()=>c.new_string));o!==null&&(s={content:o,old_string:r.old_string})}catch{}let i=es(e,s,Q()==="he"?"he":"en",n);return i?ts(i,Q()==="he"?"he":"en"):""}function ls(e,t,r,n,s,i,o=""){let a=o?`
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
48
|
+
`).length:0;return{risk:"review",lines:[S(r,`${n?"\u05DE\u05E9\u05E0\u05D4":"\u05D9\u05D5\u05E6\u05E8"} \u05E7\u05D5\u05D1\u05E5: +${i}${a?` \u2212${a}`:""} \u05E9\u05D5\u05E8\u05D5\u05EA`,`${n?"changes":"creates"} a file: +${i}${a?` \u2212${a}`:""} lines`)]}}function cs(e,t){return[e.risk==="destructive"?S(t,"\u{1F534} \u05DE\u05D5\u05D7\u05E7 \u05D0\u05D5 \u05D7\u05D5\u05E9\u05E3 \u05DE\u05D9\u05D3\u05E2","\u{1F534} deletes or exposes data"):e.risk==="review"?S(t,"\u{1F7E1} \u05DB\u05D3\u05D0\u05D9 \u05DC\u05D4\u05E1\u05EA\u05DB\u05DC","\u{1F7E1} worth a look"):S(t,"\u{1F7E2} \u05E8\u05E7 \u05DE\u05D5\u05E1\u05D9\u05E3","\u{1F7E2} only adds"),...e.lines.slice(0,8).map(n=>`\u2022 ${n}`),...e.lines.length>8?[S(t,`\u05D5\u05E2\u05D5\u05D3 ${e.lines.length-8}`,`and ${e.lines.length-8} more`)]:[]].join(`
|
|
49
|
+
`)}import{existsSync as ic,mkdirSync as ac,readFileSync as kn,writeFileSync as cc}from"node:fs";import{homedir as vn}from"node:os";import{join as Sn}from"node:path";var ls=()=>Sn(vn(),".nodata","autopilot.json"),ds=()=>Sn(vn(),".nodata","autopilot-new.json"),lc="autopilot";function dc(e){switch(e.startsWith("column:")?e.slice(7):e){case"israeli_id":case"id":case"national_id":case"passport":case"ssn":return"id";case"secret":return"auth";case"credit_card":case"iban":case"bank_account":case"financial":return"financial";case"israeli_phone":case"phone":return"phone";case"email":return"email";case"name":return"name";case"address":return"address";case"medical":return"medical";case"dob":return"dob";default:return"personal"}}function uc(){if(!ic(ls()))return{folders:[],tampered:!1};try{let e=JSON.parse(kn(ls(),"utf8")),t=Array.isArray(e.folders)?e.folders:[];return Yr(lc,t,e.mac)?{folders:t,tampered:!1}:{folders:[],tampered:!0}}catch{return{folders:[],tampered:!0}}}function fc(e){let t=ct(e);for(let r of lt())if(!(t&&r.owner!==t))try{if(JSON.parse(kn(r.file,"utf8")).require_autopilot==="off")return!0}catch{}return!1}function us(e){if(fc(e))return null;let{folders:t}=uc(),r=null;for(let n of t)Z(n.base,e)&&(!r||n.base.length>r.base.length)&&(r=n);return r}function fs(e,t){let r=[...new Set(Object.entries(t).filter(([,i])=>i>0).map(([i])=>dc(i)))],n=new Set([...e.crosses,...e.withheld]),s=r.filter(i=>!n.has(i));if(s.length)return{verdict:"new",kinds:s.sort()};let o=r.filter(i=>e.withheld.includes(i));return o.length?{verdict:"clean",kinds:o.sort()}:{verdict:"allow"}}function ps(e,t,r=new Date){try{let n=pc(),s=n[e]??{kinds:{},last:r.toISOString()};for(let o of t)s.kinds[o]=Math.min((s.kinds[o]??0)+1,999999);s.last=r.toISOString(),n[e]=s,ac(Sn(vn(),".nodata"),{recursive:!0}),cc(ds(),JSON.stringify(n)+`
|
|
50
|
+
`,{mode:384})}catch{}}function pc(){try{let e=JSON.parse(kn(ds(),"utf8"));return e&&typeof e=="object"?e:{}}catch{return{}}}var yc=new Set([".csv",".tsv",".txt",".md",".json",".log",".xml",".sql",".yaml",".yml",".eml",...Gt]),bc=50*1024*1024,hs=8,_c={israeli_id:"Israeli ID",credit_card:"card",iban:"IBAN",israeli_phone:"phone",email:"email",secret:"secret"};function Cn(e){let t=wt(e).toLowerCase();return yc.has(Ss(t))||ge.test(t)}var As=/^(reports|receipts)(\/|$)|^(prefs|consent|flagged|statusline-prev|key-backup|connection)\.json$|^(gate|status)\.mjs$|^(gate|answers)\.log$/i,xc=/\.nodata[\\/]+(device-key\.json|secrets\.json|credentials\.json|issuer-ed25519\.json|capsule\.json|capsule-key|shares|approvals|fabric-key\.json|machine-salt|pending-link\.json|api-shares\.json|secret-shares\.json|quarantine|bindings\.json|orgs)\b/i;function be(e){let t=_e(Y(),".nodata").replace(/\\/g,"/").toLowerCase();if(!e.replace(/\\/g,"/").toLowerCase().startsWith(t+"/"))return!1;let n=e.replace(/\\/g,"/").slice(t.length+1);return n!==""&&!As.test(n)}var wc=["~","$home","${home}","%userprofile%","$env:userprofile","${env:userprofile}","$env:home","%homedrive%%homepath%"],kc=/\.nodata(?=$|[\\/\s"'`|;&<>()])(?:[\\/]+([^\s"'`|;&<>()]*))?/gi,vc=/^\s*(ls|dir|tree|Get-ChildItem|gci)\b[^|;&]*$/i;function Sc(e){let t=(e.split(/[\s"'`=(|;&<>]/).pop()??"").replace(/\\/g,"/").replace(/\/+$/,"").toLowerCase(),r=Y().replace(/\\/g,"/").replace(/\/+$/,"").toLowerCase();return t===r||wc.includes(t)}function Ec(e){if(xc.test(e))return!0;for(let t of e.matchAll(kc)){if(!Sc(e.slice(0,t.index).replace(/[\\/]+$/,"")))continue;let r=(t[1]??"").replace(/\\/g,"/").replace(/\/+$/,"");if(r===""){if(!vc.test(e))return!0;continue}if(/[*?[\]{}]/.test(r)||!As.test(r))return!0}return!1}var re=e=>e.startsWith("mcp__"),Pn=e=>/^mcp__.+__nodata_[a-z0-9_]+$/i.test(e),Ac=/(path|file|dir|folder|root|uri|target|source|destination|cwd)/i,$c=/(write|edit|create|save|update|delete|remove|move|rename|append|put|upload|patch|insert|mkdir)/i,Rc=/(search|grep|find|glob|list|tree|director|query)/i,ms=16;function kt(e){let t=e.split("__").slice(2).join("__");return $c.test(t)?"write":Rc.test(t)?"search":"read"}function Ne(e,t){let r=[],n=(o,i)=>{let a=o.trim();if(/^file:\/\//i.test(a))try{a=decodeURIComponent(new URL(a).pathname).replace(/^\/([a-zA-Z]:)/,"$1")}catch{return}else if(!(i||/^(~[\\/]|\/|[a-zA-Z]:[\\/])/.test(a)))return;if(!a||a.length>1024||/[\n\r]/.test(a)||/^[a-z][a-z0-9+.-]*:\/\//i.test(a))return;let c=D(t,a.replace(/^~(?=[\\/]|$)/,Y()));!r.includes(c)&&r.length<ms&&r.push(c)},s=(o,i,a)=>{if(!(a>3||r.length>=ms)){if(typeof o=="string")n(o,Ac.test(i));else if(Array.isArray(o))for(let c of o.slice(0,50))s(c,i,a+1);else if(o&&typeof o=="object")for(let[c,l]of Object.entries(o))s(l,c,a+1)}};return s(e,"",0),r}var En=/(\.claude[\\/]+settings(\.local)?\.json|node_modules[\\/]+@nodatachat[\\/])/i,Ic=/(>|\bsed\s+-i|\btee\b|\b(rm|del|erase|mv|move|cp|copy|ren|rename)\b|Set-Content|Add-Content|Out-File|Remove-Item|Move-Item|Copy-Item|Rename-Item|WriteAllText|writeFileSync|unlinkSync)/i;function Tc(e,t,r){if(e==="Bash"||e==="PowerShell"){let s=typeof t.command=="string"?t.command:"";return En.test(s)&&Ic.test(s)}if(re(e))return kt(e)==="write"&&Ne(t,r).some(s=>En.test(s.replace(/\\/g,"/")));let n=typeof t.file_path=="string"?t.file_path:typeof t.notebook_path=="string"?t.notebook_path:"";return n?En.test((ne(n)?n:D(r,n)).replace(/\\/g,"/")):!1}function Cc(e){return Cn(e)||tt(e)!==null||nt(e)!==null}var bt=class extends Error{};function Pc(e){let t=Ss(e).toLowerCase(),r=Tn(e),n,s;if(t===".csv"||t===".tsv")s=r.toString("utf8"),n=Zt(s,t===".tsv"?" ":void 0).counts;else if(Gt.has(t)){let i=t===".xlsx"||t===".xlsm"?qt(r):null,a=Vt(r,t);if(!a&&!i)throw new bt;s=a?.text??"",n=i?i.counts:W(s).counts}else s=r.toString("utf8"),n=W(s).counts;let o=Fe.filter(i=>i.pattern.test(s)).length;return ge.test(wt(e).toLowerCase())&&(o=Math.max(o,Qt(s))),o&&(n.secret=Math.max(n.secret??0,o)),n}var Lc={israeli_id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",credit_card:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9",iban:"IBAN",israeli_phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",email:'\u05D3\u05D5\u05D0"\u05DC',secret:"\u05E1\u05D5\u05D3",name:"\u05E9\u05DD",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",financial:"\u05DE\u05D9\u05D3\u05E2 \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",bank_account:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7",plate:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"};function $s(e){let t=ee()==="he",r=n=>(t?Lc[n]:_c[n])??n;return Object.entries(e).sort((n,s)=>s[1]-n[1]).map(([n,s])=>`${s} ${n.startsWith("column:")?`${r(n.slice(7))} (${t?"\u05E2\u05DE\u05D5\u05D3\u05D4":"column"})`:r(n)}`).join(", ")}function Nc(e){return $s(e)}function Rs(e,t,r){let n=o=>ne(o)?o:D(r,o),s=o=>{try{return xt(o).isFile()}catch{return!1}};if(e==="Read"&&typeof t.file_path=="string")return[n(t.file_path)];if(e==="Grep"&&typeof t.path=="string"&&s(n(t.path)))return[n(t.path)];if(re(e))return kt(e)==="write"?[]:Ne(t,r).filter(s).slice(0,hs);if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"){let o=t.command,i=[...[...o.matchAll(/"([^"]*)"/g)].map(c=>c[1]),...[...o.matchAll(/'([^']*)'/g)].map(c=>c[1]),...o.split(/[\s|;&<>(),=`]+/)],a=[];for(let c of i){let l=c.trim().replace(/^['"]|['"]$/g,"").replace(/\\\\/g,"\\").replace(/^~(?=[\\/])/,Y()).replace(/^\/([a-zA-Z])\//,(d,h)=>process.platform==="win32"?`${h}:/`:d);if(!l)continue;let f=n(l);if(!(!Cn(l)&&!be(f)&&tt(f)===null&&nt(f)===null)&&(s(f)&&!a.includes(f)&&a.push(f),a.length>=hs))break}return a}return[]}function V(e){return e.replace(/\\+/g,"/")}function Oc(e){let t=e.trim();return/[;|&\n]|`|\$\(/.test(t.replace(/^cmd(?:\.exe)?\s+\/c\s+/i,""))?!1:/^(?:cmd(?:\.exe)?\s+\/c\s+)?(?:explorer(?:\.exe)?|start|invoke-item|ii|start-process|open|xdg-open)\b/i.test(t)}function gs(e,t){return`${V(e)}: ${t?R("\u05D4\u05E1\u05E8\u05D9\u05E7\u05D4 \u05D4\u05D0\u05D7\u05E8\u05D5\u05E0\u05D4 \u05DC\u05D0 \u05D4\u05E6\u05DC\u05D9\u05D7\u05D4 \u05DC\u05E7\u05E8\u05D5\u05D0 \u05D0\u05D5\u05EA\u05D5, \u05D5\u05D4\u05D5\u05D0 \u05D4\u05E9\u05EA\u05E0\u05D4 \u05DE\u05D0\u05D6 \u2014 \u05DC\u05D0 \u05E0\u05D1\u05D3\u05E7, \u05D4\u05EA\u05D9\u05D9\u05D7\u05E1 \u05D0\u05DC\u05D9\u05D5 \u05DB\u05E8\u05D2\u05D9\u05E9","your last scan could not read it, and it changed since \u2014 NOT checked, treat it as sensitive"):R("\u05D4\u05E1\u05E8\u05D9\u05E7\u05D4 \u05D4\u05D0\u05D7\u05E8\u05D5\u05E0\u05D4 \u05DC\u05D0 \u05D4\u05E6\u05DC\u05D9\u05D7\u05D4 \u05DC\u05E7\u05E8\u05D5\u05D0 \u05D0\u05D5\u05EA\u05D5 \u2014 \u05DC\u05D0 \u05E0\u05D1\u05D3\u05E7, \u05D4\u05EA\u05D9\u05D9\u05D7\u05E1 \u05D0\u05DC\u05D9\u05D5 \u05DB\u05E8\u05D2\u05D9\u05E9","your last scan could not read it \u2014 NOT checked, treat it as sensitive")}`}function Is(e,t,r){let n=[];if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"&&Oc(t.command))return n;for(let s of Rs(e,t,r)){if(!Cc(s)||Cr(s)||!In(s))continue;let o=nt(s);if(!Cn(s)){let i=tt(s);i?n.push({line:`${V(s)}: ${R("\u05E7\u05D5\u05D3 \u05E9\u05D4\u05E1\u05E8\u05D9\u05E7\u05D4 \u05D4\u05D0\u05D7\u05E8\u05D5\u05E0\u05D4 \u05E1\u05D9\u05DE\u05E0\u05D4","code your last scan flagged")} \u2014 ${Nc(i)}`,kind:"flagged_code"}):o&&n.push({line:gs(s,o.changed),kind:"unread"});continue}try{if(xt(s).size>bc)n.push({line:`${V(s)}: too large to check here (over 50 MB)`,kind:"too_large"});else{let i=Pc(s);Object.keys(i).length?n.push({line:`${V(s)}: ${$s(i)}`,kind:"data_file",file:s,counts:i}):o&&!o.changed&&n.push({line:gs(s,!1),kind:"unread"})}}catch(i){n.push(i instanceof bt?{line:`${V(s)}: ${R("\u05DC\u05D0 \u05E0\u05D9\u05EA\u05DF \u05DC\u05E7\u05E8\u05D5\u05D0 \u05D0\u05EA \u05D4\u05D8\u05E7\u05E1\u05D8 (\u05E1\u05E8\u05D9\u05E7\u05D4, \u05D4\u05E6\u05E4\u05E0\u05D4 \u05D0\u05D5 \u05D2\u05D5\u05E4\u05DF \u05DC\u05D0 \u05E0\u05EA\u05DE\u05DA) \u2014 \u05DC\u05D0 \u05E0\u05D1\u05D3\u05E7, \u05D4\u05EA\u05D9\u05D9\u05D7\u05E1 \u05D0\u05DC\u05D9\u05D5 \u05DB\u05E8\u05D2\u05D9\u05E9","its text could not be read (a scan, encryption or an unsupported font) \u2014 NOT checked, treat it as sensitive")}`,kind:"unreadable"}:{line:`${V(s)}: could not be checked`,kind:"unreadable"})}}return n}var $n=/(?:\.aws[\\/]+credentials|\.npmrc|\.yarnrc\.yml|\.pypirc|[._]netrc|\.git-credentials|\.pgpass|\.docker[\\/]+config\.json|\.kube[\\/]+config|gh[\\/]+hosts\.yml|\.supabase[\\/]+access-token|application_default_credentials\.json|gcloud[\\/]+(?:credentials|access_tokens)\.db|\.azure[\\/]+(?:msal_token_cache|accessTokens)|com\.vercel\.cli[\\/]+auth\.json|\.ssh[\\/]+id_(?:rsa|ed25519|ecdsa|dsa)(?![\w.]))/i,_t=/(?:TOKEN|SECRET|PASSW(?:OR)?D|API_?KEY|PRIVATE_?KEY|ACCESS_?KEY|CREDENTIAL|SERVICE_ROLE|_KEY$)/i,Ts="the vault's secrets, outside nodata_run's per-command approval",Dc=/(?:^|[^\w.@-])(?:npx|pnpx|bunx|npm|pnpm|yarn|bun|node|nodejs|deno|nodata-mcp)(?:\.cmd|\.exe|\.ps1|\.js)?(?![\w-])[\s\S]*?(?<![\w-])secrets-(?:run|login|set|import|share)(?![\w-])/i;function Fc(e){return Dc.test(e)}var Mc=[[/^(?:env|set|export\s+-p|declare\s+-x|get-childitem\s+env:\S*|gci\s+env:\S*|dir\s+env:\S*|ls\s+env:\S*)\s*$/i,"every environment variable"],[/^gh\s+auth\s+(?:token\b|status\b.*(?:\s-t\b|--show-token))/i,"the GitHub login token"],[/^gcloud\s+auth\s+(?:application-default\s+)?print-(?:access|identity)-token\b/i,"a Google Cloud access token"],[/^az\s+account\s+get-access-token\b/i,"an Azure access token"],[/^aws\s+(?:configure\s+(?:get\s+\S*(?:secret|token)\S*|export-credentials)|sts\s+get-session-token|ecr\s+get-login-password)\b/i,"AWS credentials"],[/^supabase\s+projects\s+api-keys\b/i,"the project's Supabase keys (incl. service_role)"],[/^heroku\s+auth:token\b/i,"the Heroku login token"],[/^op\s+(?:read|item\s+get)\b/i,"a 1Password secret"],[/^vault\s+(?:kv\s+get|read)\b/i,"a Vault secret"],[/^doppler\s+secrets\b/i,"Doppler secrets"],[/^security\s+find-(?:generic|internet)-password\b.*\s-w\b/i,"a keychain password"],[/^git\s+credential\s+fill\b/i,"a saved Git password"],[/^node\s+\S*nodata-pull\.mjs\b/i,Ts],[/^kubectl\s+get\s+secrets?\b.*\s-o\b/i,"Kubernetes secrets"]],jc=/^(?:echo|printf|print|write-output|write-host|say)\b/i,Cs=/^(?:cat|type|get-content|gc|more|less|head|tail|bat|nl|strings|xxd|od|hexdump|grep|egrep|rg|select-string|sls|awk|sed|jq|yq|python\d*|py|node|ruby|perl)\b/i,Hc=/\$\{?env:([A-Za-z_][\w]*)|\$\{?([A-Za-z_][\w]*)|%([A-Za-z_][\w]*)%|GetEnvironmentVariable\(\s*['"]([^'"]+)['"]/g;function Uc(e,t,r){let n=e==="Read"&&typeof t.file_path=="string"?t.file_path:e==="Grep"&&typeof t.path=="string"?t.path:"";if(n&&$n.test((ne(n)?n:D(r,n)).replace(/\\/g,"/")))return`a saved login (${wt(n)})`;if(e!=="Bash"&&e!=="PowerShell"||typeof t.command!="string")return null;let s=t.command.split(/(\|\||&&|[;|\n])/);for(let o=0;o<s.length;o+=2){let i=s[o+1]==="|",a=s[o].trim().replace(/^(?:sudo\s+|cmd(?:\.exe)?\s+\/c\s+|powershell(?:\.exe)?\s+(?:-command\s+)?|pwsh\s+(?:-c(?:ommand)?\s+)?)+/i,"").replace(/^["']|["']$/g,"");if(Cs.test(a)&&$n.test(a))return"a saved login file";if(Fc(a))return Ts;for(let[l,f]of Mc)if(l.test(a))return f;let c=a.match(/^printenv(?:\s+(\S+))?\s*$/i);if(c&&(!c[1]||_t.test(c[1])))return c[1]?`the variable ${c[1]}`:"every environment variable";if(!i&&(jc.test(a)||/GetEnvironmentVariable/i.test(a)))for(let l of a.matchAll(Hc)){let f=l[1]??l[2]??l[3]??l[4]??"";if(_t.test(f))return`the variable ${f}`}}return null}var Ps=/^(?:grep|egrep|fgrep|rg|ag|ack|git\s+grep|findstr|select-string|sls)\b/i,Bc=/(?:^|\s)(?:-[a-zA-Z]*[rR][a-zA-Z]*|--recursive|--dereference-recursive|\/s|-recurse)(?=\s|$)/i,zc=new Set(["node_modules",".git",".next","dist","build",".venv","venv","__pycache__",".cache"]),ys=4e3,Wc=5;function Vc(e){let t=0,r=0,n=(s,o)=>{if(o>Wc||t>ys)return;let i;try{i=mc(s,{withFileTypes:!0})}catch{return}for(let a of i){if(++t>ys)return;let c=_e(s,a.name);a.isDirectory()?zc.has(a.name)||n(c,o+1):(ge.test(a.name.toLowerCase())||$n.test(c.replace(/\\/g,"/"))||be(c))&&r++}};return n(e,0),r}var Le=e=>{try{return xt(e).isDirectory()}catch{return!1}};function Gc(e,t){let r=Es(D(t),D(e));return r===""||!r.startsWith("..")&&!ne(r)}function Xc(e,t,r){let n=o=>D(r,o.replace(/^~(?=[\\/]|$)/,Y())),s=[];if(e==="Grep"){let o=typeof t.path=="string"&&t.path?n(t.path):D(r);if(Le(o)){let i=[t.pattern,t.glob,t.type].filter(a=>typeof a=="string").join(" ");s.push({roots:[o],bySecret:_t.test(i)||/\.env|env\b/i.test(String(t.glob??""))})}}else if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string")for(let o of t.command.split(/\|\||&&|[;|\n]/)){let i=o.trim().replace(/^(?:sudo\s+|xargs\s+(?:-\S+\s+)*)/i,"");if(!/^find\b.*-exec\s+(?:grep|egrep|rg|cat)\b/i.test(i)&&!(Ps.test(i)&&(Bc.test(i)||/^(?:rg|ag|ack|git\s+grep)\b/i.test(i))))continue;let l=i.split(/\s+/).slice(1).map(f=>f.replace(/^['"]|['"]$/g,"")).filter(f=>f&&!f.startsWith("-")&&!/^\/[a-z]$/i.test(f)).map(n).filter(Le);s.push({roots:l.length?l:[D(r)],bySecret:_t.test(i)||/\.env\b/i.test(i)})}for(let o of s)for(let i of o.roots){if(!o.bySecret&&Gc(i,r))continue;let a=Vc(i);if(a>0)return{why:o.bySecret?"by_name":"outside",root:i,keyFiles:a}}return null}var Ls=new Set(["Write","Edit","MultiEdit","NotebookEdit"]),yt=e=>Ls.has(e)||re(e)&&kt(e)==="write";function Ln(e,t,r){let n=s=>D(r,s.replace(/^~(?=[\\/]|$)/,Y()));if(e==="Read"&&typeof t.file_path=="string")return{action:"read",paths:[n(t.file_path)],roots:[]};if(Ls.has(e)){let s=typeof t.file_path=="string"?t.file_path:typeof t.notebook_path=="string"?t.notebook_path:"";return s?{action:"write",paths:[n(s)],roots:[]}:null}if(e==="Grep"||e==="Glob"){let s=typeof t.path=="string"&&t.path?n(t.path):D(r);return{action:"search",paths:[s],roots:Le(s)?[s]:[]}}if(re(e)){let s=Ne(t,r);if(!s.length)return null;let o=kt(e);return{action:o,paths:s,roots:o==="search"?s.filter(Le):[]}}if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"){let s=t.command,i=[...[...s.matchAll(/"([^"]*)"/g)].map(l=>l[1]),...[...s.matchAll(/'([^']*)'/g)].map(l=>l[1]),...s.split(/[\s|;&<>(),=`]+/)].map(l=>l.trim()).filter(l=>l&&!l.startsWith("-")&&/[\\/.~]/.test(l)).filter(l=>e==="PowerShell"||!/^\\+$/.test(l)).map(n).filter(l=>In(l)),a=s.split(/\|\||&&|[;|\n]/).some(l=>Ps.test(l.trim())||/^find\b/i.test(l.trim())),c=i.filter(Le);return{action:a?"search":Cs.test(s.trim())?"read":"run",paths:[D(r),...i],roots:a?c.length?c:[D(r)]:[]}}return null}var Kc=/(browser|playwright|puppeteer|chrome|chromium|stagehand|browserbase|selenium|webdriver)/i,Zc=/(click|type|fill|press|select|submit|hover|drag|drop|upload|form|key|input|check|scroll|evaluate|dialog|tap|act\b|execute)/i,Yc=/^(url|uri|href|link|address|page_?url|start_?url)$/i,Ns=()=>_e(Y(),".nodata","gate-sites.json"),Jc=720*60*1e3,qc=50;function Qc(e,t){let r,n,s=(o,i,a)=>{if(!(a>3||r)){if(typeof o=="string"){let c=o.trim();if(!/^https?:\/\//i.test(c)||c.length>4096)return;Yc.test(i)?r=c:n??=c}else if(Array.isArray(o))for(let c of o.slice(0,50))s(c,i,a+1);else if(o&&typeof o=="object")for(let[c,l]of Object.entries(o))s(l,c,a+1)}};return s(e,"",0),r??(t?n:void 0)}function Nn(e,t){if(e==="WebFetch")return typeof t.url=="string"?{action:"browse",url:t.url}:null;if(!re(e)||Pn(e))return null;let r=e.split("__").slice(2).join("__"),n=Kc.test(e),s=Qc(t,n);return!s&&!n?null:{action:Zc.test(r)?"interact":"browse",...s?{url:s}:{}}}function Os(){try{let e=JSON.parse(Tn(Ns(),"utf8")),t=Date.now(),r={};for(let[n,s]of Object.entries(e??{}))typeof s?.host=="string"&&typeof s.at=="number"&&t-s.at<Jc&&(r[n]={host:s.host,at:s.at});return r}catch{return{}}}function el(e){return e?Os()[e]?.host:void 0}function tl(e,t,r,n){if(!e||t==="WebFetch")return;let s=Nn(t,r);if(!s)return;let o="";try{o=typeof n=="string"?n:JSON.stringify(n??"")}catch{}let i=/Page URL:\s*(https?:\/\/[^\s"\\]+)/i.exec(o)?.[1]??/"(?:url|pageUrl|page_url)"\s*:\s*"(https?:\/\/[^"\\]+)"/i.exec(o)?.[1],a=cn(i??s.url??"");if(a)try{let c=Os();c[e]={host:a,at:Date.now()};let l=Object.entries(c).sort((f,d)=>d[1].at-f[1].at).slice(0,qc);vs(_e(Y(),".nodata"),{recursive:!0}),gc(Ns(),JSON.stringify(Object.fromEntries(l))+`
|
|
51
|
+
`,{mode:384})}catch{}}function nl(e,t,r,n=new Date,s,o){let i=Nn(e,t);if(!i)return null;let a;if(i.url){let y=cn(i.url);if(!y)return null;a=y}else a=el(o);let{rules:c,tampered:l}=an(),f=un(),d={allow:0,ask:1,clean_copy:2,deny:3},h={action:i.action,path:"",now:n,who:s,site:a},p=te(),g=null;for(let{owner:y,rules:m}of f){if(!dt(y,D(r),p))continue;let _=dn(m,h);_&&(!g||d[_.rule.effect]>d[g.rule.effect])&&(g={..._,org:!0})}let u=null;if(l){let y=c.find(m=>m.site&&(a===void 0||ln(m.site,a)));y&&(u={rule:{...y,effect:"deny",when:[]},n:c.indexOf(y)+1,touched:a??"",tampered:!0})}else u=dn(c,h);return g&&(!u||d[g.rule.effect]>=d[u.rule.effect])?g:u}function bs(e,t,r,n=new Date,s){let o=Ln(e,t,r);if(!o)return null;let{rules:i,tampered:a}=an(),c=un();if(!i.length&&!c.length)return null;let l={allow:0,ask:1,clean_copy:2,deny:3},f=te(),d=null;for(let{owner:p,rules:g}of c){for(let u of o.paths){if(!dt(p,u,f))continue;let y=mt(g,{action:o.action,path:u,now:n,who:s});y&&(!d||l[y.rule.effect]>l[d.rule.effect])&&(d={...y,org:!0})}for(let u of o.roots){if(!dt(p,u,f))continue;let y=gt(g,u,o.action,n,s);y&&y.rule.effect!=="allow"&&(!d||l[y.rule.effect]>l[d.rule.effect])&&(d={...y,org:!0})}}let h=rl(i,a,o,n,l,s);return d&&(!h||l[d.rule.effect]>=l[h.rule.effect])?d:h}function rl(e,t,r,n,s,o){if(!e.length)return null;if(t){for(let a of r.paths){let c=e.find(l=>Z(l.path,a)||Z(a,l.path));if(c)return{rule:{...c,effect:"deny",when:[]},n:e.indexOf(c)+1,touched:a,tampered:!0}}return null}let i=null;for(let a of r.paths){let c=mt(e,{action:r.action,path:a,now:n,who:o});c&&(!i||s[c.rule.effect]>s[i.rule.effect])&&(i=c)}for(let a of r.roots){let c=gt(e,a,r.action,n,o);c&&c.rule.effect!=="allow"&&(!i||s[c.rule.effect]>s[i.rule.effect])&&(i=c)}return i}function sl(e){let t;try{t=typeof e=="string"?e:JSON.stringify(e??"")}catch{return{}}if(!t)return{};t=t.slice(0,2*1024*1024);let r={};for(let n of Se()){let s=new RegExp(n.pattern.source,n.pattern.flags.includes("g")?n.pattern.flags:n.pattern.flags+"g"),o=(t.match(s)??[]).length;o&&(r[n.id]=(r[n.id]??0)+o)}return r}function ol(e){let t=Object.keys(e);if(t.length===0)return null;let r=t.reduce((s,o)=>s+e[o],0),n=[...new Set(t.map(s=>{let o=en(s);return o.url?`${o.provider}: ${o.url}`:o.provider}))];return`NoData \xB7 A CREDENTIAL IS IN THIS OUTPUT (${r}: ${t.join(", ")}). It is now in this conversation and was sent to the AI model. Do not repeat, quote, shorten, mask-by-hand or reuse it \u2014 not in your answer, not in a command, not in a file. Tell the user in one line that a key was shown here and should be replaced at its provider (${n.join(" \xB7 ")}); nodata_scan_folder gives the full steps. Next time, run commands that need secrets through nodata_run: the output comes back with every value blanked.`+(ee()==="he"?" Answer the user in Hebrew.":"")}function il(e,t,r,n){let s=Qr();if(!s.length)return null;let o=Ln(e,t,r);if(!o)return null;let i=new Date,a=o.paths.map(l=>mt(s,{action:o.action,path:l,now:i,who:n})).find(Boolean)??o.roots.map(l=>gt(s,l,o.action,i,n)).find(Boolean);if(!a)return null;let c=String(a.rule.when?.[0]?.value??"");return R(`NoData \u05D7\u05E1\u05DD: ${V(a.rule.path)} \u05E2\u05D5\u05D1\u05D3\u05EA \u05E2\u05D1\u05D5\u05E8 \u05D0\u05E8\u05D2\u05D5\u05DF \u05D0\u05D7\u05E8 (${c}) \u05DE\u05D6\u05D4 \u05E9\u05DC \u05D4\u05EA\u05D9\u05E7\u05D9\u05D9\u05D4 \u05D4\u05D6\u05D5. \u05E1\u05D5\u05DB\u05DF \u05E9\u05E2\u05D5\u05D1\u05D3 \u05DB\u05D0\u05DF \u05E2\u05D1\u05D5\u05E8 \u05D0\u05E8\u05D2\u05D5\u05DF \u05D0\u05D7\u05D3 \u05DC\u05D0 \u05E0\u05D5\u05D2\u05E2 \u05D1\u05E7\u05D1\u05E6\u05D9\u05DD \u05E9\u05DC \u05D0\u05E8\u05D2\u05D5\u05DF \u05D0\u05D7\u05E8 \u2014 \u05D2\u05DD \u05DC\u05D0 \u05D1\u05D0\u05D9\u05E9\u05D5\u05E8. \u05DC\u05E2\u05D1\u05D5\u05D3\u05D4 \u05E9\u05DD: \u05DC\u05E4\u05EA\u05D5\u05D7 \u05D0\u05EA \u05D4\u05E1\u05D5\u05DB\u05DF \u05D1\u05EA\u05D5\u05DA \u05D4\u05EA\u05D9\u05E7\u05D9\u05D9\u05D4 \u05D4\u05D4\u05D9\u05D0.`,`NoData refused: ${V(a.rule.path)} works for another organisation (${c}) than this folder. An agent working here for one organisation does not touch another organisation's files \u2014 not even with approval. To work there, start the agent inside that folder.`)}function al(e,t,r){let n=(e==="Bash"||e==="PowerShell")&&typeof t.command=="string"?t.command:"",s=(e==="Grep"||e==="Glob")&&typeof t.path=="string"?t.path:e==="Read"&&typeof t.file_path=="string"?t.file_path:"";return n&&Ec(n)||s&&be(ne(s)?s:D(r,s))||re(e)&&Ne(t,r).some(be)||Rs(e,t,r).some(be)?R("NoData \u05D7\u05E1\u05DD: \u05D6\u05D4 \u05E7\u05D5\u05D1\u05E5 \u05DE\u05E4\u05EA\u05D7 \u05E9\u05DC NoData (\u05DE\u05E4\u05EA\u05D7 \u05D4\u05DE\u05DB\u05E9\u05D9\u05E8, \u05D4\u05DB\u05E1\u05E4\u05EA \u05D0\u05D5 \u05D4\u05D0\u05E8\u05D2\u05D5\u05DF). \u05DE\u05D9 \u05E9\u05E7\u05D5\u05E8\u05D0 \u05D0\u05D5\u05EA\u05D5 \u05D9\u05DB\u05D5\u05DC \u05DC\u05E4\u05EA\u05D5\u05D7 \u05DB\u05DC \u05E7\u05D5\u05D1\u05E5 \u05E0\u05E2\u05D5\u05DC, \u05D5\u05DC\u05DB\u05DF \u05D0\u05E3 \u05E1\u05D5\u05DB\u05DF \u05DC\u05D0 \u05E7\u05D5\u05E8\u05D0 \u05D0\u05D5\u05EA\u05D5 \u2014 \u05D2\u05DD \u05DC\u05D0 \u05D1\u05D0\u05D9\u05E9\u05D5\u05E8. \u05DC-NoData \u05D0\u05D9\u05DF \u05E2\u05D5\u05EA\u05E7 \u05E9\u05DC \u05D4\u05DE\u05E4\u05EA\u05D7 \u05D5\u05D0\u05D9\u05DF \u05D3\u05E8\u05DA \u05DC\u05E9\u05D7\u05D6\u05E8 \u05D0\u05D5\u05EA\u05D5: \u05D4\u05D2\u05D9\u05D1\u05D5\u05D9 \u05E9\u05DC\u05DA \u05D4\u05D5\u05D0 \u05D4\u05D3\u05E8\u05DA \u05D4\u05D9\u05D7\u05D9\u05D3\u05D4. \u05DC\u05D2\u05D9\u05D1\u05D5\u05D9, \u05D1\u05D8\u05E8\u05DE\u05D9\u05E0\u05DC \u05D5\u05DC\u05D0 \u05D1\u05E6'\u05D0\u05D8: npx -y @nodatachat/mcp@latest key-backup E: (E: = \u05D4\u05D3\u05D9\u05E1\u05E7-\u05D0\u05D5\u05DF-\u05E7\u05D9).","NoData refused: this is one of NoData's own key files (the device key, the vault login or the org credential). Whoever reads it can open every sealed file, so no agent reads it \u2014 not even with approval. NoData holds no copy of this key and cannot recover it: your backup is the only recovery. To back it up, in a terminal (not the chat): npx -y @nodatachat/mcp@latest key-backup E: (E: = your USB drive). Do not suggest other recovery routes \u2014 there are none."):null}var On="unreported",cl=new Set(["auto","bypassPermissions",On]),An=e=>!!e&&cl.has(e);function ye(e){return e===On?R("\u05D4\u05E1\u05E9\u05DF \u05D4\u05D6\u05D4 \u05DC\u05D0 \u05DE\u05D3\u05D5\u05D5\u05D7 \u05D0\u05DD \u05D0\u05D3\u05DD \u05E2\u05D5\u05E0\u05D4 \u05D1\u05D5 \u05E2\u05DC \u05D1\u05E7\u05E9\u05EA \u05D0\u05D9\u05E9\u05D5\u05E8 (\u05DB\u05DA \u05D1-Claude Desktop \u05D5-Cowork), \u05D5\u05DC\u05DB\u05DF NoData \u05DC\u05D0 \u05E1\u05D5\u05DE\u05DB\u05EA \u05E2\u05DC \u05D7\u05DC\u05D5\u05DF \u05D4\u05D0\u05D9\u05E9\u05D5\u05E8 \u05E9\u05DC\u05D5","this session does not report whether a person answers its approval dialog (as in Claude Desktop and Cowork), so NoData does not rely on that dialog"):R(`\u05D4\u05E1\u05E9\u05DF \u05D4\u05D6\u05D4 \u05E8\u05E5 \u05D1\u05DE\u05E6\u05D1 ${e}, \u05E9\u05D1\u05D5 Claude Code \u05E2\u05D5\u05E0\u05D4 \u05D1\u05E2\u05E6\u05DE\u05D5 \u05E2\u05DC \u05D1\u05E7\u05E9\u05EA \u05D0\u05D9\u05E9\u05D5\u05E8`,`this session runs in ${e} mode, where Claude Code answers its own approval dialog`)}var Rn=e=>e.charAt(0).toUpperCase()+e.slice(1);function _s(e,t){let r=Es(t,e);return r&&!r.startsWith("..")&&!ne(r)?V(r):wt(e)}function xs(e,t,r){if(!yt(t)||re(t))return"";let n=In(e),s=r;if(n&&(t==="Edit"||t==="MultiEdit"))try{let i=xt(e).size<=1e6?Tn(e,"utf8"):null,a=t==="Edit"?[r]:Array.isArray(r.edits)?r.edits:[];for(let c of a)i!==null&&typeof c.old_string=="string"&&typeof c.new_string=="string"&&(i=c.replace_all?i.split(c.old_string).join(c.new_string):i.replace(c.old_string,()=>c.new_string));i!==null&&(s={content:i,old_string:r.old_string})}catch{}let o=as(e,s,ee()==="he"?"he":"en",n);return o?cs(o,ee()==="he"?"he":"en"):""}function ws(e,t,r,n,s,o,i=""){let a=i?`
|
|
52
|
+
${i}`:"";if(!wn())return{decision:"deny",kind:"checkpoint",reason:R(`NoData: ${s}. ${ye(o)}, \u05D5\u05D4\u05DE\u05D7\u05E9\u05D1 \u05DC\u05D0 \u05DE\u05D7\u05D5\u05D1\u05E8 \u05DC-NoData \u05DB\u05D3\u05D9 \u05DC\u05E9\u05D0\u05D5\u05DC \u05D0\u05EA \u05D4\u05D1\u05E2\u05DC\u05D9\u05DD \u05D1\u05D3\u05E4\u05D3\u05E4\u05DF. \u05DC\u05DB\u05DF \u05D4\u05E6\u05E2\u05D3 \u05E0\u05D7\u05E1\u05DD. \u05D0\u05E4\u05E9\u05E8 \u05DC\u05D7\u05D1\u05E8 \u05D0\u05EA \u05D4\u05DE\u05D7\u05E9\u05D1 (nodata_connect), \u05D0\u05D5 \u05E9\u05D4\u05D0\u05D3\u05DD \u05D9\u05E2\u05E9\u05D4 \u05D0\u05EA \u05D4\u05E6\u05E2\u05D3 \u05D1\u05E2\u05E6\u05DE\u05D5.`,`NoData: ${s}. ${Rn(ye(o))}, and this computer is not connected to NoData to ask its owner in the browser. So the step is refused. Connect the computer (nodata_connect), or the person takes this step themselves.`)+a};let c=yn(e,t,r,n);return xn(c)?{decision:"allow"}:(_n({id:c,site:"",file:e,action:t,tool:r,what:bn(n),...i?{summary:i}:{}}),{decision:"deny",kind:"checkpoint",reason:R(`NoData: ${s}. ${ye(o)}, \u05D5\u05DC\u05DB\u05DF \u05D4\u05E6\u05E2\u05D3 \u05DE\u05D7\u05DB\u05D4 \u05DC\u05D0\u05D9\u05E9\u05D5\u05E8 \u05E9\u05DC \u05D1\u05E2\u05DC\u05D9 \u05D4\u05DE\u05D7\u05E9\u05D1 \u05D1\u05D3\u05E4\u05D3\u05E4\u05DF.
|
|
53
|
+
\u05DB\u05D3\u05D9 \u05DC\u05D1\u05E7\u05E9: nodata_rules {action:"approve", checkpoint:"${c}"}. \u05D4\u05D5\u05D0 \u05E4\u05D5\u05EA\u05D7 \u05D0\u05EA \u05D3\u05E3 \u05D4\u05D0\u05D9\u05E9\u05D5\u05E8 \u05D5\u05DE\u05D7\u05DB\u05D4. \u05D0\u05D7\u05E8\u05D9 \u05D4\u05D0\u05D9\u05E9\u05D5\u05E8, \u05D7\u05D6\u05D5\u05E8 \u05E2\u05DC \u05D0\u05D5\u05EA\u05D4 \u05E7\u05E8\u05D9\u05D0\u05D4 \u05D1\u05D3\u05D9\u05D5\u05E7 (\u05E4\u05E2\u05DD \u05D0\u05D7\u05EA, \u05EA\u05D5\u05DA 5 \u05D3\u05E7\u05D5\u05EA). \u05D0\u05EA\u05D4 \u05DC\u05D0 \u05D9\u05DB\u05D5\u05DC \u05DC\u05D0\u05E9\u05E8 \u05D1\u05E2\u05E6\u05DE\u05DA.`,`NoData: ${s}. ${Rn(ye(o))}, so the step waits for the computer's owner to approve it in the browser.
|
|
54
|
+
To ask: nodata_rules {action:"approve", checkpoint:"${c}"}. It opens the approval page and waits. Once approved, repeat exactly the same call (once, within 5 minutes). You cannot approve it yourself.`)+a})}function ll(e,t,r,n,s,o,i){if(Pn(e))return{decision:"allow"};let a=ct(r),c={...s,org:a??void 0},l=al(e,t,r);if(l)return{decision:"deny",reason:l,kind:"nodata_key"};let f=il(e,t,r,c);if(f)return{decision:"deny",reason:f,kind:"org_wall"};let d=Uc(e,t,r);if(d&&bs(e,t,r,new Date,c)?.rule.effect!=="deny"){let $=R(`NoData: \u05D4\u05E4\u05E7\u05D5\u05D3\u05D4 \u05D4\u05D6\u05D5 \u05DE\u05E6\u05D9\u05D2\u05D4 ${d}. \u05DE\u05D4 \u05E9\u05D4\u05D9\u05D0 \u05DE\u05D3\u05E4\u05D9\u05E1\u05D4 \u05E0\u05DB\u05E0\u05E1 \u05DC\u05E9\u05D9\u05D7\u05D4 \u05D5\u05E0\u05E9\u05DC\u05D7 \u05DC\u05DE\u05D5\u05D3\u05DC \u05D4\u05D1\u05D9\u05E0\u05D4 \u05D4\u05DE\u05DC\u05D0\u05DB\u05D5\u05EA\u05D9\u05EA, \u05D5\u05DE\u05E4\u05EA\u05D7 \u05E9\u05E0\u05E8\u05D0\u05D4 \u05DB\u05D0\u05DF \u05E6\u05E8\u05D9\u05DA \u05DC\u05D4\u05D7\u05DC\u05D9\u05E3.
|
|
54
55
|
\u05D1\u05DE\u05E7\u05D5\u05DD \u05D6\u05D4: \u05DC\u05D4\u05E8\u05D9\u05E5 \u05D0\u05D5\u05EA\u05D4 \u05D1\u05E2\u05E6\u05DE\u05DA \u05D1\u05D8\u05E8\u05DE\u05D9\u05E0\u05DC (\u05DC\u05D0 \u05D1\u05E6'\u05D0\u05D8), \u05D0\u05D5 nodata_run \u2014 \u05E9\u05DE\u05E8\u05D9\u05E5 \u05E4\u05E7\u05D5\u05D3\u05D4 \u05E2\u05DD \u05D4\u05E1\u05D5\u05D3\u05D5\u05EA \u05D5\u05DE\u05D7\u05D6\u05D9\u05E8 \u05D0\u05EA \u05D4\u05E4\u05DC\u05D8 \u05DB\u05E9\u05DB\u05DC \u05E2\u05E8\u05DA \u05DE\u05D5\u05E1\u05EA\u05E8.`+(n?"":" \u05DC\u05D0\u05E9\u05E8 \u05D1\u05DB\u05DC \u05D6\u05D0\u05EA?"),`NoData: this shows ${d}. Whatever it prints enters the conversation and goes to the AI model, and a key seen there has to be replaced.
|
|
55
|
-
Instead: run it yourself in a terminal (not the chat), or nodata_run \u2014 it runs a command with the secrets and returns the output with every value blanked.`+(n?"":" Allow anyway?"));return{decision:n?"deny":"ask",reason
|
|
56
|
-
\u05DB\u05D3\u05D9 \u05DC\u05D1\u05E7\u05E9: nodata_rules {action:"approve", checkpoint:"${
|
|
57
|
-
To ask: nodata_rules {action:"approve", checkpoint:"${
|
|
58
|
-
${
|
|
59
|
-
\u05D1\u05DE\u05E7\u05D5\u05DD \u05D6\u05D4: \u05DC\u05D7\u05E4\u05E9 \u05D1\u05EA\u05D5\u05DA \u05D4\u05E4\u05E8\u05D5\u05D9\u05E7\u05D8, \u05D0\u05D5 nodata_run \u05E2\u05DD \u05D4\u05DE\u05E4\u05EA\u05D7\u05D5\u05EA \u05DE\u05D4\u05DB\u05E1\u05E4\u05EA (\u05DB\u05DC \u05E4\u05E7\u05D5\u05D3\u05D4 \u05DE\u05D0\u05D5\u05E9\u05E8\u05EA \u05DB\u05DE\u05D5 \u05E9\u05D4\u05D9\u05D0).`+(n?"":" \u05DC\u05D0\u05E9\u05E8 \u05D1\u05DB\u05DC \u05D6\u05D0\u05EA?"),`NoData: this is ${y.why==="by_name"?"a search for a secret by name":"a search outside this project"}, over ${
|
|
60
|
-
Instead: search inside the project, or nodata_run with the keys from the vault (each command approved as written).`+(n?"":" Allow anyway?"));return{decision:n?"deny":"ask",reason:
|
|
61
|
-
${
|
|
56
|
+
Instead: run it yourself in a terminal (not the chat), or nodata_run \u2014 it runs a command with the secrets and returns the output with every value blanked.`+(n?"":" Allow anyway?"));return{decision:n?"deny":"ask",reason:$,kind:"credential_print"}}if((yt(e)||e==="Bash"||e==="PowerShell")&&Tc(e,t,r)){if(An(i)){let $=typeof t.file_path=="string"?_s(ne(t.file_path)?t.file_path:D(r,t.file_path),r):R("\u05D4\u05D4\u05D2\u05D3\u05E8\u05D5\u05EA \u05E9\u05DC Claude Code \u05D0\u05D5 \u05D4\u05E9\u05E2\u05E8 \u05E9\u05DC NoData","Claude Code's settings or NoData's gate");return ws($,"write",e,t,R("\u05D4\u05E4\u05E2\u05D5\u05DC\u05D4 \u05DE\u05E9\u05E0\u05D4 \u05D0\u05EA \u05DE\u05D4 \u05E9\u05DE\u05E4\u05E2\u05D9\u05DC \u05D0\u05EA \u05D4\u05E9\u05E2\u05E8","this changes what runs the gate"),i)}return{decision:"ask",kind:"gate_holder",reason:R("NoData: \u05D4\u05E4\u05E2\u05D5\u05DC\u05D4 \u05D4\u05D6\u05D5 \u05DE\u05E9\u05E0\u05D4 \u05D0\u05EA \u05DE\u05D4 \u05E9\u05DE\u05E4\u05E2\u05D9\u05DC \u05D0\u05EA \u05D4\u05E9\u05E2\u05E8 \u2014 \u05D4\u05D4\u05D2\u05D3\u05E8\u05D5\u05EA \u05E9\u05DC Claude Code \u05D0\u05D5 \u05D4\u05E7\u05D5\u05D3 \u05D4\u05DE\u05D5\u05EA\u05E7\u05DF \u05E9\u05DC NoData. \u05D0\u05D7\u05E8\u05D9 \u05E9\u05D9\u05E0\u05D5\u05D9 \u05DB\u05D6\u05D4 \u05D9\u05D9\u05EA\u05DB\u05DF \u05E9\u05D4\u05E9\u05E2\u05E8 \u05DC\u05D0 \u05D9\u05D1\u05D3\u05D5\u05E7 \u05D9\u05D5\u05EA\u05E8. \u05DC\u05D0\u05E9\u05E8 \u05E8\u05E7 \u05D0\u05DD \u05D0\u05EA\u05D4 \u05D1\u05D9\u05E7\u05E9\u05EA \u05D0\u05EA \u05D6\u05D4.","NoData: this changes what runs the gate \u2014 Claude Code's settings or NoData's installed code. After such a change the gate may stop checking. Approve only if you asked for it.")}}if(yt(e)){let $=typeof t.file_path=="string"?t.file_path:typeof t.notebook_path=="string"?t.notebook_path:"";if((re(e)?Ne(t,r):$?[ne($)?$:D(r,$)]:[]).some(be))return{decision:"deny",kind:"nodata_write",reason:R("NoData \u05D7\u05E1\u05DD: \u05D4\u05EA\u05D9\u05E7\u05D9\u05D9\u05D4 ~/.nodata \u05E1\u05D2\u05D5\u05E8\u05D4 \u05DC\u05E1\u05D5\u05DB\u05E0\u05D9\u05DD, \u05D2\u05DD \u05DC\u05DB\u05EA\u05D9\u05D1\u05D4 (\u05DB\u05DC\u05DC\u05D9\u05DD, \u05DE\u05E4\u05EA\u05D7\u05D5\u05EA, \u05D0\u05D9\u05E9\u05D5\u05E8\u05D9\u05DD).","NoData refused: ~/.nodata is closed to agents, writes included (rules, keys, approvals).")}}let h=new Date,p=bs(e,t,r,h,c),g=nl(e,t,r,h,c,o),u=g&&(!p||de[g.rule.effect]>de[p.rule.effect])?g:p;if(u&&u.rule.effect!=="allow"){let $=ee()==="he",M=u.rule.site?Jr(u.rule,$):u.rule.path.startsWith("**/")?u.rule.path:V(u.rule.path),U=u.rule.site&&!u.touched?R(" (NoData \u05DC\u05D0 \u05D9\u05D5\u05D3\u05E2 \u05D1\u05D0\u05D9\u05D6\u05D4 \u05D0\u05EA\u05E8 \u05D4\u05D3\u05E3 \u05D4\u05D6\u05D4, \u05D5\u05DC\u05DB\u05DF \u05D4\u05DB\u05DC\u05DC \u05D4\u05DE\u05D7\u05DE\u05D9\u05E8 \u05DE\u05D1\u05D9\u05DF \u05DB\u05DC\u05DC\u05D9 \u05D4\u05D0\u05EA\u05E8\u05D9\u05DD \u05D7\u05DC)"," (NoData does not know which site this page is on, so the strictest site rule applies)"):"",L=u.tampered?R("\u05E7\u05D5\u05D1\u05E5 \u05D4\u05DB\u05DC\u05DC\u05D9\u05DD \u05E9\u05D5\u05E0\u05D4 \u05E9\u05DC\u05D0 \u05D3\u05E8\u05DA nodata_rules, \u05D5\u05DC\u05DB\u05DF \u05DB\u05DC \u05E0\u05EA\u05D9\u05D1 \u05D5\u05D0\u05EA\u05E8 \u05E9\u05D4\u05D5\u05D0 \u05DE\u05D6\u05DB\u05D9\u05E8 \u05E1\u05D2\u05D5\u05E8\u05D9\u05DD \u05E2\u05D3 \u05E9\u05EA\u05E9\u05DE\u05D5\u05E8 \u05D0\u05EA \u05D4\u05DB\u05DC\u05DC\u05D9\u05DD \u05DE\u05D7\u05D3\u05E9.","the rules file was changed outside nodata_rules, so every path and site it names is closed until you save the rules again."):`${u.org?R("\u05DB\u05DC\u05DC \u05E9\u05DC \u05D4\u05D0\u05E8\u05D2\u05D5\u05DF","organisation rule"):R("\u05DB\u05DC\u05DC","rule")} ${u.n}: ${M} \u2192 ${qr(u.rule.effect,$)}${u.rule.note?` (${u.rule.note})`:""}${U}`;if(u.rule.site&&u.rule.effect==="ask"&&!u.tampered&&wn()){let F=Nn(e,t),z=u.touched,B=yn(z,F.action,e,t);return xn(B)?{decision:"allow"}:(_n({id:B,site:z,action:F.action,tool:e,what:bn(t)}),{decision:"deny",kind:"checkpoint",reason:R(`NoData: ${L}. \u05D4\u05E6\u05E2\u05D3 \u05D4\u05D6\u05D4 \u05DE\u05D7\u05DB\u05D4 \u05DC\u05D0\u05D9\u05E9\u05D5\u05E8 \u05E9\u05DC \u05D1\u05E2\u05DC\u05D9 \u05D4\u05DE\u05D7\u05E9\u05D1 \u05D1\u05D3\u05E4\u05D3\u05E4\u05DF, \u05DC\u05D0 \u05DC\u05D0\u05D9\u05E9\u05D5\u05E8 \u05DB\u05D0\u05DF.
|
|
57
|
+
\u05DB\u05D3\u05D9 \u05DC\u05D1\u05E7\u05E9: nodata_rules {action:"approve", checkpoint:"${B}"} \u2014 \u05D4\u05D5\u05D0 \u05E4\u05D5\u05EA\u05D7 \u05D0\u05EA \u05D3\u05E3 \u05D4\u05D0\u05D9\u05E9\u05D5\u05E8 \u05D5\u05DE\u05D7\u05DB\u05D4. \u05D0\u05D7\u05E8\u05D9 \u05D4\u05D0\u05D9\u05E9\u05D5\u05E8, \u05D7\u05D6\u05D5\u05E8 \u05E2\u05DC \u05D0\u05D5\u05EA\u05D4 \u05E7\u05E8\u05D9\u05D0\u05D4 \u05D1\u05D3\u05D9\u05D5\u05E7 (\u05E4\u05E2\u05DD \u05D0\u05D7\u05EA, \u05EA\u05D5\u05DA 5 \u05D3\u05E7\u05D5\u05EA). \u05D0\u05EA\u05D4 \u05DC\u05D0 \u05D9\u05DB\u05D5\u05DC \u05DC\u05D0\u05E9\u05E8 \u05D1\u05E2\u05E6\u05DE\u05DA.`,`NoData: ${L}. This step waits for the computer's owner to approve it in the browser, not here.
|
|
58
|
+
To ask: nodata_rules {action:"approve", checkpoint:"${B}"} \u2014 it opens the approval page and waits. Once approved, repeat exactly the same call (once, within 5 minutes). You cannot approve it yourself.`)})}if(u.rule.site&&u.rule.effect==="ask"&&!u.tampered&&An(i))return{decision:"deny",kind:"checkpoint",reason:R(`NoData: ${L}. ${ye(i)}, \u05D5\u05D4\u05DE\u05D7\u05E9\u05D1 \u05DC\u05D0 \u05DE\u05D7\u05D5\u05D1\u05E8 \u05DC-NoData \u05DB\u05D3\u05D9 \u05DC\u05E9\u05D0\u05D5\u05DC \u05D0\u05EA \u05D4\u05D1\u05E2\u05DC\u05D9\u05DD \u05D1\u05D3\u05E4\u05D3\u05E4\u05DF. \u05DC\u05DB\u05DF \u05D4\u05E6\u05E2\u05D3 \u05E0\u05D7\u05E1\u05DD. \u05D0\u05E4\u05E9\u05E8 \u05DC\u05D7\u05D1\u05E8 \u05D0\u05EA \u05D4\u05DE\u05D7\u05E9\u05D1 (nodata_connect), \u05D0\u05D5 \u05E9\u05D4\u05D0\u05D3\u05DD \u05D9\u05E2\u05E9\u05D4 \u05D0\u05EA \u05D4\u05E6\u05E2\u05D3 \u05D1\u05E2\u05E6\u05DE\u05D5.`,`NoData: ${L}. ${Rn(ye(i))}, and this computer is not connected to NoData to ask its owner in the browser. So the step is refused. Connect the computer (nodata_connect), or the person takes this step themselves.`)};if(!u.rule.site&&u.rule.effect==="ask"&&!u.tampered&&An(i)){let F=Ln(e,t,r)?.action,z=F==="read"||F==="search"||F==="run"?F:"write";return ws(_s(u.touched,r),z,e,t,L,i,xs(u.touched,e,t))}let N=u.rule.effect==="ask"?xs(u.touched,e,t):"",j=u.rule.effect==="clean_copy"?R(`NoData: ${L}. \u05D4\u05E1\u05D5\u05DB\u05DF \u05E2\u05D5\u05D1\u05D3 \u05DB\u05D0\u05DF \u05E8\u05E7 \u05E2\u05DC \u05E2\u05D5\u05EA\u05E7 \u05E0\u05E7\u05D9: nodata_redact \u05D9\u05D5\u05E6\u05E8 \u05D0\u05D5\u05EA\u05D5 (\u05DE\u05D6\u05D4\u05D9\u05DD \u05DE\u05D5\u05D7\u05DC\u05E4\u05D9\u05DD, \u05E0\u05D1\u05D3\u05E7 \u05DC\u05E4\u05E0\u05D9 \u05E9\u05D9\u05DE\u05D5\u05E9).`,`NoData: ${L}. The agent works here on a clean copy only: nodata_redact makes one (identifiers replaced, checked before use).`):u.rule.effect==="ask"?R(`NoData: ${L}. \u05DC\u05D0\u05E9\u05E8?`,`NoData: ${L}. Allow?`)+(N?`
|
|
59
|
+
${N}`:""):R(`NoData: ${L}. \u05D4\u05DB\u05DC\u05DC\u05D9\u05DD \u05E9\u05DC \u05D4\u05E7\u05D1\u05E6\u05D9\u05DD, \u05D4\u05EA\u05D9\u05E7\u05D9\u05D5\u05EA \u05D5\u05D4\u05D0\u05EA\u05E8\u05D9\u05DD \u05E9\u05DC\u05DA: nodata_rules.`,`NoData: ${L}. Your file, folder and site rules: nodata_rules.`);return{decision:u.rule.effect==="ask"?"ask":"deny",reason:j,kind:"rule"}}if(yt(e))return{decision:"allow"};let y=Xc(e,t,r);if(y){let $=V(y.root),M=R(`NoData: \u05D6\u05D4 ${y.why==="by_name"?"\u05D7\u05D9\u05E4\u05D5\u05E9 \u05E1\u05D5\u05D3 \u05DC\u05E4\u05D9 \u05E9\u05DD":"\u05D7\u05D9\u05E4\u05D5\u05E9 \u05DE\u05D7\u05D5\u05E5 \u05DC\u05E4\u05E8\u05D5\u05D9\u05E7\u05D8"}, \u05D1\u05EA\u05D5\u05DA ${$}, \u05E9\u05D9\u05E9 \u05D1\u05D4 ${y.keyFiles} \u05E7\u05D1\u05E6\u05D9 \u05DE\u05E4\u05EA\u05D7\u05D5\u05EA (.env, \u05D4\u05EA\u05D7\u05D1\u05E8\u05D5\u05D9\u05D5\u05EA). \u05DE\u05D4 \u05E9\u05D4\u05D7\u05D9\u05E4\u05D5\u05E9 \u05D9\u05DE\u05E6\u05D0 \u05E0\u05DB\u05E0\u05E1 \u05DC\u05E9\u05D9\u05D7\u05D4, \u05D5\u05DE\u05E4\u05EA\u05D7 \u05E9\u05E0\u05DE\u05E6\u05D0 \u05DB\u05DA \u05D9\u05DB\u05D5\u05DC \u05DC\u05E9\u05DE\u05E9 \u05D0\u05EA \u05D4\u05E1\u05D5\u05DB\u05DF \u2014 \u05D2\u05DD \u05DC\u05E4\u05E2\u05D5\u05DC\u05D5\u05EA \u05E9\u05E2\u05D5\u05DC\u05D5\u05EA \u05DB\u05E1\u05E3 \u2014 \u05D1\u05DC\u05D9 \u05E9\u05D0\u05D9\u05E9\u05E8\u05EA \u05D0\u05D5\u05EA\u05D5.
|
|
60
|
+
\u05D1\u05DE\u05E7\u05D5\u05DD \u05D6\u05D4: \u05DC\u05D7\u05E4\u05E9 \u05D1\u05EA\u05D5\u05DA \u05D4\u05E4\u05E8\u05D5\u05D9\u05E7\u05D8, \u05D0\u05D5 nodata_run \u05E2\u05DD \u05D4\u05DE\u05E4\u05EA\u05D7\u05D5\u05EA \u05DE\u05D4\u05DB\u05E1\u05E4\u05EA (\u05DB\u05DC \u05E4\u05E7\u05D5\u05D3\u05D4 \u05DE\u05D0\u05D5\u05E9\u05E8\u05EA \u05DB\u05DE\u05D5 \u05E9\u05D4\u05D9\u05D0).`+(n?"":" \u05DC\u05D0\u05E9\u05E8 \u05D1\u05DB\u05DC \u05D6\u05D0\u05EA?"),`NoData: this is ${y.why==="by_name"?"a search for a secret by name":"a search outside this project"}, over ${$}, where ${y.keyFiles} key file(s) (.env, logins) are. Whatever it finds enters the conversation, and a key found this way can be used by the agent \u2014 for paid calls too \u2014 without you approving it.
|
|
61
|
+
Instead: search inside the project, or nodata_run with the keys from the vault (each command approved as written).`+(n?"":" Allow anyway?"));return{decision:n?"deny":"ask",reason:M,kind:"secret_search"}}if(u?.rule.effect==="allow")return{decision:"allow"};let m=Is(e,t,r);if(m.length===0)return{decision:"allow"};let _=dl(m);if(_.decision)return _.decision;let b=m.map($=>$.line),E=R(`NoData \u05E1\u05E8\u05E7 \u05D0\u05EA \u05D4\u05E7\u05D5\u05D1\u05E5 \u05D1\u05DE\u05D7\u05E9\u05D1 \u05E9\u05DC\u05DA \u2014 \u05E9\u05D5\u05DD \u05D3\u05D1\u05E8 \u05DC\u05D0 \u05D9\u05E6\u05D0:
|
|
62
|
+
${b.join(`
|
|
62
63
|
`)}
|
|
63
64
|
`+(n?"\u05D4\u05E7\u05E8\u05D9\u05D0\u05D4 \u05E0\u05D7\u05E1\u05DE\u05D4: Claude \u05DC\u05D0 \u05D9\u05E7\u05E8\u05D0 \u05D0\u05EA \u05D4\u05DE\u05E7\u05D5\u05E8. \u05D1\u05DE\u05E7\u05D5\u05DD \u05D6\u05D4: nodata_redact (\u05E2\u05D5\u05EA\u05E7 \u05E0\u05E7\u05D9 \u05DC\u05E2\u05D1\u05D5\u05D3\u05D4) \u05D0\u05D5 nodata_protect (\u05E0\u05E2\u05D9\u05DC\u05D4).":"\u05D0\u05DD \u05EA\u05D0\u05E9\u05E8, Claude \u05D9\u05E7\u05E8\u05D0 \u05D0\u05EA \u05D4\u05E7\u05D5\u05D1\u05E5 \u05E2\u05E6\u05DE\u05D5 \u05D5\u05D4\u05EA\u05D5\u05DB\u05DF \u05D9\u05D9\u05E9\u05DC\u05D7 \u05DC\u05DE\u05D5\u05D3\u05DC \u05D4\u05D1\u05D9\u05E0\u05D4 \u05D4\u05DE\u05DC\u05D0\u05DB\u05D5\u05EA\u05D9\u05EA. \u05D1\u05DE\u05E7\u05D5\u05DD \u05D6\u05D4: nodata_redact (\u05E2\u05D5\u05EA\u05E7 \u05E0\u05E7\u05D9 \u05DC\u05E2\u05D1\u05D5\u05D3\u05D4) \u05D0\u05D5 nodata_protect (\u05E0\u05E2\u05D9\u05DC\u05D4). \u05DC\u05D0\u05E9\u05E8 \u05D1\u05DB\u05DC \u05D6\u05D0\u05EA?"),`NoData scanned this file on your machine \u2014 nothing left it:
|
|
64
|
-
${
|
|
65
|
+
${b.join(`
|
|
65
66
|
`)}
|
|
66
|
-
`+(n?"Read refused: Claude will not read the original. Instead: nodata_redact (a clean copy to work on) or nodata_protect (lock it).":"If you allow it, Claude reads the file itself and its content goes to the AI model. Instead: nodata_redact (a clean copy to work on) or nodata_protect (lock it). Allow anyway?")),
|
|
67
|
+
`+(n?"Read refused: Claude will not read the original. Instead: nodata_redact (a clean copy to work on) or nodata_protect (lock it).":"If you allow it, Claude reads the file itself and its content goes to the AI model. Instead: nodata_redact (a clean copy to work on) or nodata_protect (lock it). Allow anyway?")),w=[...new Set(m.map($=>$.kind)),..._.fresh?["policy_new"]:[]];return{decision:n?"deny":"ask",reason:E+(_.fresh??""),kind:w[0],...w.length>1?{kinds:w}:{}}}function dl(e){let t=[];for(let o of e){if(o.kind!=="data_file"||!o.file||!o.counts)return{};let i=us(o.file);if(!i)return{};t.push({base:i.base,v:fs(i,o.counts)})}let r=o=>[...new Set(o.flatMap(i=>i.v.verdict==="allow"?[]:i.v.kinds))].join(", "),n=t.filter(o=>o.v.verdict==="new");if(n.length){for(let i of n)i.v.verdict==="new"&&ps(i.base,i.v.kinds);let o=r(n);return{fresh:R(`
|
|
68
|
+
|
|
69
|
+
\u05D4\u05DE\u05D3\u05D9\u05E0\u05D9\u05D5\u05EA \u05E9\u05D0\u05D9\u05E9\u05E8\u05EA \u05DC\u05EA\u05D9\u05E7\u05D9\u05D9\u05D4 \u05D4\u05D6\u05D5 \u05DC\u05D0 \u05E8\u05D0\u05EA\u05D4 \u05D0\u05EA \u05D4\u05E1\u05D5\u05D2 \u05D4\u05D6\u05D4 (${o}), \u05D5\u05DC\u05DB\u05DF NoData \u05E9\u05D5\u05D0\u05DC. \u05DC\u05D4\u05D5\u05E1\u05D9\u05E3 \u05D0\u05D5\u05EA\u05D5 \u05DC\u05DE\u05D3\u05D9\u05E0\u05D9\u05D5\u05EA: \u05DC\u05E1\u05E8\u05D5\u05E7 \u05E9\u05D5\u05D1 \u05D5\u05DC\u05D1\u05D7\u05D5\u05E8 (nodata_scan_folder \u05D5\u05D0\u05D6 nodata_choose).`,`
|
|
70
|
+
|
|
71
|
+
The policy you approved for this folder never saw this kind (${o}), so NoData asks. To add it to the policy: scan again and choose (nodata_scan_folder, then nodata_choose).`)}}let s=t.filter(o=>o.v.verdict==="clean");if(s.length){let o=r(s);return{decision:{decision:"deny",kind:"by_policy",reason:R(`NoData, \u05DC\u05E4\u05D9 \u05D4\u05DE\u05D3\u05D9\u05E0\u05D9\u05D5\u05EA \u05E9\u05D0\u05D9\u05E9\u05E8\u05EA \u05DC\u05EA\u05D9\u05E7\u05D9\u05D9\u05D4 \u05D4\u05D6\u05D5: \u05D4\u05E7\u05D5\u05D1\u05E5 \u05DE\u05D7\u05D6\u05D9\u05E7 \u05E1\u05D5\u05D2 \u05E9\u05D1\u05D7\u05E8\u05EA \u05DC\u05D0 \u05DC\u05D4\u05E2\u05D1\u05D9\u05E8 \u05DC\u05D1\u05D9\u05E0\u05D4 \u05D4\u05DE\u05DC\u05D0\u05DB\u05D5\u05EA\u05D9\u05EA (${o}). \u05DC\u05E2\u05D1\u05D5\u05D3 \u05DE\u05D4\u05E2\u05D5\u05EA\u05E7 \u05D4\u05E0\u05E7\u05D9: nodata_redact, \u05D0\u05D5 \u05D4\u05EA\u05D9\u05E7\u05D9\u05D9\u05D4 \u05D4\u05E0\u05E7\u05D9\u05D9\u05D4 (nodata_clean_folder). \u05DC\u05E9\u05E0\u05D5\u05EA \u05D0\u05EA \u05D4\u05DE\u05D3\u05D9\u05E0\u05D9\u05D5\u05EA: nodata_choose.`,`NoData, by the policy you approved for this folder: this file holds a kind you chose to keep from the AI (${o}). Work from the clean copy: nodata_redact, or the clean folder (nodata_clean_folder). To change the policy: nodata_choose.`)}}}return{decision:{decision:"allow",kind:"by_policy"}}}function ul(e,t,r){let n=Is(e,t,r).map(s=>s.line);return n.length===0?null:`NoData \xB7 ON SCREEN rule. What you just read holds personal data:
|
|
67
72
|
${n.join(`
|
|
68
73
|
`)}
|
|
69
|
-
The user's screen is not private \u2014 someone may be beside them. Answer with totals, counts, groupings and trends. Do not print names, ID / policy / account numbers, addresses, phones, or amounts tied to a person \u2014 not in a table, not as an "example" \u2014 unless the user explicitly asks to see those values. For a clean, anonymised or shareable version use nodata_redact \u2014 never your own script: it verifies the copy and records a proof.`+(
|
|
70
|
-
`,{mode:384})}catch{}}function
|
|
74
|
+
The user's screen is not private \u2014 someone may be beside them. Answer with totals, counts, groupings and trends. Do not print names, ID / policy / account numbers, addresses, phones, or amounts tied to a person \u2014 not in a table, not as an "example" \u2014 unless the user explicitly asks to see those values. For a clean, anonymised or shareable version use nodata_redact \u2014 never your own script: it verifies the copy and records a proof.`+(ee()==="he"?" Answer the user in Hebrew.":"")}function Ds(e){try{let t=_e(Y(),".nodata");vs(t,{recursive:!0}),hc(_e(t,"gate.log"),JSON.stringify({at:new Date().toISOString(),...e})+`
|
|
75
|
+
`,{mode:384})}catch{}}function ks(e,t){Ds({tool:e,decision:t.decision,...t.kind?{kind:t.kind}:{},...t.kinds?.length?{kinds:t.kinds}:{}})}function fl(e,t){let r=typeof e=="string"&&e.trim()?e.trim().toLowerCase():void 0,n=typeof t.agent_type=="string"&&t.agent_type.trim()?t.agent_type.trim().toLowerCase():r==="claude-code"?"main":void 0;return{host:r,type:n}}function pl(e,t,r){let n=typeof r=="string"&&r?r:void 0;return e?{host:t??(n?"claude-code":"claude-desktop"),mode:n??On}:{host:t,mode:n}}async function Fs(e){let t=e.includes("--block"),r=e.includes("--post"),n=e.indexOf("--host"),s=n>=0&&e[n+1]&&!e[n+1].startsWith("--")?e[n+1]:void 0,o=e.includes("--plugin"),i="";for await(let g of process.stdin)i+=g;let a;try{a=JSON.parse(i)}catch{return}let c=a.tool_name??"";if(Pn(c))return;let{host:l,mode:f}=pl(o,s,a.permission_mode),d=typeof a.tool_use_id=="string"&&a.tool_use_id?a.tool_use_id:void 0;if(r){let g=await pn(d,"post",()=>{tl(a.session_id,c,a.tool_input??{},a.tool_response);let u=sl(a.tool_response);return Object.keys(u).length&&Ds({tool:c,leaked:Object.values(u).reduce((y,m)=>y+m,0)}),[ol(u),ul(c,a.tool_input??{},a.cwd??process.cwd())].filter(Boolean).join(`
|
|
71
76
|
|
|
72
|
-
`)});g.first&&g.value&&process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PostToolUse",additionalContext:g.value}}));return}let h=await un(d,"pre",()=>Wc(c,a.tool_input??{},a.cwd??process.cwd(),t,Xc(l,a),a.session_id,f)),p=h.value;p.decision!=="allow"&&(h.first&&Vc(c,p),process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:p.decision,permissionDecisionReason:p.reason}})))}var Zc="claude-code",zp=` --host ${Zc}`;var Yc=[{type:"id_number",patterns:[/\b\d{9}\b/g,/ת\.?ז\.?\s*:?\s*(\d{9})/g,/זהות\s*:?\s*(\d{9})/g],confidence:.9,replacement:()=>"[\u05EA.\u05D6. \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"phone",patterns:[/\b0[2-9]\d[\s\-]?\d{7}\b/g,/\b05[0-9][\s\-]?\d{7}\b/g,/\+972[\s\-]?[2-9]\d[\s\-]?\d{7}\b/g],confidence:.95,replacement:()=>"[\u05D8\u05DC\u05E4\u05D5\u05DF \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"email",patterns:[/[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}/g],confidence:.99,replacement:e=>{let[,t]=e.split("@");return`[\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC: ***@${t}]`}},{type:"full_name",patterns:[/(?:לקוח|מטופל|מועמד|שם|נהג|מבוטח|תובע|נתבע|שוכר|מחזיק)[:\s]+([א-ת][א-ת"'\-\s]{2,30}?)(?=[,\n\d]|ת\.ז)/g,/(?:עו"ד|ד"ר|פרופ'|מר|גברת)\s+([א-ת][א-ת"'\-\s]{2,25}?)(?=[,\n])/g],confidence:.75,replacement:()=>"[\u05E9\u05DD \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"bank_account",patterns:[/\b\d{2}[\-]\d{5,9}[\-]\d{2,3}\b/g,/(?:חשבון|ח-ן)\s*:?\s*(\d[\d\-]{8,15})/g],confidence:.88,replacement:()=>"[\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"medical",patterns:[/(?<![א-ת])[בהוכלמש]{0,2}(?:סוכרת|יתר לחץ דם|אסתמה|דיכאון|חרדה|סרטן|אי ספיקת לב|אפילפסיה)(?![א-ת])/g,/\b(?:Metformin|Lisinopril|Atorvastatin|Amlodipine|Sertraline|Fluoxetine|Omeprazole|Warfarin|Aspirin|Insulin)\b/gi,/\bHbA1c\s*:?\s*[\d.]+%?/g,/\bBMI\s*:?\s*[\d.]+/g,/(?<![א-ת])[בהוכלמש]{0,2}אבחנ[הות]\s*:?\s*[^,\n.]{2,40}/g,/\b(?:Diagnosis|diagnosed\s+with)\s*:?\s*[^,\n.]{2,40}/gi,/\b(?:(?:type\s*[12]\s+)?diabetes(?:\s+mellitus)?|hypertension|asthma|epilepsy|schizophrenia|bipolar\s+disorder|HIV|hepatitis(?:\s+[A-C]\b)?|heart\s+failure|COPD|multiple\s+sclerosis|Crohn'?s\s+disease)\b/gi,/(?<![א-ת])[בהוכלמש]{0,2}(?:אינסולין|מטפורמין|אספירין|קומדין|אומפרדקס|פרוזק|ציפרלקס|אטורבסטטין|אמלודיפין)(?![א-ת])/g],confidence:.85,replacement:()=>"[\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"financial_amount",patterns:[/[\d,]+(?:\.\d{2})?\s*(?:₪|ש"ח|NIS|שקל(?:ים)?)/g,/(?:₪|NIS)\s*[\d,]+(?:\.\d{2})?/g],confidence:.92,replacement:()=>"[\u05E1\u05DB\u05D5\u05DD \u05DB\u05E1\u05E4\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"birth_date",patterns:[/(?:תאריך לידה|נולד|נולדה|ד\.ל\.)\s*:?\s*\d{1,2}[\/\.\-]\d{1,2}[\/\.\-]\d{2,4}/g,/(?<![א-ת])[בהוכלמש]{0,2}גיל\s*:?\s*\d{1,3}\b/g],confidence:.88,replacement:()=>"[\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"address",patterns:[/רחוב\s+[א-ת][א-ת\s"'\-]{2,30}\s+\d{1,5}/g,/(?:רח'|רח\.)\s+[א-ת][א-ת\s"'\-]{2,30}\d{1,5}/g],confidence:.72,replacement:()=>"[\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D5\u05E1\u05EA\u05E8\u05EA]"},{type:"license_plate",patterns:[/\b\d{2,3}[\-]\d{2,3}[\-]\d{2,3}\b/g],confidence:.8,replacement:()=>"[\u05DC\u05D5\u05D7\u05D9\u05EA \u05E8\u05D9\u05E9\u05D5\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8\u05EA]"}];function Jc(e){if(e.length!==9)return!1;let t=e.split("").map(Number),r=0;for(let n=0;n<9;n++){let s=t[n]*(n%2===0?1:2);s>9&&(s-=9),r+=s}return r%10===0}var xe=class{constructor(t){this.enabledTypes=new Set(t)}detect(t){let r=[],n=new Set;for(let i of Yc)if(this.enabledTypes.has(i.type))for(let o of i.patterns){let a=new RegExp(o.source,o.flags),c;for(;(c=a.exec(t))!==null;){let l=c[0],f=`${i.type}:${c.index}`;if(!n.has(f)){if(n.add(f),i.type==="id_number"){let d=l.replace(/\D/g,"");if(/^\d{9}$/.test(l)&&d.length===9&&!Jc(d))continue}r.push({type:i.type,value:l,startIndex:c.index,endIndex:c.index+l.length,confidence:i.confidence,replacement:i.replacement(l,i.type)})}}}r.sort((i,o)=>i.startIndex-o.startIndex||o.confidence-i.confidence);let s=[];for(let i of r)s.some(a=>i.startIndex<a.endIndex&&i.endIndex>a.startIndex)||s.push(i);return s}};var C=["GDPR","CPRA","PPL"],qc=["GDPR-9","CPRA","PPL"],Qc=[{id:"person_name",type:"name",sensitivity:"high",regulations:[...C],en:["firstname","lastname","fname","lname","middle name","maiden name","birth name","preferred name","display name","nickname","surname","given name","full name"],he:["\u05E9\u05DD \u05E4\u05E8\u05D8\u05D9","\u05E9\u05DD \u05DE\u05E9\u05E4\u05D7\u05D4","\u05E9\u05DD \u05DE\u05DC\u05D0","\u05DB\u05D9\u05E0\u05D5\u05D9","\u05E9\u05DD \u05E0\u05E2\u05D5\u05E8\u05D9\u05DD"],ar:["\u0627\u0644\u0627\u0633\u0645","\u0627\u0633\u0645 \u0627\u0644\u0639\u0627\u0626\u0644\u0629","\u0627\u0644\u0627\u0633\u0645 \u0627\u0644\u0643\u0627\u0645\u0644"],ru:["\u0438\u043C\u044F","\u0444\u0430\u043C\u0438\u043B\u0438\u044F","\u043E\u0442\u0447\u0435\u0441\u0442\u0432\u043E","\u0444\u0438\u043E"]},{id:"birth_place",type:"location",sensitivity:"medium",regulations:[...C],en:["birth place","birthplace","place of birth"],he:["\u05DE\u05E7\u05D5\u05DD \u05DC\u05D9\u05D3\u05D4","\u05D0\u05E8\u05E5 \u05DC\u05D9\u05D3\u05D4"],ar:["\u0645\u0643\u0627\u0646 \u0627\u0644\u0645\u064A\u0644\u0627\u062F"],ru:["\u043C\u0435\u0441\u0442\u043E \u0440\u043E\u0436\u0434\u0435\u043D\u0438\u044F"]},{id:"citizenship",type:"sensitive_personal",sensitivity:"high",regulations:[...C],en:["citizenship","nationality"],he:["\u05D0\u05D6\u05E8\u05D7\u05D5\u05EA","\u05DC\u05D0\u05D5\u05DD"],ar:["\u0627\u0644\u062C\u0646\u0633\u064A\u0629"],ru:["\u0433\u0440\u0430\u0436\u0434\u0430\u043D\u0441\u0442\u0432\u043E"]},{id:"marital_status",type:"sensitive_personal",sensitivity:"high",regulations:[...C],en:["marital status"],he:["\u05DE\u05E6\u05D1 \u05DE\u05E9\u05E4\u05D7\u05EA\u05D9"],ar:["\u0627\u0644\u062D\u0627\u0644\u0629 \u0627\u0644\u0627\u062C\u062A\u0645\u0627\u0639\u064A\u0629"],ru:["\u0441\u0435\u043C\u0435\u0439\u043D\u043E\u0435 \u043F\u043E\u043B\u043E\u0436\u0435\u043D\u0438\u0435"]},{id:"government_id",type:"id",sensitivity:"critical",regulations:[...C],en:["ssn","national id","passport","driver license","drivers license","tax id","social security","national insurance","military id","voter id","resident id","residence permit","visa number"],he:["\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA","\u05D3\u05E8\u05DB\u05D5\u05DF","\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4","\u05DE\u05E1\u05E4\u05E8 \u05D1\u05D9\u05D8\u05D5\u05D7 \u05DC\u05D0\u05D5\u05DE\u05D9","\u05DE\u05E1\u05E4\u05E8 \u05D0\u05D9\u05E9\u05D9","\u05DE\u05E1\u05E4\u05E8 \u05D5\u05D9\u05D6\u05D4","\u05EA\u05E2\u05D5\u05D3\u05EA \u05EA\u05D5\u05E9\u05D1","\u05DE\u05E1\u05E4\u05E8 \u05E2\u05D5\u05E1\u05E7"],ar:["\u0631\u0642\u0645 \u0627\u0644\u0647\u0648\u064A\u0629","\u062C\u0648\u0627\u0632 \u0627\u0644\u0633\u0641\u0631","\u0631\u062E\u0635\u0629 \u0627\u0644\u0642\u064A\u0627\u062F\u0629"],ru:["\u043F\u0430\u0441\u043F\u043E\u0440\u0442","\u0441\u043D\u0438\u043B\u0441","\u0438\u043D\u043D","\u0432\u043E\u0434\u0438\u0442\u0435\u043B\u044C\u0441\u043A\u043E\u0435 \u0443\u0434\u043E\u0441\u0442\u043E\u0432\u0435\u0440\u0435\u043D\u0438\u0435"]},{id:"institution_person_id",type:"tracking",sensitivity:"medium",regulations:[...C],en:["employee id","employee number","employee no","student id","student number","user id","userid","customer id","customer number","customer no","client id","member id","subscriber id","participant id","profile id","person id","person uuid","lead id","crm contact","account id"],he:["\u05DE\u05E1\u05E4\u05E8 \u05E2\u05D5\u05D1\u05D3","\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D8\u05D5\u05D3\u05E0\u05D8","\u05DE\u05E1\u05E4\u05E8 \u05DC\u05E7\u05D5\u05D7","\u05DE\u05D6\u05D4\u05D4 \u05DC\u05E7\u05D5\u05D7","\u05DE\u05E1\u05E4\u05E8 \u05DE\u05E0\u05D5\u05D9","\u05DE\u05D6\u05D4\u05D4 \u05DE\u05E9\u05EA\u05DE\u05E9"],ar:["\u0631\u0642\u0645 \u0627\u0644\u0645\u0648\u0638\u0641","\u0631\u0642\u0645 \u0627\u0644\u0639\u0645\u064A\u0644"],ru:["\u0442\u0430\u0431\u0435\u043B\u044C\u043D\u044B\u0439 \u043D\u043E\u043C\u0435\u0440","\u043D\u043E\u043C\u0435\u0440 \u043A\u043B\u0438\u0435\u043D\u0442\u0430"]},{id:"patient_id",type:"medical",sensitivity:"critical",regulations:["GDPR-9","HIPAA","PPL"],en:["patient id","patient number","mrn","medical record number"],he:["\u05DE\u05E1\u05E4\u05E8 \u05DE\u05D8\u05D5\u05E4\u05DC","\u05DE\u05E1\u05E4\u05E8 \u05EA\u05D9\u05E7 \u05E8\u05E4\u05D5\u05D0\u05D9"],ar:["\u0631\u0642\u0645 \u0627\u0644\u0645\u0631\u064A\u0636"],ru:["\u043D\u043E\u043C\u0435\u0440 \u043F\u0430\u0446\u0438\u0435\u043D\u0442\u0430"]},{id:"email",type:"email",sensitivity:"high",regulations:[...C],en:["emailaddress","e mail","recovery email","contact email"],he:["\u05D3\u05D5\u05D0\u05DC","\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC"],ar:["\u0627\u0644\u0628\u0631\u064A\u062F \u0627\u0644\u0625\u0644\u0643\u062A\u0631\u0648\u0646\u064A"],ru:["\u043F\u043E\u0447\u0442\u0430","\u044D\u043B\u0435\u043A\u0442\u0440\u043E\u043D\u043D\u0430\u044F \u043F\u043E\u0447\u0442\u0430","email"]},{id:"phone",type:"phone",sensitivity:"high",regulations:[...C],en:["cellphone","contact number","work phone","home phone","whatsapp","recovery phone","telephone"],he:["\u05D8\u05DC\u05E4\u05D5\u05DF \u05D1\u05D9\u05EA","\u05D8\u05DC\u05E4\u05D5\u05DF \u05E2\u05D1\u05D5\u05D3\u05D4","\u05D5\u05D5\u05D8\u05E1\u05D0\u05E4","\u05DE\u05E1\u05E4\u05E8 \u05E0\u05D9\u05D9\u05D3"],ar:["\u0647\u0627\u062A\u0641","\u0631\u0642\u0645 \u0627\u0644\u0647\u0627\u062A\u0641","\u062C\u0648\u0627\u0644"],ru:["\u0442\u0435\u043B\u0435\u0444\u043E\u043D","\u043C\u043E\u0431\u0438\u043B\u044C\u043D\u044B\u0439"]},{id:"social_handle",type:"tracking",sensitivity:"medium",regulations:[...C],en:["telegram","linkedin","facebook","twitter","instagram","tiktok","social profile"],he:["\u05D8\u05DC\u05D2\u05E8\u05DD","\u05DC\u05D9\u05E0\u05E7\u05D3\u05D0\u05D9\u05DF","\u05E4\u05D9\u05D9\u05E1\u05D1\u05D5\u05E7","\u05D0\u05D9\u05E0\u05E1\u05D8\u05D2\u05E8\u05DD"]},{id:"address",type:"address",sensitivity:"high",regulations:[...C],en:["house number","apartment","apt","billing address","shipping address","postal code","zip code","postcode","street"],he:["\u05DE\u05E1\u05E4\u05E8 \u05D1\u05D9\u05EA","\u05D3\u05D9\u05E8\u05D4","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DC\u05DE\u05E9\u05DC\u05D5\u05D7","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DC\u05D7\u05D9\u05D5\u05D1","\u05EA.\u05D3","\u05EA\u05D0 \u05D3\u05D5\u05D0\u05E8"],ar:["\u0627\u0644\u0639\u0646\u0648\u0627\u0646","\u0627\u0644\u0634\u0627\u0631\u0639","\u0627\u0644\u0631\u0645\u0632 \u0627\u0644\u0628\u0631\u064A\u062F\u064A"],ru:["\u0430\u0434\u0440\u0435\u0441","\u0443\u043B\u0438\u0446\u0430","\u0438\u043D\u0434\u0435\u043A\u0441","\u043A\u0432\u0430\u0440\u0442\u0438\u0440\u0430"]},{id:"geo",type:"location",sensitivity:"high",regulations:[...C],en:["geo location","geolocation","latitude","longitude","coordinates","home location","current location"],he:["\u05DE\u05D9\u05E7\u05D5\u05DD","\u05E7\u05D5\u05D0\u05D5\u05E8\u05D3\u05D9\u05E0\u05D8\u05D5\u05EA"],ar:["\u0627\u0644\u0645\u0648\u0642\u0639"],ru:["\u043C\u0435\u0441\u0442\u043E\u043F\u043E\u043B\u043E\u0436\u0435\u043D\u0438\u0435","\u043A\u043E\u043E\u0440\u0434\u0438\u043D\u0430\u0442\u044B"]},{id:"bank_card",type:"financial",sensitivity:"critical",regulations:[...C],en:["bank account","iban","swift","bic","routing number","credit card","creditcard","card number","cvv","card expiry","cc exp","paypal","wallet address","crypto wallet","bitcoin address"],he:["\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7","\u05DE\u05E1\u05E4\u05E8 \u05D7\u05E9\u05D1\u05D5\u05DF","\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9","\u05D0\u05E8\u05E0\u05E7 \u05E7\u05E8\u05D9\u05E4\u05D8\u05D5","\u05D0\u05E8\u05E0\u05E7 \u05D3\u05D9\u05D2\u05D9\u05D8\u05DC\u05D9"],ar:["\u062D\u0633\u0627\u0628 \u0628\u0646\u0643\u064A","\u0631\u0642\u0645 \u0627\u0644\u062D\u0633\u0627\u0628","\u0628\u0637\u0627\u0642\u0629 \u0627\u0626\u062A\u0645\u0627\u0646"],ru:["\u0440\u0430\u0441\u0447\u0435\u0442\u043D\u044B\u0439 \u0441\u0447\u0435\u0442","\u043D\u043E\u043C\u0435\u0440 \u0441\u0447\u0435\u0442\u0430","\u043D\u043E\u043C\u0435\u0440 \u043A\u0430\u0440\u0442\u044B","\u043A\u0440\u0435\u0434\u0438\u0442\u043D\u0430\u044F \u043A\u0430\u0440\u0442\u0430"]},{id:"income_tax",type:"financial",sensitivity:"high",regulations:[...C],en:["salary","income","wage","tax record","tax return","payment history","credit score","net worth","salary grade"],he:["\u05E9\u05DB\u05E8","\u05DE\u05E9\u05DB\u05D5\u05E8\u05EA","\u05D4\u05DB\u05E0\u05E1\u05D4","\u05EA\u05DC\u05D5\u05E9 \u05E9\u05DB\u05E8","\u05D3\u05D5\u05D7 \u05DE\u05E1","\u05D4\u05D9\u05E1\u05D8\u05D5\u05E8\u05D9\u05D9\u05EA \u05EA\u05E9\u05DC\u05D5\u05DE\u05D9\u05DD","\u05D3\u05D9\u05E8\u05D5\u05D2 \u05D0\u05E9\u05E8\u05D0\u05D9","\u05E9\u05D5\u05D5\u05D9 \u05E0\u05E7\u05D9","\u05D3\u05E8\u05D2\u05EA \u05E9\u05DB\u05E8"],ar:["\u0627\u0644\u0631\u0627\u062A\u0628","\u0627\u0644\u062F\u062E\u0644"],ru:["\u0437\u0430\u0440\u043F\u043B\u0430\u0442\u0430","\u0434\u043E\u0445\u043E\u0434"]},{id:"assets",type:"financial",sensitivity:"high",regulations:[...C],en:["property id","land record","ownership record","title deed","holdings"],he:["\u05D2\u05D5\u05E9 \u05D7\u05DC\u05E7\u05D4","\u05E0\u05E1\u05D7 \u05D8\u05D0\u05D1\u05D5","\u05E8\u05D9\u05E9\u05D5\u05DD \u05DE\u05E7\u05E8\u05E7\u05E2\u05D9\u05DF","\u05D1\u05E2\u05DC\u05D5\u05EA","\u05D0\u05D7\u05D6\u05E7\u05D5\u05EA"],ru:["\u0441\u043E\u0431\u0441\u0442\u0432\u0435\u043D\u043D\u043E\u0441\u0442\u044C","\u043D\u0435\u0434\u0432\u0438\u0436\u0438\u043C\u043E\u0441\u0442\u044C"]},{id:"vehicle",type:"tracking",sensitivity:"medium",regulations:[...C],en:["vin","vehicle id","license plate","registration number","plate number"],he:["\u05DE\u05E1\u05E4\u05E8 \u05E9\u05DC\u05D3\u05D4","\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1","\u05DC\u05D5\u05D7\u05D9\u05EA \u05E8\u05D9\u05E9\u05D5\u05D9"],ru:["\u043D\u043E\u043C\u0435\u0440 \u0430\u0432\u0442\u043E\u043C\u043E\u0431\u0438\u043B\u044F","vin"]},{id:"health",type:"medical",sensitivity:"critical",regulations:["GDPR-9","HIPAA","PPL"],en:["medical record","health condition","health data","lab result","lab results","vaccination","mental health","hospitalization","hospitalisation","disability","insurance number","diagnosis","allergy","prescription","medication","blood type"],he:["\u05EA\u05D9\u05E7 \u05E8\u05E4\u05D5\u05D0\u05D9","\u05EA\u05D5\u05E6\u05D0\u05D5\u05EA \u05DE\u05E2\u05D1\u05D3\u05D4","\u05EA\u05D5\u05E6\u05D0\u05D5\u05EA \u05D1\u05D3\u05D9\u05E7\u05D4","\u05D7\u05D9\u05E1\u05D5\u05E0\u05D9\u05DD","\u05D1\u05E8\u05D9\u05D0\u05D5\u05EA \u05E0\u05E4\u05E9","\u05D0\u05E9\u05E4\u05D5\u05D6","\u05E0\u05DB\u05D5\u05EA","\u05DE\u05E6\u05D1 \u05D1\u05E8\u05D9\u05D0\u05D5\u05EA\u05D9"],ar:["\u0627\u0644\u062A\u0634\u062E\u064A\u0635","\u0627\u0644\u0633\u062C\u0644 \u0627\u0644\u0637\u0628\u064A","\u0627\u0644\u0623\u062F\u0648\u064A\u0629"],ru:["\u0434\u0438\u0430\u0433\u043D\u043E\u0437","\u043C\u0435\u0434\u0438\u0446\u0438\u043D\u0441\u043A\u0430\u044F \u043A\u0430\u0440\u0442\u0430","\u0430\u043D\u0430\u043B\u0438\u0437\u044B"]},{id:"biometric",type:"biometric",sensitivity:"critical",regulations:["GDPR-9","CPRA","PPL"],en:["face embedding","face scan","iris scan","retina scan","voice print","voiceprint","voice signature","hand geometry","biometric template","biometric data","dna","genetic data","genome"],he:["\u05D8\u05D1\u05D9\u05E2\u05EA \u05E7\u05D5\u05DC","\u05E1\u05E8\u05D9\u05E7\u05EA \u05E4\u05E0\u05D9\u05DD","\u05E1\u05E8\u05D9\u05E7\u05EA \u05E7\u05E9\u05EA\u05D9\u05EA","\u05E0\u05EA\u05D5\u05E0\u05D9\u05DD \u05D2\u05E0\u05D8\u05D9\u05D9\u05DD",'\u05D3\u05E0"\u05D0'],ar:["\u0628\u0635\u0645\u0629"],ru:["\u0431\u0438\u043E\u043C\u0435\u0442\u0440\u0438\u044F","\u043E\u0442\u043F\u0435\u0447\u0430\u0442\u043E\u043A"]},{id:"employment",type:"employment",sensitivity:"medium",regulations:[...C],en:["employer","job title","employment status","hire date","start date of employment","termination date","performance review","disciplinary"],he:["\u05DE\u05E2\u05E1\u05D9\u05E7","\u05DE\u05E7\u05D5\u05DD \u05E2\u05D1\u05D5\u05D3\u05D4","\u05EA\u05E4\u05E7\u05D9\u05D3 \u05D4\u05E2\u05D5\u05D1\u05D3","\u05EA\u05D0\u05E8\u05D9\u05DA \u05EA\u05D7\u05D9\u05DC\u05EA \u05E2\u05D1\u05D5\u05D3\u05D4","\u05EA\u05D0\u05E8\u05D9\u05DA \u05E1\u05D9\u05D5\u05DD \u05E2\u05D1\u05D5\u05D3\u05D4","\u05D4\u05E2\u05E8\u05DB\u05EA \u05D1\u05D9\u05E6\u05D5\u05E2\u05D9\u05DD","\u05E9\u05D9\u05DE\u05D5\u05E2"],ar:["\u062C\u0647\u0629 \u0627\u0644\u0639\u0645\u0644","\u0627\u0644\u0645\u0633\u0645\u0649 \u0627\u0644\u0648\u0638\u064A\u0641\u064A"],ru:["\u0440\u0430\u0431\u043E\u0442\u043E\u0434\u0430\u0442\u0435\u043B\u044C","\u0434\u043E\u043B\u0436\u043D\u043E\u0441\u0442\u044C"]},{id:"manager",type:"name",sensitivity:"medium",regulations:[...C],en:["manager","supervisor"],he:["\u05DE\u05E0\u05D4\u05DC \u05D9\u05E9\u05D9\u05E8"]},{id:"education",type:"education",sensitivity:"medium",regulations:[...C],en:["school","university","college","degree","transcript","education history","gpa"],he:["\u05D1\u05D9\u05EA \u05E1\u05E4\u05E8","\u05D0\u05D5\u05E0\u05D9\u05D1\u05E8\u05E1\u05D9\u05D8\u05D4","\u05DE\u05DB\u05DC\u05DC\u05D4","\u05D2\u05D9\u05DC\u05D9\u05D5\u05DF \u05E6\u05D9\u05D5\u05E0\u05D9\u05DD","\u05D4\u05E9\u05DB\u05DC\u05D4","\u05EA\u05D5\u05D0\u05E8 \u05D0\u05E7\u05D3\u05DE\u05D9"],ar:["\u0627\u0644\u062C\u0627\u0645\u0639\u0629","\u0627\u0644\u0645\u062F\u0631\u0633\u0629"],ru:["\u043E\u0431\u0440\u0430\u0437\u043E\u0432\u0430\u043D\u0438\u0435","\u0443\u043D\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442"]},{id:"device_online",type:"tracking",sensitivity:"medium",regulations:[...C],en:["ip","ipaddress","ip address","mac address","device id","deviceid","advertising id","idfa","gaid","android id","apple id","cookie id","cookieid","browser fingerprint","user agent","imei"],he:["\u05DB\u05EA\u05D5\u05D1\u05EA ip","\u05DE\u05D6\u05D4\u05D4 \u05DE\u05DB\u05E9\u05D9\u05E8"],ru:["ip \u0430\u0434\u0440\u0435\u0441"]},{id:"account",type:"tracking",sensitivity:"medium",regulations:[...C],en:["username","user name","login","screen name"],he:["\u05E9\u05DD \u05DE\u05E9\u05EA\u05DE\u05E9"],ru:["\u043B\u043E\u0433\u0438\u043D"]},{id:"credential",type:"auth",sensitivity:"critical",regulations:[...C],en:["password","password hash","mfa secret","otp secret","security question","security answer","session id","session token","api key"],he:["\u05E1\u05D9\u05E1\u05DE\u05D4","\u05E1\u05D9\u05E1\u05DE\u05D0","\u05E9\u05D0\u05DC\u05EA \u05D0\u05D1\u05D8\u05D7\u05D4"],ar:["\u0643\u0644\u0645\u0629 \u0627\u0644\u0645\u0631\u0648\u0631"],ru:["\u043F\u0430\u0440\u043E\u043B\u044C"]},{id:"behavior",type:"behavior",sensitivity:"high",regulations:[...C],en:["purchase history","search history","browsing history","clickstream","usage pattern","behavior profile","behaviour profile"],he:["\u05D4\u05D9\u05E1\u05D8\u05D5\u05E8\u05D9\u05D9\u05EA \u05E8\u05DB\u05D9\u05E9\u05D5\u05EA","\u05D4\u05D9\u05E1\u05D8\u05D5\u05E8\u05D9\u05D9\u05EA \u05D7\u05D9\u05E4\u05D5\u05E9","\u05D4\u05D9\u05E1\u05D8\u05D5\u05E8\u05D9\u05D9\u05EA \u05D2\u05DC\u05D9\u05E9\u05D4","\u05E4\u05E8\u05D5\u05E4\u05D9\u05DC \u05D4\u05EA\u05E0\u05D4\u05D2\u05D5\u05EA"]},{id:"special_category",type:"sensitive_personal",sensitivity:"critical",regulations:[...qc],en:["race","ethnicity","religion","political opinion","political party","union membership","trade union","sexual orientation","gender identity","criminal record"],he:["\u05D2\u05D6\u05E2","\u05D3\u05EA","\u05D4\u05E9\u05E7\u05E4\u05D4 \u05E4\u05D5\u05DC\u05D9\u05D8\u05D9\u05EA","\u05D7\u05D1\u05E8\u05D5\u05EA \u05D1\u05D0\u05D9\u05D2\u05D5\u05D3","\u05E0\u05D8\u05D9\u05D9\u05D4 \u05DE\u05D9\u05E0\u05D9\u05EA","\u05D6\u05D4\u05D5\u05EA \u05DE\u05D2\u05D3\u05E8\u05D9\u05EA","\u05E8\u05D9\u05E9\u05D5\u05DD \u05E4\u05DC\u05D9\u05DC\u05D9"],ar:["\u0627\u0644\u062F\u064A\u0627\u0646\u0629","\u0627\u0644\u0639\u0631\u0642"],ru:["\u0440\u0435\u043B\u0438\u0433\u0438\u044F","\u043D\u0430\u0446\u0438\u043E\u043D\u0430\u043B\u044C\u043D\u043E\u0441\u0442\u044C"]},{id:"family_names",type:"name",sensitivity:"high",regulations:[...C],en:["mother name","father name","spouse","partner name","emergency contact","next of kin","family member","guardian","beneficiary"],he:["\u05E9\u05DD \u05D4\u05D0\u05DD","\u05E9\u05DD \u05D4\u05D0\u05D1","\u05D1\u05DF \u05D6\u05D5\u05D2","\u05D1\u05EA \u05D6\u05D5\u05D2","\u05D0\u05D9\u05E9 \u05E7\u05E9\u05E8 \u05DC\u05D7\u05D9\u05E8\u05D5\u05DD","\u05E7\u05E8\u05D5\u05D1 \u05DE\u05E9\u05E4\u05D7\u05D4","\u05D0\u05E4\u05D5\u05D8\u05E8\u05D5\u05E4\u05D5\u05E1","\u05DE\u05D5\u05D8\u05D1"],ar:["\u0627\u0633\u0645 \u0627\u0644\u0623\u0645","\u0627\u0633\u0645 \u0627\u0644\u0623\u0628","\u0627\u0644\u0632\u0648\u062C"],ru:["\u0441\u0443\u043F\u0440\u0443\u0433","\u043E\u043F\u0435\u043A\u0443\u043D"]},{id:"children",type:"minor_data",sensitivity:"critical",regulations:[...C],en:["children","child name","dependents","dependants"],he:["\u05D9\u05DC\u05D3\u05D9\u05DD","\u05E9\u05DE\u05D5\u05EA \u05D4\u05D9\u05DC\u05D3\u05D9\u05DD"],ar:["\u0627\u0644\u0623\u0637\u0641\u0627\u0644"],ru:["\u0434\u0435\u0442\u0438"]}];function el(e){return e.trim().toLowerCase().replace(/["'`׳״]/g,"").replace(/[_\-.]+/g," ").replace(/\s+/g," ").trim()}function Es(){return Qc.map(e=>{let t=[...e.en,...e.he??[],...e.ar??[],...e.ru??[]].map(el).filter(Boolean);return{type:e.type,tokens:t.filter(r=>!r.includes(" ")),phrases:t.filter(r=>r.includes(" "))}})}var tl=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם_אדם|שם הלקוח|שם_הלקוח|שם בן זוג|שם בן_זוג|שם המבוטח|שם_המבוטח|שם המוטב|שם_המוטב|שם מבוטח|שם_מבוטח|שם מוטב|שם_מוטב|שם הילד|שם_הילד|שם הקטין|שם_הקטין|firstname_he|lastname_he|shem|shem_mishpacha|shem_prati)$/i,type:"name",label:"Person name (Hebrew)",labelHe:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מספר_זהות|מס' זהות|מס_זהות|מס' ת"ז|teudat_zehut|tz|t_z|israeli_id|il_id)$/i,type:"id",label:"Israeli ID",labelHe:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|מס דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה|מס רישיון|דרכון_מספר)$/i,type:"id",label:"Passport / DL (Hebrew)",labelHe:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|דואר_אלקטרוני|אימייל|כתובת מייל|כתובת_מייל|כתובת דואר|כתובת_דואר)$/i,type:"email",label:"Email (Hebrew)",labelHe:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|מספר_טלפון|טלפון נייד|טלפון_נייד|מס נייד|מס_נייד|מס' טל)$/i,type:"phone",label:"Phone (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|כתובת_מגורים|רחוב|מס בית|מספר בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|כתובת_מלאה|מען)$/i,type:"address",label:"Address (Hebrew)",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|תאריך_לידה|ת לידה|תאריך הולדת|תאריך_הולדת|יום הולדת|יום_הולדת|גיל)$/i,type:"dob",label:"Date of birth (Hebrew)",labelHe:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|חשבון_בנק|מספר חשבון|מספר_חשבון|מס חשבון|מס' חשבון|בנק|סניף|מס סניף|iban|iban_il)$/i,type:"financial",label:"Bank account (Hebrew)",labelHe:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|כרטיס_אשראי|מספר אשראי|מס אשראי|מס' אשראי|cvv|אשראי|מס כרטיס|מס_כרטיס)$/i,type:"financial",label:"Credit card (Hebrew)",labelHe:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר_ברוטו|שכר נטו|שכר_נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"Salary / income (Hebrew)",labelHe:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|בדיקה_רפואית|מצב רפואי|מצב_רפואי|חיסון|תוצאת בדיקה|תוצאת_בדיקה|רופא|רגישות|אלרגיה|סוג דם|סוג_דם)$/i,type:"medical",label:"Medical (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מספר_פוליסה|מס פוליסה|מס' פוליסה|פוליסה|מספר חבר|מספר_חבר|מס חבר|מספר ביטוח|מספר_ביטוח|policy_?number|policy_?no|policy_?id)$/i,type:"policy",label:"Insurance policy number (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"},{pattern:/^(?:מספר סוכן|מספר_סוכן|מס סוכן|מס' סוכן|מס_סוכן|קוד סוכן|קוד_סוכן|מספר משווק|מספר_משווק|מספר יצרן|סוכן ביטוח|agent_?number|agent_?no|agent_?id|agent_?code|broker_?id|broker_?number)$/i,type:"agent_id",label:"Insurance agent / broker number (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF"},{pattern:/^(?:שם הילד|שם_הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|מספר_ילדים|תעודת לידה|ת לידה ילד)$/i,type:"minor_data",label:"Minor data (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|נטייה_מינית|השקפה פוליטית|השקפה_פוליטית|מצב משפחתי|מצב_משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"Sensitive personal (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מספר_רכב|מס רכב|מס' רכב|לוחית רישוי|לוחית_רישוי|מספר רישוי|מספר_רישוי)$/i,type:"tracking",label:"Vehicle ID (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}];function Ne(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let r=t.padStart(9,"0"),n=0;for(let s=0;s<9;s++){let i=parseInt(r[s]??"0",10)*(s%2+1);i>9&&(i-=9),n+=i}return n%10===0&&parseInt(r,10)>0}var xt=/(?<!\d)(?<!\d[.,])(?:\+972[\s-]?|0)(?:5[0-9]|7[0-9]|[2-4]|[89])(?:[\s-]?\d){7}(?!\d)(?![.,]\d)/g,wt=/(?<!:\/\/[^\s/@]*)[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}/gi;var Cn=/\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b/g;function As(e){let t=String(e??"").replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let r=t.slice(4)+t.slice(0,4),n=0;for(let s of r){let i=s>="A"&&s<="Z"?String(s.charCodeAt(0)-55):s;for(let o of i)n=(n*10+Number(o))%97}return n===1}function $s(e){let t=String(e??"").replace(/\D/g,"");if(t.length<13||t.length>19||!/^[2-6]/.test(t))return!1;let r=0,n=!1;for(let s=t.length-1;s>=0;s--){let i=t.charCodeAt(s)-48;if(i<0||i>9)return!1;n&&(i*=2,i>9&&(i-=9)),r+=i,n=!n}return r%10===0}function Rs(e){if(!e)return null;let t=e.trim();for(let r of tl)if(r.pattern.test(t))return{type:r.type,label:r.label,labelHe:r.labelHe};return null}var nl=[{type:"biometric",tokens:["biometric","fingerprint","\u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9"],phrases:["face id","\u05D8\u05D1\u05D9\u05E2\u05EA \u05D0\u05E6\u05D1\u05E2"]},{type:"medical",tokens:["diagnosis","medical","disease","medication","prescription","allergy","vaccine","\u05D0\u05D1\u05D7\u05D5\u05DF","\u05D0\u05D1\u05D7\u05E0\u05D4","\u05DE\u05D7\u05DC\u05D4","\u05EA\u05E8\u05D5\u05E4\u05D4","\u05DE\u05E8\u05E9\u05DD","\u05D7\u05D9\u05E1\u05D5\u05DF","\u05D0\u05DC\u05E8\u05D2\u05D9\u05D4"],phrases:["medical record","blood type","\u05DE\u05E6\u05D1 \u05E8\u05E4\u05D5\u05D0\u05D9","\u05E1\u05D5\u05D2 \u05D3\u05DD"]},{type:"sensitive_personal",tokens:["religion","ethnicity","nationality","\u05D3\u05EA","\u05DC\u05D0\u05D5\u05DD","\u05E2\u05D3\u05D4","\u05DE\u05D5\u05E6\u05D0"],phrases:["sexual orientation","marital status","\u05DE\u05E6\u05D1 \u05DE\u05E9\u05E4\u05D7\u05EA\u05D9","\u05E0\u05D8\u05D9\u05D9\u05D4 \u05DE\u05D9\u05E0\u05D9\u05EA"]},{type:"minor_data",tokens:["minor","\u05E7\u05D8\u05D9\u05DF"],phrases:["child name","\u05E9\u05DD \u05D4\u05D9\u05DC\u05D3","\u05E9\u05DD \u05D4\u05E7\u05D8\u05D9\u05DF"]},{type:"id",tokens:["ssn","passport","\u05D6\u05D4\u05D5\u05EA","\u05D3\u05E8\u05DB\u05D5\u05DF"],phrases:["national id","id number","identity number","social security","driver license","driving license","drivers license","passport number","tax id","\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA","\u05DE\u05E1\u05E4\u05E8 \u05D6\u05D4\u05D5\u05EA","\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4"]},{type:"financial",tokens:["iban","swift","bic","salary","income","wage","\u05D0\u05E9\u05E8\u05D0\u05D9","\u05E9\u05DB\u05E8","\u05DE\u05E9\u05DB\u05D5\u05E8\u05EA","\u05D4\u05DB\u05E0\u05E1\u05D4"],phrases:["bank account","account number","credit card","card number","routing number","sort code","\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7","\u05DE\u05E1\u05E4\u05E8 \u05D7\u05E9\u05D1\u05D5\u05DF","\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"]},{type:"policy",tokens:["policy","\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"],phrases:["policy number","member number","\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"]},{type:"agent_id",tokens:["\u05DE\u05E9\u05D5\u05D5\u05E7"],phrases:["agent number","agent code","broker id","\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF"]},{type:"dob",tokens:["dob","birthdate","birthday","\u05DC\u05D9\u05D3\u05D4","\u05D4\u05D5\u05DC\u05D3\u05EA","\u05D2\u05D9\u05DC"],phrases:["date of birth","birth date","\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"]},{type:"phone",tokens:["phone","tel","mobile","cell","fax","\u05D8\u05DC\u05E4\u05D5\u05DF","\u05E0\u05D9\u05D9\u05D3","\u05E4\u05DC\u05D0\u05E4\u05D5\u05DF","\u05E1\u05DC\u05D5\u05DC\u05E8\u05D9"],phrases:["phone number","mobile number","cell phone","\u05D8\u05DC\u05E4\u05D5\u05DF \u05E0\u05D9\u05D9\u05D3"]},{type:"email",tokens:["email","mail","\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC","\u05DE\u05D9\u05D9\u05DC","\u05D3\u05D5\u05D0\u05DC"],phrases:["email address","e mail","\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D9\u05D9\u05DC"]},{type:"address",tokens:["address","street","city","zipcode","zip","postcode","\u05DB\u05EA\u05D5\u05D1\u05EA","\u05E8\u05D7\u05D5\u05D1","\u05E2\u05D9\u05E8","\u05D9\u05E9\u05D5\u05D1","\u05D9\u05D9\u05E9\u05D5\u05D1","\u05DE\u05D9\u05E7\u05D5\u05D3","\u05DE\u05E2\u05DF"],phrases:["home address","postal code","street address","zip code","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D2\u05D5\u05E8\u05D9\u05DD"]},{type:"location",tokens:["gps","latitude","longitude","geolocation","\u05DE\u05D9\u05E7\u05D5\u05DD"],phrases:["gps coordinates"]},{type:"tracking",tokens:["plate","vehicle","\u05E8\u05DB\u05D1","\u05E8\u05D9\u05E9\u05D5\u05D9"],phrases:["license plate","vehicle number","plate number","\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"]},...Es(),{type:"name",tokens:["name","\u05E9\u05DD"],phrases:["first name","last name","full name","family name","given name","surname","\u05E9\u05DD \u05E4\u05E8\u05D8\u05D9","\u05E9\u05DD \u05DE\u05E9\u05E4\u05D7\u05D4","\u05E9\u05DD \u05DE\u05DC\u05D0"]}];function kt(e){if(!e||/^\[[A-Z_]+(?:-\d+)?\]$/.test(e.trim()))return null;let t=e.trim().toLowerCase().replace(/["'`׳״]/g,"").replace(/[_\-.]+/g," ").replace(/\s+/g," ").trim();if(!t)return null;let r=new Set(t.match(/[\p{L}\p{N}]+/gu)??[]);for(let n of nl)if(n.phrases?.some(i=>t.includes(i))||n.tokens?.some(i=>r.has(i)))return{type:n.type,label:n.type,labelHe:vt(n.type)};return null}function vt(e){return{id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",employment:"\u05E4\u05E8\u05D8\u05D9 \u05EA\u05E2\u05E1\u05D5\u05E7\u05D4",education:"\u05D4\u05E9\u05DB\u05DC\u05D4",behavior:"\u05E4\u05E8\u05D5\u05E4\u05D9\u05DC \u05D4\u05EA\u05E0\u05D4\u05D2\u05D5\u05EA",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",name:"\u05E9\u05DD \u05D0\u05D3\u05DD",email:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9",phone:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",financial:"\u05E4\u05E8\u05D8\u05D9\u05DD \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9\u05D9\u05DD",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",minor_data:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF",sensitive_personal:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9",biometric:"\u05DE\u05D9\u05D3\u05E2 \u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9",auth:"\u05E1\u05D9\u05E1\u05DE\u05D0\u05D5\u05EA/\u05E1\u05D5\u05D3\u05D5\u05EA",tracking:"\u05DE\u05D6\u05D4\u05D9 \u05DE\u05E2\u05E7\u05D1",location:"\u05DE\u05D9\u05E7\u05D5\u05DD"}[e]??"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9"}var rl=/^(?:\d{5,9}|\d{8}-\d)$/;function Ts(e){let t=0,r=0,n=0,s=0,i=0;for(let a of e)typeof a=="string"&&(rl.test(a.trim())&&Ne(a)&&t++,xt.lastIndex=0,xt.test(a)&&r++,wt.lastIndex=0,wt.test(a)&&n++,Cn.lastIndex=0,[...a.matchAll(Cn)].some(c=>As(c[0]))&&s++,$s(a)&&i++);let o=e.length||1;return t/o>=.3?{type:"id",label:"Israeli ID (sniffed)",matchedSample:t}:s/o>=.3?{type:"financial",label:"IBAN-IL (sniffed)",matchedSample:s}:r/o>=.3?{type:"phone",label:"IL phone (sniffed)",matchedSample:r}:n/o>=.3?{type:"email",label:"Email (sniffed)",matchedSample:n}:i/o>=.3?{type:"financial",label:"Credit card (sniffed)",matchedSample:i}:null}var sl=[{type:"full_name",kind:"name",severity:"medium",hint:`A person's name in free text (after a role word such as \u05DC\u05E7\u05D5\u05D7 / \u05DE\u05E8 / \u05E2\u05D5"\u05D3, or Client: / Mr.).`},{type:"bank_account",kind:"bank_account",severity:"high",hint:"An Israeli bank account number (branch-account-check form) in plaintext."},{type:"medical",kind:"medical",severity:"high",hint:"Medical information (diagnosis, medication, lab value) in plaintext."},{type:"birth_date",kind:"dob",severity:"medium",hint:"A date of birth in plaintext."},{type:"address",kind:"address",severity:"medium",hint:"A street address in plaintext."},{type:"license_plate",kind:"plate",severity:"low",hint:"A vehicle licence plate in plaintext."}],il=/^(?:לקוח|מטופל|מועמד|שם|נהג|מבוטח|תובע|נתבע|שוכר|מחזיק|עו"ד|ד"ר|פרופ'|מר|גברת|חשבון|ח-ן|[בהוכלמש]{0,2}אבחנ[הות]|תאריך לידה|נולד|נולדה|ד\.ל\.|[בהוכלמש]{0,2}גיל|[Dd]iagnosis|[Dd]iagnosed\s+with)\s*:?\s*/;function ol(e,t,r,n){if(n==="address")return{start:t,end:r};let s=il.exec(e.slice(t,r));return s&&t+s[0].length<r?{start:t+s[0].length,end:r}:{start:t,end:r}}function W(e,t,r=()=>!0){let n=[],s=new RegExp(e.source,e.flags.includes("g")?e.flags:e.flags+"g");for(let i of t.matchAll(s)){let o=i[1];if(!o||!r(o))continue;let a=(i.index??0)+i[0].indexOf(o);n.push({start:a,end:a+o.length})}return n}var Is=String.raw`[A-Z][a-z']+(?:-[A-Z]?[a-z']+)*`,Pn=String.raw`${Is}(?:[ \t]+${Is}){0,2}`,al=new RegExp(String.raw`\b(?:Mr|Mrs|Ms|Miss|Dr|Prof)\.?[ \t]+(${Pn})`),cl=new RegExp(String.raw`\b(?:Client|Customer|Patient|Name|Full name|Beneficiary|Insured|Applicant|Tenant|Employee|Holder|Investor)[ \t]*:[ \t]*(${Pn})`),ll=new RegExp(String.raw`\b(${Pn})(?=,[ \t]*\d{1,3}[ \t]*,|[ \t]*\(\d{1,3}\))`,"g"),dl=/^(?:Figure|Fig|Table|Step|Section|Chapter|Page|Shot|Scene|Part|Item|Note|Appendix|Version|Level|Phase|Round|Room|Floor|Line|Act|Episode|Season|Slide|Clip|Take)$/,ul=/\b(\d{1,5}[ \t]+(?:[A-Z][A-Za-z'-]*[ \t]+){1,3}(?:Street|St|Road|Rd|Avenue|Ave|Boulevard|Blvd|Lane|Ln|Drive|Way|Court|Ct|Place|Pl)\b\.?)/,fl=/\b(?:policy|claim|account|member|customer|client|contract|case|reference|ref|company|registration)[ \t]+(?:number|no\.?|num\.?|#)[ \t]*:?[ \t]*([A-Z]{0,4}-?\d[\d-]{3,}\d[A-Z]?)\b/i,pl=String.raw`\d{1,2}[\/\-.]\d{1,2}[\/\-.]\d{2,4}|\d{4}[\/\-.]\d{1,2}[\/\-.]\d{1,2}|\d{1,2}\s+[A-Z][a-z]{2,8}\s+\d{4}|[A-Z][a-z]{2,8}\s+\d{1,2},?\s+\d{4}`,hl=new RegExp(String.raw`\b(?:date\s+of\s+birth|birth\s*date|d\.?o\.?b\.?|born(?:\s+on)?)\s*[:\-]?\s*(${pl})`,"i"),ml=/\b((?!000|666|9\d\d)\d{3}-(?!00)\d{2}-(?!0000)\d{4})\b/,gl=/\b((?!BG|GB|NK|KN|TN|NT|ZZ)[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Z]\s?\d{2}\s?\d{2}\s?\d{2}\s?[A-D])\b/,yl=/(?<![\w+])(\+(?!972)[1-9][\d\s().-]{7,20}\d)/,Cs=e=>e.replace(/\D/g,"").length,bl=String.raw`(?:(?<![א-ת])ת["'׳״]?\.?ז\.?|תעודת[\s_]?זהות|מספר[\s_]?זהות|מס['׳]?[\s_]?זהות|\bID[ \t]*(?:No\.?|Number|#)|\bnational[ \t]+ID|\bidentity[ \t]+(?:No\.?|number)|\bteudat[\s_]?zehut)`,_l=new RegExp(String.raw`${bl}[ \t]*[:#.\-]?[ \t]*(\d[\d \t-]{6,10}\d)(?![\d-])`,"i"),xl=e=>{let t=e.replace(/\D/g,"");return t.length!==8&&t.length!==9||/^\d{9}$/.test(e)||/^\d{8}-\d$/.test(e)?!1:Ne(t)},wl=/(?:(?<![א-ת])דרכון|\bpassport(?:[ \t]*(?:No\.?|Number|#))?)[ \t]*[:#.\-]?[ \t]*([A-Z]{0,2}\d{6,9})(?![\dA-Z])/i,kl=[{kind:"name",severity:"medium",hint:"A person's name in free text (after Mr. / Dr. / Client: \u2026, or with an age beside it).",find:e=>[...W(al,e),...W(cl,e),...W(ll,e,t=>!t.split(/[ \t]/).some(r=>dl.test(r)))]},{kind:"address",severity:"medium",hint:"A street address in plaintext.",find:e=>W(ul,e)},{kind:"reference",severity:"medium",hint:"A policy, claim, account or company number in plaintext.",find:e=>W(fl,e)},{kind:"dob",severity:"medium",hint:"A date of birth in plaintext.",find:e=>W(hl,e)},{kind:"national_id",severity:"high",hint:"A national ID number (an Israeli ID after its word, US SSN, UK NINO) in plaintext.",find:e=>[...W(ml,e),...W(gl,e),...W(_l,e,xl)]},{kind:"passport",severity:"high",hint:"A passport number, after the word that announces it, in plaintext.",find:e=>W(wl,e)},{kind:"phone",severity:"high",hint:"A phone number in international form in plaintext.",find:e=>W(yl,e,t=>Cs(t)>=8&&Cs(t)<=15)}];function vl(e){let t=new Map;for(let r of e){let n=t.get(r.kind);t.set(r.kind,n?{...n,find:s=>[...n.find(s),...r.find(s)]}:r)}return[...t.values()]}function Ps(){let e=sl.map(({type:t,kind:r,severity:n,hint:s})=>{let i=new xe([t]);return{kind:r,severity:n,hint:s,find:o=>i.detect(o).map(a=>ol(o,a.startIndex,a.endIndex,r))}});return vl([...e,...kl])}var we={_comment:"CANONICAL secret ruleset \u2014 the SINGLE SOURCE OF TRUTH for hardcoded-secret detection, loaded by BOTH the web scanner (lib/soc/exposure-map.ts) and the installed Capsule agent (apps/desktop/src-tauri/src/scanner.rs, via include_str!). Patterns are written in the regex subset both JavaScript and the Rust `regex` crate accept (no lookaround, no backreferences). A connection string counts only WITH credentials (user:pass@). Edit here once and both engines stay aligned.",rules:[{id:"aws-access-key",subkind:"aws_access_key",name:"AWS Access Key",severity:"critical",pattern:"(?:^|[^A-Z0-9])AKIA(?!X{16})[A-Z2-7]{16}(?:[^A-Z2-7]|$)",hint:"AWS access key id detected. Rotate via IAM and move to an environment variable."},{id:"aws-secret-key",subkind:"aws_secret_key",name:"AWS Secret Key",severity:"critical",pattern:`(?:aws_secret_access_key|aws_secret_key|secret_access_key)\\s*[=:]\\s*['"]?[A-Za-z0-9/+=]{40}['"]?`,hint:"AWS secret access key detected. Rotate immediately."},{id:"gcp-api-key",subkind:"gcp_api_key",name:"GCP API Key",severity:"critical",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Google API key detected. Restrict or rotate it in the Google Cloud console."},{id:"gcp-service-account",subkind:"gcp_service_account",name:"GCP Service Account",severity:"critical",pattern:'"type"\\s*:\\s*"service_account"',hint:"GCP service-account JSON detected. Move it out of the repo and rotate the key."},{id:"github-token",subkind:"github_token",name:"GitHub Token",severity:"critical",pattern:"gh[pousr]_[0-9a-zA-Z]{36,}",hint:"GitHub token detected. Revoke at https://github.com/settings/tokens."},{id:"github-fine-grained",subkind:"github_fine_grained_token",name:"GitHub Fine-Grained Token",severity:"critical",pattern:"github_pat_[0-9a-zA-Z_]{22,}",hint:"GitHub fine-grained token detected. Revoke it in GitHub settings."},{id:"gitlab-token",subkind:"gitlab_token",name:"GitLab Token",severity:"critical",pattern:"glpat-[0-9a-zA-Z_-]{20,}",hint:"GitLab token detected. Revoke it in GitLab access tokens."},{id:"stripe-secret",subkind:"stripe_key",name:"Stripe Secret Key",severity:"critical",pattern:"sk_live_[0-9a-zA-Z]{24,}",hint:"Stripe live secret key detected. Roll it in the Stripe dashboard."},{id:"stripe-restricted",subkind:"stripe_restricted_key",name:"Stripe Restricted Key",severity:"critical",pattern:"rk_live_[0-9a-zA-Z]{24,}",hint:"Stripe restricted key detected. Roll it in the Stripe dashboard."},{id:"slack-token",subkind:"slack_token",name:"Slack Token",severity:"high",pattern:"xox[baprs]-[0-9a-zA-Z-]{10,}",hint:"Slack token detected. Revoke it in the Slack app settings."},{id:"slack-webhook",subkind:"slack_webhook",name:"Slack Webhook",severity:"high",pattern:"hooks\\.slack\\.com/services/T[0-9A-Z]{8,}/B[0-9A-Z]{8,}/[0-9a-zA-Z]{24}",hint:"Slack incoming-webhook URL detected. Regenerate it."},{id:"twilio-api-key",subkind:"twilio_api_key",name:"Twilio API Key",severity:"high",pattern:"SK[0-9a-fA-F]{32}",hint:"Twilio API key detected. Rotate it in the Twilio console."},{id:"sendgrid-api-key",subkind:"sendgrid_api_key",name:"SendGrid API Key",severity:"critical",pattern:"SG\\.[0-9a-zA-Z_-]{22}\\.[0-9a-zA-Z_-]{43}",hint:"SendGrid API key detected. Rotate it in the SendGrid console."},{id:"postgres-uri",subkind:"postgres_uri",name:"PostgreSQL Connection String",severity:"critical",pattern:`postgres(?:ql)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"PostgreSQL connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"mongodb-uri",subkind:"mongodb_uri",name:"MongoDB Connection String",severity:"critical",pattern:`mongodb(?:\\+srv)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"MongoDB connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"redis-uri",subkind:"redis_uri",name:"Redis Connection String",severity:"high",pattern:`redis(?:s)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"Redis connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"openai-key",subkind:"openai_key",name:"OpenAI API Key",severity:"critical",pattern:"sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}",hint:"OpenAI API key detected. Rotate at https://platform.openai.com/api-keys."},{id:"anthropic-key",subkind:"anthropic_key",name:"Anthropic API Key",severity:"critical",pattern:"sk-ant-[0-9a-zA-Z_-]{40,}",hint:"Anthropic API key detected. Rotate at https://console.anthropic.com/."},{id:"firebase-key",subkind:"firebase_key",name:"Firebase API Key",severity:"high",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Firebase API key detected. Restrict it in the Firebase console."},{id:"supabase-key",subkind:"supabase_key",name:"Supabase Service Key",severity:"critical",pattern:"eyJ[0-9a-zA-Z_-]{100,}",hint:"Long JWT (possible Supabase service key) detected. Rotate it and keep it server-side only."},{id:"private-key",subkind:"private_key",name:"Private Key",severity:"critical",pattern:"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",hint:"Private key material in plaintext. Rotate immediately and move to a key manager (KMS/Vault).",skipPlaceholder:!0},{id:"jwt-secret",subkind:"jwt_secret",name:"JWT/Generic Secret",severity:"high",pattern:`(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded signing/API secret detected. Move it to an environment variable and rotate it."},{id:"password-in-code",subkind:"password_in_code",name:"Password in Code",severity:"high",pattern:`(?:password|passwd|pwd)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded password detected. Move it to a secret manager and rotate it."},{id:"bearer-token",subkind:"bearer_token",name:"Bearer Token in Code",severity:"high",pattern:`['"]Bearer\\s+[0-9a-zA-Z._-]{20,}['"]`,hint:"Hardcoded bearer token detected. Move it to a secret manager and rotate it."},{id:"hex-secret-32",subkind:"hex_secret",name:"Hardcoded 32+ Hex Secret",severity:"medium",pattern:`['"][0-9a-f]{32,}['"]`,hint:"Long hex string that looks like a secret/hash. Confirm it is not a live credential."},{id:"base64-secret",subkind:"base64_secret",name:"Hardcoded Base64 Secret (long)",severity:"medium",pattern:`['"][A-Za-z0-9+/]{64,}={0,2}['"]`,hint:"Long base64 blob that looks like an embedded secret. Confirm it is not a live credential."}]};var Al=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name",labelHe:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA \u05D0\u05D9\u05DE\u05D9\u05D9\u05DC"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05DE\u05D6\u05D4\u05D4"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth",labelHe:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account",labelHe:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card",labelHe:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Financial data",labelHe:"\u05E0\u05EA\u05D5\u05DF \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication)$/i,type:"medical",label:"Medical data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(ip_?address)$/i,type:"tracking",label:"IP address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA IP"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D3\u05E8\u05DB\u05D5\u05DF"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license",labelHe:"\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4"},{pattern:/^(iban|swift_?code|bic)$/i,type:"financial",label:"Banking code",labelHe:"\u05E7\u05D5\u05D3 \u05D1\u05E0\u05E7\u05D0\u05D9"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05DE\u05E1"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Member ID",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D1\u05D9\u05D8\u05D5\u05D7/\u05D7\u05D1\u05E8"},{pattern:/^(blood_?type|allergy|allergies|prescription)$/i,type:"medical",label:"Medical data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation",labelHe:"\u05DE\u05D9\u05E7\u05D5\u05DD \u05D2\u05D9\u05D0\u05D5\u05D2\u05E8\u05E4\u05D9"},{pattern:/^(mac_?address|device_?fingerprint|imei|serial_?number)$/i,type:"tracking",label:"Device identifier",labelHe:"\u05DE\u05D6\u05D4\u05D4 \u05DE\u05DB\u05E9\u05D9\u05E8"},{pattern:/^(ethnicity|race|religion|political_?affiliation|sexual_?orientation)$/i,type:"sensitive_personal",label:"Sensitive personal",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(minor|child_?name|child_?age|dependent)$/i,type:"minor_data",label:"Minor data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05E0\u05D9\u05DD"},{pattern:/^(signature|digital_?signature)$/i,type:"id",label:"Signature",labelHe:"\u05D7\u05EA\u05D9\u05DE\u05D4"},{pattern:/^(vehicle_?number|license_?plate|plate_?number)$/i,type:"tracking",label:"Vehicle ID",labelHe:"\u05DE\u05D6\u05D4\u05D4 \u05E8\u05DB\u05D1"}],$l=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|sort_?order|position|enabled|active|public|version|metadata|config|settings|options|data|content|body|raw|json|text|note|comment|label|color|icon|image|avatar|logo|thumbnail|preview|template|schema|format|mode|level|priority|severity|source|target|parent|child|owner|creator|modifier|assignee|project|workspace|organization|team|group|channel|thread|room|session|device|platform|browser|locale|timezone|currency|country|region|city|zip|postal|state|province|name|display_?name|user_?agent|password_?hash|secret|token|private_?key|auth_?token|constraint|index|sequence|trigger|function|procedure|database|namespace|migration|revision)$/i,Rl=/^(beacon_?registr|device_?config|hardware|sensor|firmware|telemetry|metric|analytic|log_?event|audit_?log|system_?config|cache|queue|job|migration|schema_?version|spatial_?ref)/i,Tl=/^(minor|major|uuid|rssi|tx_?power|beacon_?id|device_?type|firmware_?version|batch_?id|zone_?id)$/i;function Ls(e,t){if($l.test(e)||/^name$/i.test(e)||t&&Rl.test(t)||Tl.test(e))return null;for(let n of Al)if(n.pattern.test(e))return n.type;let r=Rs(e);return r?r.type:null}var ah=we.rules.map(e=>({id:e.id,name:e.name,pattern:new RegExp(e.pattern),severity:e.severity}));var ch=512*1024,lh=50*1024*1024;var Il=new Set(["hex-secret-32","base64-secret"]),bh=we.rules.filter(e=>!Il.has(e.id)).map(e=>new RegExp(e.pattern,"g"));var Os={id:"critical",agent_id:"high",policy:"high",financial:"critical",medical:"critical",sensitive_personal:"critical",minor_data:"critical",biometric:"critical",auth:"critical",name:"high",email:"high",phone:"high",address:"high",dob:"high",location:"high",tracking:"medium",employment:"high",education:"medium",behavior:"high"};function Ds(e){return Os[e]}function Cl(e){return Os[e]??"low"}function Fs(e,t){let r=[];for(let n of t){let s=n.rows.length;for(let i=0;i<n.headers.length;i++){let o=n.headers[i]??"",a=o?Ls(o.trim().replace(/["'`׳״:]/g,"").replace(/\s+/g,"_"),n.name)??kt(o)?.type??null:null,c=[];for(let f of n.rows){let d=f[i];typeof d=="string"&&d.length>0&&c.push(d)}let l=c.length>0?Ts(c):null;l?r.push(Ns(e,n.name,o,l.type,l.label,"value",l.matchedSample,s)):a&&r.push(Ns(e,n.name,o,a,vt(a),"header",0,s))}}return r}function Ns(e,t,r,n,s,i,o,a){return{file:e,location:t,column:r,type:n,label:s,category:vt(n),severity:Cl(n),matchKind:i,hits:o,sampleSize:a}}var Pl=new Set(["hex-secret-32","base64-secret"]),Ll=[/(?:[$€£]|USD|EUR|GBP)\s?\d[\d,]*(?:\.\d+)?/g,/\d[\d,]*(?:\.\d+)?\s?(?:[$€£]|USD|EUR|GBP|דולר|יורו)/g,/\b\d{1,3}(?:,\d{3})+(?:\.\d+)?\b/g];function Nl(e){let t=new xe(["financial_amount"]);return{kind:"amount",severity:"medium",hint:"A money amount (the amounts dial is on: amounts are treated as sensitive here).",find:r=>{if(!e())return[];let n=t.detect(r).map(i=>({start:i.startIndex,end:i.endIndex}));for(let i of Ll){i.lastIndex=0;for(let o of r.matchAll(i))n.push({start:o.index,end:o.index+o[0].length})}n.sort((i,o)=>i.start-o.start||o.end-i.end);let s=[];for(let i of n){let o=s[s.length-1];o&&i.start<o.end?o.end=Math.max(o.end,i.end):s.push({...i})}return s}}}function Ms(e={}){let t=e.amounts??(()=>!1),r=[...Ps(),Nl(t)],n=we.rules.filter(s=>!Pl.has(s.id)).map(s=>({id:s.id,name:s.name,severity:s.severity,pattern:new RegExp(s.pattern)}));return{text:r,amounts:t,header:s=>{let i=kt(s);return i?{type:i.type,label:i.labelHe||i.label}:null},secrets:n,table:s=>Fs("",[s]).filter(i=>i.column).map(i=>({column:i.column,type:i.type,category:i.category,severity:i.severity,hits:i.hits,how:i.matchKind==="value"?"value":"header"})),severity:s=>Ds(s)}}var js=!1;function Hs(){js||(js=!0,St(Ms({amounts:Pr})))}Hs();Ss(process.argv.slice(2)).catch(()=>{process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"ask",permissionDecisionReason:"NoData could not check this file before it is read. Allow anyway?"}}))});
|
|
77
|
+
`)});g.first&&g.value&&process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PostToolUse",additionalContext:g.value}}));return}let h=await pn(d,"pre",()=>ll(c,a.tool_input??{},a.cwd??process.cwd(),t,fl(l,a),a.session_id,f)),p=h.value;if(p.decision==="allow"){h.first&&p.kind&&ks(c,p);return}h.first&&ks(c,p),process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:p.decision,permissionDecisionReason:p.reason}}))}var hl="claude-code",mh=` --host ${hl}`;var ml=[{type:"id_number",patterns:[/\b\d{9}\b/g,/ת\.?ז\.?\s*:?\s*(\d{9})/g,/זהות\s*:?\s*(\d{9})/g],confidence:.9,replacement:()=>"[\u05EA.\u05D6. \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"phone",patterns:[/\b0[2-9]\d[\s\-]?\d{7}\b/g,/\b05[0-9][\s\-]?\d{7}\b/g,/\+972[\s\-]?[2-9]\d[\s\-]?\d{7}\b/g],confidence:.95,replacement:()=>"[\u05D8\u05DC\u05E4\u05D5\u05DF \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"email",patterns:[/[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}/g],confidence:.99,replacement:e=>{let[,t]=e.split("@");return`[\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC: ***@${t}]`}},{type:"full_name",patterns:[/(?:לקוח|מטופל|מועמד|שם|נהג|מבוטח|תובע|נתבע|שוכר|מחזיק)[:\s]+([א-ת][א-ת"'\-\s]{2,30}?)(?=[,\n\d]|ת\.ז)/g,/(?:עו"ד|ד"ר|פרופ'|מר|גברת)\s+([א-ת][א-ת"'\-\s]{2,25}?)(?=[,\n])/g],confidence:.75,replacement:()=>"[\u05E9\u05DD \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"bank_account",patterns:[/\b\d{2}[\-]\d{5,9}[\-]\d{2,3}\b/g,/(?:חשבון|ח-ן)\s*:?\s*(\d[\d\-]{8,15})/g],confidence:.88,replacement:()=>"[\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"medical",patterns:[/(?<![א-ת])[בהוכלמש]{0,2}(?:סוכרת|יתר לחץ דם|אסתמה|דיכאון|חרדה|סרטן|אי ספיקת לב|אפילפסיה)(?![א-ת])/g,/\b(?:Metformin|Lisinopril|Atorvastatin|Amlodipine|Sertraline|Fluoxetine|Omeprazole|Warfarin|Aspirin|Insulin)\b/gi,/\bHbA1c\s*:?\s*[\d.]+%?/g,/\bBMI\s*:?\s*[\d.]+/g,/(?<![א-ת])[בהוכלמש]{0,2}אבחנ[הות]\s*:?\s*[^,\n.]{2,40}/g,/\b(?:Diagnosis|diagnosed\s+with)\s*:?\s*[^,\n.]{2,40}/gi,/\b(?:(?:type\s*[12]\s+)?diabetes(?:\s+mellitus)?|hypertension|asthma|epilepsy|schizophrenia|bipolar\s+disorder|HIV|hepatitis(?:\s+[A-C]\b)?|heart\s+failure|COPD|multiple\s+sclerosis|Crohn'?s\s+disease)\b/gi,/(?<![א-ת])[בהוכלמש]{0,2}(?:אינסולין|מטפורמין|אספירין|קומדין|אומפרדקס|פרוזק|ציפרלקס|אטורבסטטין|אמלודיפין)(?![א-ת])/g],confidence:.85,replacement:()=>"[\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"financial_amount",patterns:[/[\d,]+(?:\.\d{2})?\s*(?:₪|ש"ח|NIS|שקל(?:ים)?)/g,/(?:₪|NIS)\s*[\d,]+(?:\.\d{2})?/g],confidence:.92,replacement:()=>"[\u05E1\u05DB\u05D5\u05DD \u05DB\u05E1\u05E4\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"birth_date",patterns:[/(?:תאריך לידה|נולד|נולדה|ד\.ל\.)\s*:?\s*\d{1,2}[\/\.\-]\d{1,2}[\/\.\-]\d{2,4}/g,/(?<![א-ת])[בהוכלמש]{0,2}גיל\s*:?\s*\d{1,3}\b/g],confidence:.88,replacement:()=>"[\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"address",patterns:[/רחוב\s+[א-ת][א-ת\s"'\-]{2,30}\s+\d{1,5}/g,/(?:רח'|רח\.)\s+[א-ת][א-ת\s"'\-]{2,30}\d{1,5}/g],confidence:.72,replacement:()=>"[\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D5\u05E1\u05EA\u05E8\u05EA]"},{type:"license_plate",patterns:[/\b\d{2,3}[\-]\d{2,3}[\-]\d{2,3}\b/g],confidence:.8,replacement:()=>"[\u05DC\u05D5\u05D7\u05D9\u05EA \u05E8\u05D9\u05E9\u05D5\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8\u05EA]"}];function gl(e){if(e.length!==9)return!1;let t=e.split("").map(Number),r=0;for(let n=0;n<9;n++){let s=t[n]*(n%2===0?1:2);s>9&&(s-=9),r+=s}return r%10===0}var xe=class{constructor(t){this.enabledTypes=new Set(t)}detect(t){let r=[],n=new Set;for(let o of ml)if(this.enabledTypes.has(o.type))for(let i of o.patterns){let a=new RegExp(i.source,i.flags),c;for(;(c=a.exec(t))!==null;){let l=c[0],f=`${o.type}:${c.index}`;if(!n.has(f)){if(n.add(f),o.type==="id_number"){let d=l.replace(/\D/g,"");if(/^\d{9}$/.test(l)&&d.length===9&&!gl(d))continue}r.push({type:o.type,value:l,startIndex:c.index,endIndex:c.index+l.length,confidence:o.confidence,replacement:o.replacement(l,o.type)})}}}r.sort((o,i)=>o.startIndex-i.startIndex||i.confidence-o.confidence);let s=[];for(let o of r)s.some(a=>o.startIndex<a.endIndex&&o.endIndex>a.startIndex)||s.push(o);return s}};var P=["GDPR","CPRA","PPL"],yl=["GDPR-9","CPRA","PPL"],bl=[{id:"person_name",type:"name",sensitivity:"high",regulations:[...P],en:["firstname","lastname","fname","lname","middle name","maiden name","birth name","preferred name","display name","nickname","surname","given name","full name"],he:["\u05E9\u05DD \u05E4\u05E8\u05D8\u05D9","\u05E9\u05DD \u05DE\u05E9\u05E4\u05D7\u05D4","\u05E9\u05DD \u05DE\u05DC\u05D0","\u05DB\u05D9\u05E0\u05D5\u05D9","\u05E9\u05DD \u05E0\u05E2\u05D5\u05E8\u05D9\u05DD"],ar:["\u0627\u0644\u0627\u0633\u0645","\u0627\u0633\u0645 \u0627\u0644\u0639\u0627\u0626\u0644\u0629","\u0627\u0644\u0627\u0633\u0645 \u0627\u0644\u0643\u0627\u0645\u0644"],ru:["\u0438\u043C\u044F","\u0444\u0430\u043C\u0438\u043B\u0438\u044F","\u043E\u0442\u0447\u0435\u0441\u0442\u0432\u043E","\u0444\u0438\u043E"]},{id:"birth_place",type:"location",sensitivity:"medium",regulations:[...P],en:["birth place","birthplace","place of birth"],he:["\u05DE\u05E7\u05D5\u05DD \u05DC\u05D9\u05D3\u05D4","\u05D0\u05E8\u05E5 \u05DC\u05D9\u05D3\u05D4"],ar:["\u0645\u0643\u0627\u0646 \u0627\u0644\u0645\u064A\u0644\u0627\u062F"],ru:["\u043C\u0435\u0441\u0442\u043E \u0440\u043E\u0436\u0434\u0435\u043D\u0438\u044F"]},{id:"citizenship",type:"sensitive_personal",sensitivity:"high",regulations:[...P],en:["citizenship","nationality"],he:["\u05D0\u05D6\u05E8\u05D7\u05D5\u05EA","\u05DC\u05D0\u05D5\u05DD"],ar:["\u0627\u0644\u062C\u0646\u0633\u064A\u0629"],ru:["\u0433\u0440\u0430\u0436\u0434\u0430\u043D\u0441\u0442\u0432\u043E"]},{id:"marital_status",type:"sensitive_personal",sensitivity:"high",regulations:[...P],en:["marital status"],he:["\u05DE\u05E6\u05D1 \u05DE\u05E9\u05E4\u05D7\u05EA\u05D9"],ar:["\u0627\u0644\u062D\u0627\u0644\u0629 \u0627\u0644\u0627\u062C\u062A\u0645\u0627\u0639\u064A\u0629"],ru:["\u0441\u0435\u043C\u0435\u0439\u043D\u043E\u0435 \u043F\u043E\u043B\u043E\u0436\u0435\u043D\u0438\u0435"]},{id:"government_id",type:"id",sensitivity:"critical",regulations:[...P],en:["ssn","national id","passport","driver license","drivers license","tax id","social security","national insurance","military id","voter id","resident id","residence permit","visa number"],he:["\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA","\u05D3\u05E8\u05DB\u05D5\u05DF","\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4","\u05DE\u05E1\u05E4\u05E8 \u05D1\u05D9\u05D8\u05D5\u05D7 \u05DC\u05D0\u05D5\u05DE\u05D9","\u05DE\u05E1\u05E4\u05E8 \u05D0\u05D9\u05E9\u05D9","\u05DE\u05E1\u05E4\u05E8 \u05D5\u05D9\u05D6\u05D4","\u05EA\u05E2\u05D5\u05D3\u05EA \u05EA\u05D5\u05E9\u05D1","\u05DE\u05E1\u05E4\u05E8 \u05E2\u05D5\u05E1\u05E7"],ar:["\u0631\u0642\u0645 \u0627\u0644\u0647\u0648\u064A\u0629","\u062C\u0648\u0627\u0632 \u0627\u0644\u0633\u0641\u0631","\u0631\u062E\u0635\u0629 \u0627\u0644\u0642\u064A\u0627\u062F\u0629"],ru:["\u043F\u0430\u0441\u043F\u043E\u0440\u0442","\u0441\u043D\u0438\u043B\u0441","\u0438\u043D\u043D","\u0432\u043E\u0434\u0438\u0442\u0435\u043B\u044C\u0441\u043A\u043E\u0435 \u0443\u0434\u043E\u0441\u0442\u043E\u0432\u0435\u0440\u0435\u043D\u0438\u0435"]},{id:"institution_person_id",type:"tracking",sensitivity:"medium",regulations:[...P],en:["employee id","employee number","employee no","student id","student number","user id","userid","customer id","customer number","customer no","client id","member id","subscriber id","participant id","profile id","person id","person uuid","lead id","crm contact","account id"],he:["\u05DE\u05E1\u05E4\u05E8 \u05E2\u05D5\u05D1\u05D3","\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D8\u05D5\u05D3\u05E0\u05D8","\u05DE\u05E1\u05E4\u05E8 \u05DC\u05E7\u05D5\u05D7","\u05DE\u05D6\u05D4\u05D4 \u05DC\u05E7\u05D5\u05D7","\u05DE\u05E1\u05E4\u05E8 \u05DE\u05E0\u05D5\u05D9","\u05DE\u05D6\u05D4\u05D4 \u05DE\u05E9\u05EA\u05DE\u05E9"],ar:["\u0631\u0642\u0645 \u0627\u0644\u0645\u0648\u0638\u0641","\u0631\u0642\u0645 \u0627\u0644\u0639\u0645\u064A\u0644"],ru:["\u0442\u0430\u0431\u0435\u043B\u044C\u043D\u044B\u0439 \u043D\u043E\u043C\u0435\u0440","\u043D\u043E\u043C\u0435\u0440 \u043A\u043B\u0438\u0435\u043D\u0442\u0430"]},{id:"patient_id",type:"medical",sensitivity:"critical",regulations:["GDPR-9","HIPAA","PPL"],en:["patient id","patient number","mrn","medical record number"],he:["\u05DE\u05E1\u05E4\u05E8 \u05DE\u05D8\u05D5\u05E4\u05DC","\u05DE\u05E1\u05E4\u05E8 \u05EA\u05D9\u05E7 \u05E8\u05E4\u05D5\u05D0\u05D9"],ar:["\u0631\u0642\u0645 \u0627\u0644\u0645\u0631\u064A\u0636"],ru:["\u043D\u043E\u043C\u0435\u0440 \u043F\u0430\u0446\u0438\u0435\u043D\u0442\u0430"]},{id:"email",type:"email",sensitivity:"high",regulations:[...P],en:["emailaddress","e mail","recovery email","contact email"],he:["\u05D3\u05D5\u05D0\u05DC","\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC"],ar:["\u0627\u0644\u0628\u0631\u064A\u062F \u0627\u0644\u0625\u0644\u0643\u062A\u0631\u0648\u0646\u064A"],ru:["\u043F\u043E\u0447\u0442\u0430","\u044D\u043B\u0435\u043A\u0442\u0440\u043E\u043D\u043D\u0430\u044F \u043F\u043E\u0447\u0442\u0430","email"]},{id:"phone",type:"phone",sensitivity:"high",regulations:[...P],en:["cellphone","contact number","work phone","home phone","whatsapp","recovery phone","telephone"],he:["\u05D8\u05DC\u05E4\u05D5\u05DF \u05D1\u05D9\u05EA","\u05D8\u05DC\u05E4\u05D5\u05DF \u05E2\u05D1\u05D5\u05D3\u05D4","\u05D5\u05D5\u05D8\u05E1\u05D0\u05E4","\u05DE\u05E1\u05E4\u05E8 \u05E0\u05D9\u05D9\u05D3"],ar:["\u0647\u0627\u062A\u0641","\u0631\u0642\u0645 \u0627\u0644\u0647\u0627\u062A\u0641","\u062C\u0648\u0627\u0644"],ru:["\u0442\u0435\u043B\u0435\u0444\u043E\u043D","\u043C\u043E\u0431\u0438\u043B\u044C\u043D\u044B\u0439"]},{id:"social_handle",type:"tracking",sensitivity:"medium",regulations:[...P],en:["telegram","linkedin","facebook","twitter","instagram","tiktok","social profile"],he:["\u05D8\u05DC\u05D2\u05E8\u05DD","\u05DC\u05D9\u05E0\u05E7\u05D3\u05D0\u05D9\u05DF","\u05E4\u05D9\u05D9\u05E1\u05D1\u05D5\u05E7","\u05D0\u05D9\u05E0\u05E1\u05D8\u05D2\u05E8\u05DD"]},{id:"address",type:"address",sensitivity:"high",regulations:[...P],en:["house number","apartment","apt","billing address","shipping address","postal code","zip code","postcode","street"],he:["\u05DE\u05E1\u05E4\u05E8 \u05D1\u05D9\u05EA","\u05D3\u05D9\u05E8\u05D4","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DC\u05DE\u05E9\u05DC\u05D5\u05D7","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DC\u05D7\u05D9\u05D5\u05D1","\u05EA.\u05D3","\u05EA\u05D0 \u05D3\u05D5\u05D0\u05E8"],ar:["\u0627\u0644\u0639\u0646\u0648\u0627\u0646","\u0627\u0644\u0634\u0627\u0631\u0639","\u0627\u0644\u0631\u0645\u0632 \u0627\u0644\u0628\u0631\u064A\u062F\u064A"],ru:["\u0430\u0434\u0440\u0435\u0441","\u0443\u043B\u0438\u0446\u0430","\u0438\u043D\u0434\u0435\u043A\u0441","\u043A\u0432\u0430\u0440\u0442\u0438\u0440\u0430"]},{id:"geo",type:"location",sensitivity:"high",regulations:[...P],en:["geo location","geolocation","latitude","longitude","coordinates","home location","current location"],he:["\u05DE\u05D9\u05E7\u05D5\u05DD","\u05E7\u05D5\u05D0\u05D5\u05E8\u05D3\u05D9\u05E0\u05D8\u05D5\u05EA"],ar:["\u0627\u0644\u0645\u0648\u0642\u0639"],ru:["\u043C\u0435\u0441\u0442\u043E\u043F\u043E\u043B\u043E\u0436\u0435\u043D\u0438\u0435","\u043A\u043E\u043E\u0440\u0434\u0438\u043D\u0430\u0442\u044B"]},{id:"bank_card",type:"financial",sensitivity:"critical",regulations:[...P],en:["bank account","iban","swift","bic","routing number","credit card","creditcard","card number","cvv","card expiry","cc exp","paypal","wallet address","crypto wallet","bitcoin address"],he:["\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7","\u05DE\u05E1\u05E4\u05E8 \u05D7\u05E9\u05D1\u05D5\u05DF","\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9","\u05D0\u05E8\u05E0\u05E7 \u05E7\u05E8\u05D9\u05E4\u05D8\u05D5","\u05D0\u05E8\u05E0\u05E7 \u05D3\u05D9\u05D2\u05D9\u05D8\u05DC\u05D9"],ar:["\u062D\u0633\u0627\u0628 \u0628\u0646\u0643\u064A","\u0631\u0642\u0645 \u0627\u0644\u062D\u0633\u0627\u0628","\u0628\u0637\u0627\u0642\u0629 \u0627\u0626\u062A\u0645\u0627\u0646"],ru:["\u0440\u0430\u0441\u0447\u0435\u0442\u043D\u044B\u0439 \u0441\u0447\u0435\u0442","\u043D\u043E\u043C\u0435\u0440 \u0441\u0447\u0435\u0442\u0430","\u043D\u043E\u043C\u0435\u0440 \u043A\u0430\u0440\u0442\u044B","\u043A\u0440\u0435\u0434\u0438\u0442\u043D\u0430\u044F \u043A\u0430\u0440\u0442\u0430"]},{id:"income_tax",type:"financial",sensitivity:"high",regulations:[...P],en:["salary","income","wage","tax record","tax return","payment history","credit score","net worth","salary grade"],he:["\u05E9\u05DB\u05E8","\u05DE\u05E9\u05DB\u05D5\u05E8\u05EA","\u05D4\u05DB\u05E0\u05E1\u05D4","\u05EA\u05DC\u05D5\u05E9 \u05E9\u05DB\u05E8","\u05D3\u05D5\u05D7 \u05DE\u05E1","\u05D4\u05D9\u05E1\u05D8\u05D5\u05E8\u05D9\u05D9\u05EA \u05EA\u05E9\u05DC\u05D5\u05DE\u05D9\u05DD","\u05D3\u05D9\u05E8\u05D5\u05D2 \u05D0\u05E9\u05E8\u05D0\u05D9","\u05E9\u05D5\u05D5\u05D9 \u05E0\u05E7\u05D9","\u05D3\u05E8\u05D2\u05EA \u05E9\u05DB\u05E8"],ar:["\u0627\u0644\u0631\u0627\u062A\u0628","\u0627\u0644\u062F\u062E\u0644"],ru:["\u0437\u0430\u0440\u043F\u043B\u0430\u0442\u0430","\u0434\u043E\u0445\u043E\u0434"]},{id:"assets",type:"financial",sensitivity:"high",regulations:[...P],en:["property id","land record","ownership record","title deed","holdings"],he:["\u05D2\u05D5\u05E9 \u05D7\u05DC\u05E7\u05D4","\u05E0\u05E1\u05D7 \u05D8\u05D0\u05D1\u05D5","\u05E8\u05D9\u05E9\u05D5\u05DD \u05DE\u05E7\u05E8\u05E7\u05E2\u05D9\u05DF","\u05D1\u05E2\u05DC\u05D5\u05EA","\u05D0\u05D7\u05D6\u05E7\u05D5\u05EA"],ru:["\u0441\u043E\u0431\u0441\u0442\u0432\u0435\u043D\u043D\u043E\u0441\u0442\u044C","\u043D\u0435\u0434\u0432\u0438\u0436\u0438\u043C\u043E\u0441\u0442\u044C"]},{id:"vehicle",type:"tracking",sensitivity:"medium",regulations:[...P],en:["vin","vehicle id","license plate","registration number","plate number"],he:["\u05DE\u05E1\u05E4\u05E8 \u05E9\u05DC\u05D3\u05D4","\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1","\u05DC\u05D5\u05D7\u05D9\u05EA \u05E8\u05D9\u05E9\u05D5\u05D9"],ru:["\u043D\u043E\u043C\u0435\u0440 \u0430\u0432\u0442\u043E\u043C\u043E\u0431\u0438\u043B\u044F","vin"]},{id:"health",type:"medical",sensitivity:"critical",regulations:["GDPR-9","HIPAA","PPL"],en:["medical record","health condition","health data","lab result","lab results","vaccination","mental health","hospitalization","hospitalisation","disability","insurance number","diagnosis","allergy","prescription","medication","blood type"],he:["\u05EA\u05D9\u05E7 \u05E8\u05E4\u05D5\u05D0\u05D9","\u05EA\u05D5\u05E6\u05D0\u05D5\u05EA \u05DE\u05E2\u05D1\u05D3\u05D4","\u05EA\u05D5\u05E6\u05D0\u05D5\u05EA \u05D1\u05D3\u05D9\u05E7\u05D4","\u05D7\u05D9\u05E1\u05D5\u05E0\u05D9\u05DD","\u05D1\u05E8\u05D9\u05D0\u05D5\u05EA \u05E0\u05E4\u05E9","\u05D0\u05E9\u05E4\u05D5\u05D6","\u05E0\u05DB\u05D5\u05EA","\u05DE\u05E6\u05D1 \u05D1\u05E8\u05D9\u05D0\u05D5\u05EA\u05D9"],ar:["\u0627\u0644\u062A\u0634\u062E\u064A\u0635","\u0627\u0644\u0633\u062C\u0644 \u0627\u0644\u0637\u0628\u064A","\u0627\u0644\u0623\u062F\u0648\u064A\u0629"],ru:["\u0434\u0438\u0430\u0433\u043D\u043E\u0437","\u043C\u0435\u0434\u0438\u0446\u0438\u043D\u0441\u043A\u0430\u044F \u043A\u0430\u0440\u0442\u0430","\u0430\u043D\u0430\u043B\u0438\u0437\u044B"]},{id:"biometric",type:"biometric",sensitivity:"critical",regulations:["GDPR-9","CPRA","PPL"],en:["face embedding","face scan","iris scan","retina scan","voice print","voiceprint","voice signature","hand geometry","biometric template","biometric data","dna","genetic data","genome"],he:["\u05D8\u05D1\u05D9\u05E2\u05EA \u05E7\u05D5\u05DC","\u05E1\u05E8\u05D9\u05E7\u05EA \u05E4\u05E0\u05D9\u05DD","\u05E1\u05E8\u05D9\u05E7\u05EA \u05E7\u05E9\u05EA\u05D9\u05EA","\u05E0\u05EA\u05D5\u05E0\u05D9\u05DD \u05D2\u05E0\u05D8\u05D9\u05D9\u05DD",'\u05D3\u05E0"\u05D0'],ar:["\u0628\u0635\u0645\u0629"],ru:["\u0431\u0438\u043E\u043C\u0435\u0442\u0440\u0438\u044F","\u043E\u0442\u043F\u0435\u0447\u0430\u0442\u043E\u043A"]},{id:"employment",type:"employment",sensitivity:"medium",regulations:[...P],en:["employer","job title","employment status","hire date","start date of employment","termination date","performance review","disciplinary"],he:["\u05DE\u05E2\u05E1\u05D9\u05E7","\u05DE\u05E7\u05D5\u05DD \u05E2\u05D1\u05D5\u05D3\u05D4","\u05EA\u05E4\u05E7\u05D9\u05D3 \u05D4\u05E2\u05D5\u05D1\u05D3","\u05EA\u05D0\u05E8\u05D9\u05DA \u05EA\u05D7\u05D9\u05DC\u05EA \u05E2\u05D1\u05D5\u05D3\u05D4","\u05EA\u05D0\u05E8\u05D9\u05DA \u05E1\u05D9\u05D5\u05DD \u05E2\u05D1\u05D5\u05D3\u05D4","\u05D4\u05E2\u05E8\u05DB\u05EA \u05D1\u05D9\u05E6\u05D5\u05E2\u05D9\u05DD","\u05E9\u05D9\u05DE\u05D5\u05E2"],ar:["\u062C\u0647\u0629 \u0627\u0644\u0639\u0645\u0644","\u0627\u0644\u0645\u0633\u0645\u0649 \u0627\u0644\u0648\u0638\u064A\u0641\u064A"],ru:["\u0440\u0430\u0431\u043E\u0442\u043E\u0434\u0430\u0442\u0435\u043B\u044C","\u0434\u043E\u043B\u0436\u043D\u043E\u0441\u0442\u044C"]},{id:"manager",type:"name",sensitivity:"medium",regulations:[...P],en:["manager","supervisor"],he:["\u05DE\u05E0\u05D4\u05DC \u05D9\u05E9\u05D9\u05E8"]},{id:"education",type:"education",sensitivity:"medium",regulations:[...P],en:["school","university","college","degree","transcript","education history","gpa"],he:["\u05D1\u05D9\u05EA \u05E1\u05E4\u05E8","\u05D0\u05D5\u05E0\u05D9\u05D1\u05E8\u05E1\u05D9\u05D8\u05D4","\u05DE\u05DB\u05DC\u05DC\u05D4","\u05D2\u05D9\u05DC\u05D9\u05D5\u05DF \u05E6\u05D9\u05D5\u05E0\u05D9\u05DD","\u05D4\u05E9\u05DB\u05DC\u05D4","\u05EA\u05D5\u05D0\u05E8 \u05D0\u05E7\u05D3\u05DE\u05D9"],ar:["\u0627\u0644\u062C\u0627\u0645\u0639\u0629","\u0627\u0644\u0645\u062F\u0631\u0633\u0629"],ru:["\u043E\u0431\u0440\u0430\u0437\u043E\u0432\u0430\u043D\u0438\u0435","\u0443\u043D\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442"]},{id:"device_online",type:"tracking",sensitivity:"medium",regulations:[...P],en:["ip","ipaddress","ip address","mac address","device id","deviceid","advertising id","idfa","gaid","android id","apple id","cookie id","cookieid","browser fingerprint","user agent","imei"],he:["\u05DB\u05EA\u05D5\u05D1\u05EA ip","\u05DE\u05D6\u05D4\u05D4 \u05DE\u05DB\u05E9\u05D9\u05E8"],ru:["ip \u0430\u0434\u0440\u0435\u0441"]},{id:"account",type:"tracking",sensitivity:"medium",regulations:[...P],en:["username","user name","login","screen name"],he:["\u05E9\u05DD \u05DE\u05E9\u05EA\u05DE\u05E9"],ru:["\u043B\u043E\u0433\u0438\u043D"]},{id:"credential",type:"auth",sensitivity:"critical",regulations:[...P],en:["password","password hash","mfa secret","otp secret","security question","security answer","session id","session token","api key"],he:["\u05E1\u05D9\u05E1\u05DE\u05D4","\u05E1\u05D9\u05E1\u05DE\u05D0","\u05E9\u05D0\u05DC\u05EA \u05D0\u05D1\u05D8\u05D7\u05D4"],ar:["\u0643\u0644\u0645\u0629 \u0627\u0644\u0645\u0631\u0648\u0631"],ru:["\u043F\u0430\u0440\u043E\u043B\u044C"]},{id:"behavior",type:"behavior",sensitivity:"high",regulations:[...P],en:["purchase history","search history","browsing history","clickstream","usage pattern","behavior profile","behaviour profile"],he:["\u05D4\u05D9\u05E1\u05D8\u05D5\u05E8\u05D9\u05D9\u05EA \u05E8\u05DB\u05D9\u05E9\u05D5\u05EA","\u05D4\u05D9\u05E1\u05D8\u05D5\u05E8\u05D9\u05D9\u05EA \u05D7\u05D9\u05E4\u05D5\u05E9","\u05D4\u05D9\u05E1\u05D8\u05D5\u05E8\u05D9\u05D9\u05EA \u05D2\u05DC\u05D9\u05E9\u05D4","\u05E4\u05E8\u05D5\u05E4\u05D9\u05DC \u05D4\u05EA\u05E0\u05D4\u05D2\u05D5\u05EA"]},{id:"special_category",type:"sensitive_personal",sensitivity:"critical",regulations:[...yl],en:["race","ethnicity","religion","political opinion","political party","union membership","trade union","sexual orientation","gender identity","criminal record"],he:["\u05D2\u05D6\u05E2","\u05D3\u05EA","\u05D4\u05E9\u05E7\u05E4\u05D4 \u05E4\u05D5\u05DC\u05D9\u05D8\u05D9\u05EA","\u05D7\u05D1\u05E8\u05D5\u05EA \u05D1\u05D0\u05D9\u05D2\u05D5\u05D3","\u05E0\u05D8\u05D9\u05D9\u05D4 \u05DE\u05D9\u05E0\u05D9\u05EA","\u05D6\u05D4\u05D5\u05EA \u05DE\u05D2\u05D3\u05E8\u05D9\u05EA","\u05E8\u05D9\u05E9\u05D5\u05DD \u05E4\u05DC\u05D9\u05DC\u05D9"],ar:["\u0627\u0644\u062F\u064A\u0627\u0646\u0629","\u0627\u0644\u0639\u0631\u0642"],ru:["\u0440\u0435\u043B\u0438\u0433\u0438\u044F","\u043D\u0430\u0446\u0438\u043E\u043D\u0430\u043B\u044C\u043D\u043E\u0441\u0442\u044C"]},{id:"family_names",type:"name",sensitivity:"high",regulations:[...P],en:["mother name","father name","spouse","partner name","emergency contact","next of kin","family member","guardian","beneficiary"],he:["\u05E9\u05DD \u05D4\u05D0\u05DD","\u05E9\u05DD \u05D4\u05D0\u05D1","\u05D1\u05DF \u05D6\u05D5\u05D2","\u05D1\u05EA \u05D6\u05D5\u05D2","\u05D0\u05D9\u05E9 \u05E7\u05E9\u05E8 \u05DC\u05D7\u05D9\u05E8\u05D5\u05DD","\u05E7\u05E8\u05D5\u05D1 \u05DE\u05E9\u05E4\u05D7\u05D4","\u05D0\u05E4\u05D5\u05D8\u05E8\u05D5\u05E4\u05D5\u05E1","\u05DE\u05D5\u05D8\u05D1"],ar:["\u0627\u0633\u0645 \u0627\u0644\u0623\u0645","\u0627\u0633\u0645 \u0627\u0644\u0623\u0628","\u0627\u0644\u0632\u0648\u062C"],ru:["\u0441\u0443\u043F\u0440\u0443\u0433","\u043E\u043F\u0435\u043A\u0443\u043D"]},{id:"children",type:"minor_data",sensitivity:"critical",regulations:[...P],en:["children","child name","dependents","dependants"],he:["\u05D9\u05DC\u05D3\u05D9\u05DD","\u05E9\u05DE\u05D5\u05EA \u05D4\u05D9\u05DC\u05D3\u05D9\u05DD"],ar:["\u0627\u0644\u0623\u0637\u0641\u0627\u0644"],ru:["\u0434\u0435\u0442\u0438"]}];function _l(e){return e.trim().toLowerCase().replace(/["'`׳״]/g,"").replace(/[_\-.]+/g," ").replace(/\s+/g," ").trim()}function Ms(){return bl.map(e=>{let t=[...e.en,...e.he??[],...e.ar??[],...e.ru??[]].map(_l).filter(Boolean);return{type:e.type,tokens:t.filter(r=>!r.includes(" ")),phrases:t.filter(r=>r.includes(" "))}})}var xl=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם_אדם|שם הלקוח|שם_הלקוח|שם בן זוג|שם בן_זוג|שם המבוטח|שם_המבוטח|שם המוטב|שם_המוטב|שם מבוטח|שם_מבוטח|שם מוטב|שם_מוטב|שם הילד|שם_הילד|שם הקטין|שם_הקטין|firstname_he|lastname_he|shem|shem_mishpacha|shem_prati)$/i,type:"name",label:"Person name (Hebrew)",labelHe:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מספר_זהות|מס' זהות|מס_זהות|מס' ת"ז|teudat_zehut|tz|t_z|israeli_id|il_id)$/i,type:"id",label:"Israeli ID",labelHe:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|מס דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה|מס רישיון|דרכון_מספר)$/i,type:"id",label:"Passport / DL (Hebrew)",labelHe:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|דואר_אלקטרוני|אימייל|כתובת מייל|כתובת_מייל|כתובת דואר|כתובת_דואר)$/i,type:"email",label:"Email (Hebrew)",labelHe:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|מספר_טלפון|טלפון נייד|טלפון_נייד|מס נייד|מס_נייד|מס' טל)$/i,type:"phone",label:"Phone (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|כתובת_מגורים|רחוב|מס בית|מספר בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|כתובת_מלאה|מען)$/i,type:"address",label:"Address (Hebrew)",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|תאריך_לידה|ת לידה|תאריך הולדת|תאריך_הולדת|יום הולדת|יום_הולדת|גיל)$/i,type:"dob",label:"Date of birth (Hebrew)",labelHe:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|חשבון_בנק|מספר חשבון|מספר_חשבון|מס חשבון|מס' חשבון|בנק|סניף|מס סניף|iban|iban_il)$/i,type:"financial",label:"Bank account (Hebrew)",labelHe:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|כרטיס_אשראי|מספר אשראי|מס אשראי|מס' אשראי|cvv|אשראי|מס כרטיס|מס_כרטיס)$/i,type:"financial",label:"Credit card (Hebrew)",labelHe:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר_ברוטו|שכר נטו|שכר_נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"Salary / income (Hebrew)",labelHe:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|בדיקה_רפואית|מצב רפואי|מצב_רפואי|חיסון|תוצאת בדיקה|תוצאת_בדיקה|רופא|רגישות|אלרגיה|סוג דם|סוג_דם)$/i,type:"medical",label:"Medical (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מספר_פוליסה|מס פוליסה|מס' פוליסה|פוליסה|מספר חבר|מספר_חבר|מס חבר|מספר ביטוח|מספר_ביטוח|policy_?number|policy_?no|policy_?id)$/i,type:"policy",label:"Insurance policy number (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"},{pattern:/^(?:מספר סוכן|מספר_סוכן|מס סוכן|מס' סוכן|מס_סוכן|קוד סוכן|קוד_סוכן|מספר משווק|מספר_משווק|מספר יצרן|סוכן ביטוח|agent_?number|agent_?no|agent_?id|agent_?code|broker_?id|broker_?number)$/i,type:"agent_id",label:"Insurance agent / broker number (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF"},{pattern:/^(?:שם הילד|שם_הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|מספר_ילדים|תעודת לידה|ת לידה ילד)$/i,type:"minor_data",label:"Minor data (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|נטייה_מינית|השקפה פוליטית|השקפה_פוליטית|מצב משפחתי|מצב_משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"Sensitive personal (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מספר_רכב|מס רכב|מס' רכב|לוחית רישוי|לוחית_רישוי|מספר רישוי|מספר_רישוי)$/i,type:"tracking",label:"Vehicle ID (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}];function Oe(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let r=t.padStart(9,"0"),n=0;for(let s=0;s<9;s++){let o=parseInt(r[s]??"0",10)*(s%2+1);o>9&&(o-=9),n+=o}return n%10===0&&parseInt(r,10)>0}var vt=/(?<!\d)(?<!\d[.,])(?:\+972[\s-]?|0)(?:5[0-9]|7[0-9]|[2-4]|[89])(?:[\s-]?\d){7}(?!\d)(?![.,]\d)/g,St=/(?<!:\/\/[^\s/@]*)[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}/gi;var Dn=/\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b/g;function js(e){let t=String(e??"").replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let r=t.slice(4)+t.slice(0,4),n=0;for(let s of r){let o=s>="A"&&s<="Z"?String(s.charCodeAt(0)-55):s;for(let i of o)n=(n*10+Number(i))%97}return n===1}function Hs(e){let t=String(e??"").replace(/\D/g,"");if(t.length<13||t.length>19||!/^[2-6]/.test(t))return!1;let r=0,n=!1;for(let s=t.length-1;s>=0;s--){let o=t.charCodeAt(s)-48;if(o<0||o>9)return!1;n&&(o*=2,o>9&&(o-=9)),r+=o,n=!n}return r%10===0}function Us(e){if(!e)return null;let t=e.trim();for(let r of xl)if(r.pattern.test(t))return{type:r.type,label:r.label,labelHe:r.labelHe};return null}var wl=[{type:"biometric",tokens:["biometric","fingerprint","\u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9"],phrases:["face id","\u05D8\u05D1\u05D9\u05E2\u05EA \u05D0\u05E6\u05D1\u05E2"]},{type:"medical",tokens:["diagnosis","medical","disease","medication","prescription","allergy","vaccine","\u05D0\u05D1\u05D7\u05D5\u05DF","\u05D0\u05D1\u05D7\u05E0\u05D4","\u05DE\u05D7\u05DC\u05D4","\u05EA\u05E8\u05D5\u05E4\u05D4","\u05DE\u05E8\u05E9\u05DD","\u05D7\u05D9\u05E1\u05D5\u05DF","\u05D0\u05DC\u05E8\u05D2\u05D9\u05D4"],phrases:["medical record","blood type","\u05DE\u05E6\u05D1 \u05E8\u05E4\u05D5\u05D0\u05D9","\u05E1\u05D5\u05D2 \u05D3\u05DD"]},{type:"sensitive_personal",tokens:["religion","ethnicity","nationality","\u05D3\u05EA","\u05DC\u05D0\u05D5\u05DD","\u05E2\u05D3\u05D4","\u05DE\u05D5\u05E6\u05D0"],phrases:["sexual orientation","marital status","\u05DE\u05E6\u05D1 \u05DE\u05E9\u05E4\u05D7\u05EA\u05D9","\u05E0\u05D8\u05D9\u05D9\u05D4 \u05DE\u05D9\u05E0\u05D9\u05EA"]},{type:"minor_data",tokens:["minor","\u05E7\u05D8\u05D9\u05DF"],phrases:["child name","\u05E9\u05DD \u05D4\u05D9\u05DC\u05D3","\u05E9\u05DD \u05D4\u05E7\u05D8\u05D9\u05DF"]},{type:"id",tokens:["ssn","passport","\u05D6\u05D4\u05D5\u05EA","\u05D3\u05E8\u05DB\u05D5\u05DF"],phrases:["national id","id number","identity number","social security","driver license","driving license","drivers license","passport number","tax id","\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA","\u05DE\u05E1\u05E4\u05E8 \u05D6\u05D4\u05D5\u05EA","\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4"]},{type:"financial",tokens:["iban","swift","bic","salary","income","wage","\u05D0\u05E9\u05E8\u05D0\u05D9","\u05E9\u05DB\u05E8","\u05DE\u05E9\u05DB\u05D5\u05E8\u05EA","\u05D4\u05DB\u05E0\u05E1\u05D4"],phrases:["bank account","account number","credit card","card number","routing number","sort code","\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7","\u05DE\u05E1\u05E4\u05E8 \u05D7\u05E9\u05D1\u05D5\u05DF","\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"]},{type:"policy",tokens:["policy","\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"],phrases:["policy number","member number","\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"]},{type:"agent_id",tokens:["\u05DE\u05E9\u05D5\u05D5\u05E7"],phrases:["agent number","agent code","broker id","\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF"]},{type:"dob",tokens:["dob","birthdate","birthday","\u05DC\u05D9\u05D3\u05D4","\u05D4\u05D5\u05DC\u05D3\u05EA","\u05D2\u05D9\u05DC"],phrases:["date of birth","birth date","\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"]},{type:"phone",tokens:["phone","tel","mobile","cell","fax","\u05D8\u05DC\u05E4\u05D5\u05DF","\u05E0\u05D9\u05D9\u05D3","\u05E4\u05DC\u05D0\u05E4\u05D5\u05DF","\u05E1\u05DC\u05D5\u05DC\u05E8\u05D9"],phrases:["phone number","mobile number","cell phone","\u05D8\u05DC\u05E4\u05D5\u05DF \u05E0\u05D9\u05D9\u05D3"]},{type:"email",tokens:["email","mail","\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC","\u05DE\u05D9\u05D9\u05DC","\u05D3\u05D5\u05D0\u05DC"],phrases:["email address","e mail","\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D9\u05D9\u05DC"]},{type:"address",tokens:["address","street","city","zipcode","zip","postcode","\u05DB\u05EA\u05D5\u05D1\u05EA","\u05E8\u05D7\u05D5\u05D1","\u05E2\u05D9\u05E8","\u05D9\u05E9\u05D5\u05D1","\u05D9\u05D9\u05E9\u05D5\u05D1","\u05DE\u05D9\u05E7\u05D5\u05D3","\u05DE\u05E2\u05DF"],phrases:["home address","postal code","street address","zip code","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D2\u05D5\u05E8\u05D9\u05DD"]},{type:"location",tokens:["gps","latitude","longitude","geolocation","\u05DE\u05D9\u05E7\u05D5\u05DD"],phrases:["gps coordinates"]},{type:"tracking",tokens:["plate","vehicle","\u05E8\u05DB\u05D1","\u05E8\u05D9\u05E9\u05D5\u05D9"],phrases:["license plate","vehicle number","plate number","\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"]},...Ms(),{type:"name",tokens:["name","\u05E9\u05DD"],phrases:["first name","last name","full name","family name","given name","surname","\u05E9\u05DD \u05E4\u05E8\u05D8\u05D9","\u05E9\u05DD \u05DE\u05E9\u05E4\u05D7\u05D4","\u05E9\u05DD \u05DE\u05DC\u05D0"]}];function Et(e){if(!e||/^\[[A-Z_]+(?:-\d+)?\]$/.test(e.trim()))return null;let t=e.trim().toLowerCase().replace(/["'`׳״]/g,"").replace(/[_\-.]+/g," ").replace(/\s+/g," ").trim();if(!t)return null;let r=new Set(t.match(/[\p{L}\p{N}]+/gu)??[]);for(let n of wl)if(n.phrases?.some(o=>t.includes(o))||n.tokens?.some(o=>r.has(o)))return{type:n.type,label:n.type,labelHe:At(n.type)};return null}function At(e){return{id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",employment:"\u05E4\u05E8\u05D8\u05D9 \u05EA\u05E2\u05E1\u05D5\u05E7\u05D4",education:"\u05D4\u05E9\u05DB\u05DC\u05D4",behavior:"\u05E4\u05E8\u05D5\u05E4\u05D9\u05DC \u05D4\u05EA\u05E0\u05D4\u05D2\u05D5\u05EA",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",name:"\u05E9\u05DD \u05D0\u05D3\u05DD",email:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9",phone:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",financial:"\u05E4\u05E8\u05D8\u05D9\u05DD \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9\u05D9\u05DD",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",minor_data:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF",sensitive_personal:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9",biometric:"\u05DE\u05D9\u05D3\u05E2 \u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9",auth:"\u05E1\u05D9\u05E1\u05DE\u05D0\u05D5\u05EA/\u05E1\u05D5\u05D3\u05D5\u05EA",tracking:"\u05DE\u05D6\u05D4\u05D9 \u05DE\u05E2\u05E7\u05D1",location:"\u05DE\u05D9\u05E7\u05D5\u05DD"}[e]??"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9"}var kl=/^(?:\d{5,9}|\d{8}-\d)$/;function Bs(e){let t=0,r=0,n=0,s=0,o=0;for(let a of e)typeof a=="string"&&(kl.test(a.trim())&&Oe(a)&&t++,vt.lastIndex=0,vt.test(a)&&r++,St.lastIndex=0,St.test(a)&&n++,Dn.lastIndex=0,[...a.matchAll(Dn)].some(c=>js(c[0]))&&s++,Hs(a)&&o++);let i=e.length||1;return t/i>=.3?{type:"id",label:"Israeli ID (sniffed)",matchedSample:t}:s/i>=.3?{type:"financial",label:"IBAN-IL (sniffed)",matchedSample:s}:r/i>=.3?{type:"phone",label:"IL phone (sniffed)",matchedSample:r}:n/i>=.3?{type:"email",label:"Email (sniffed)",matchedSample:n}:o/i>=.3?{type:"financial",label:"Credit card (sniffed)",matchedSample:o}:null}var vl=[{type:"full_name",kind:"name",severity:"medium",hint:`A person's name in free text (after a role word such as \u05DC\u05E7\u05D5\u05D7 / \u05DE\u05E8 / \u05E2\u05D5"\u05D3, or Client: / Mr.).`},{type:"bank_account",kind:"bank_account",severity:"high",hint:"An Israeli bank account number (branch-account-check form) in plaintext."},{type:"medical",kind:"medical",severity:"high",hint:"Medical information (diagnosis, medication, lab value) in plaintext."},{type:"birth_date",kind:"dob",severity:"medium",hint:"A date of birth in plaintext."},{type:"address",kind:"address",severity:"medium",hint:"A street address in plaintext."},{type:"license_plate",kind:"plate",severity:"low",hint:"A vehicle licence plate in plaintext."}],Sl=/^(?:לקוח|מטופל|מועמד|שם|נהג|מבוטח|תובע|נתבע|שוכר|מחזיק|עו"ד|ד"ר|פרופ'|מר|גברת|חשבון|ח-ן|[בהוכלמש]{0,2}אבחנ[הות]|תאריך לידה|נולד|נולדה|ד\.ל\.|[בהוכלמש]{0,2}גיל|[Dd]iagnosis|[Dd]iagnosed\s+with)\s*:?\s*/;function El(e,t,r,n){if(n==="address")return{start:t,end:r};let s=Sl.exec(e.slice(t,r));return s&&t+s[0].length<r?{start:t+s[0].length,end:r}:{start:t,end:r}}function G(e,t,r=()=>!0){let n=[],s=new RegExp(e.source,e.flags.includes("g")?e.flags:e.flags+"g");for(let o of t.matchAll(s)){let i=o[1];if(!i||!r(i))continue;let a=(o.index??0)+o[0].indexOf(i);n.push({start:a,end:a+i.length})}return n}var zs=String.raw`[A-Z][a-z']+(?:-[A-Z]?[a-z']+)*`,Fn=String.raw`${zs}(?:[ \t]+${zs}){0,2}`,Al=new RegExp(String.raw`\b(?:Mr|Mrs|Ms|Miss|Dr|Prof)\.?[ \t]+(${Fn})`),$l=new RegExp(String.raw`\b(?:Client|Customer|Patient|Name|Full name|Beneficiary|Insured|Applicant|Tenant|Employee|Holder|Investor)[ \t]*:[ \t]*(${Fn})`),Rl=new RegExp(String.raw`\b(${Fn})(?=,[ \t]*\d{1,3}[ \t]*,|[ \t]*\(\d{1,3}\))`,"g"),Il=/^(?:Figure|Fig|Table|Step|Section|Chapter|Page|Shot|Scene|Part|Item|Note|Appendix|Version|Level|Phase|Round|Room|Floor|Line|Act|Episode|Season|Slide|Clip|Take)$/,Tl=/\b(\d{1,5}[ \t]+(?:[A-Z][A-Za-z'-]*[ \t]+){1,3}(?:Street|St|Road|Rd|Avenue|Ave|Boulevard|Blvd|Lane|Ln|Drive|Way|Court|Ct|Place|Pl)\b\.?)/,Cl=/\b(?:policy|claim|account|member|customer|client|contract|case|reference|ref|company|registration)[ \t]+(?:number|no\.?|num\.?|#)[ \t]*:?[ \t]*([A-Z]{0,4}-?\d[\d-]{3,}\d[A-Z]?)\b/i,Pl=String.raw`\d{1,2}[\/\-.]\d{1,2}[\/\-.]\d{2,4}|\d{4}[\/\-.]\d{1,2}[\/\-.]\d{1,2}|\d{1,2}\s+[A-Z][a-z]{2,8}\s+\d{4}|[A-Z][a-z]{2,8}\s+\d{1,2},?\s+\d{4}`,Ll=new RegExp(String.raw`\b(?:date\s+of\s+birth|birth\s*date|d\.?o\.?b\.?|born(?:\s+on)?)\s*[:\-]?\s*(${Pl})`,"i"),Nl=/\b((?!000|666|9\d\d)\d{3}-(?!00)\d{2}-(?!0000)\d{4})\b/,Ol=/\b((?!BG|GB|NK|KN|TN|NT|ZZ)[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Z]\s?\d{2}\s?\d{2}\s?\d{2}\s?[A-D])\b/,Dl=/(?<![\w+])(\+(?!972)[1-9][\d\s().-]{7,20}\d)/,Ws=e=>e.replace(/\D/g,"").length,Fl=String.raw`(?:(?<![א-ת])ת["'׳״]?\.?ז\.?|תעודת[\s_]?זהות|מספר[\s_]?זהות|מס['׳]?[\s_]?זהות|\bID[ \t]*(?:No\.?|Number|#)|\bnational[ \t]+ID|\bidentity[ \t]+(?:No\.?|number)|\bteudat[\s_]?zehut)`,Ml=new RegExp(String.raw`${Fl}[ \t]*[:#.\-]?[ \t]*(\d[\d \t-]{6,10}\d)(?![\d-])`,"i"),jl=e=>{let t=e.replace(/\D/g,"");return t.length!==8&&t.length!==9||/^\d{9}$/.test(e)||/^\d{8}-\d$/.test(e)?!1:Oe(t)},Hl=/(?:(?<![א-ת])דרכון|\bpassport(?:[ \t]*(?:No\.?|Number|#))?)[ \t]*[:#.\-]?[ \t]*([A-Z]{0,2}\d{6,9})(?![\dA-Z])/i,Ul=[{kind:"name",severity:"medium",hint:"A person's name in free text (after Mr. / Dr. / Client: \u2026, or with an age beside it).",find:e=>[...G(Al,e),...G($l,e),...G(Rl,e,t=>!t.split(/[ \t]/).some(r=>Il.test(r)))]},{kind:"address",severity:"medium",hint:"A street address in plaintext.",find:e=>G(Tl,e)},{kind:"reference",severity:"medium",hint:"A policy, claim, account or company number in plaintext.",find:e=>G(Cl,e)},{kind:"dob",severity:"medium",hint:"A date of birth in plaintext.",find:e=>G(Ll,e)},{kind:"national_id",severity:"high",hint:"A national ID number (an Israeli ID after its word, US SSN, UK NINO) in plaintext.",find:e=>[...G(Nl,e),...G(Ol,e),...G(Ml,e,jl)]},{kind:"passport",severity:"high",hint:"A passport number, after the word that announces it, in plaintext.",find:e=>G(Hl,e)},{kind:"phone",severity:"high",hint:"A phone number in international form in plaintext.",find:e=>G(Dl,e,t=>Ws(t)>=8&&Ws(t)<=15)}];function Bl(e){let t=new Map;for(let r of e){let n=t.get(r.kind);t.set(r.kind,n?{...n,find:s=>[...n.find(s),...r.find(s)]}:r)}return[...t.values()]}function Vs(){let e=vl.map(({type:t,kind:r,severity:n,hint:s})=>{let o=new xe([t]);return{kind:r,severity:n,hint:s,find:i=>o.detect(i).map(a=>El(i,a.startIndex,a.endIndex,r))}});return Bl([...e,...Ul])}var we={_comment:"CANONICAL secret ruleset \u2014 the SINGLE SOURCE OF TRUTH for hardcoded-secret detection, loaded by BOTH the web scanner (lib/soc/exposure-map.ts) and the installed Capsule agent (apps/desktop/src-tauri/src/scanner.rs, via include_str!). Patterns are written in the regex subset both JavaScript and the Rust `regex` crate accept (no lookaround, no backreferences). A connection string counts only WITH credentials (user:pass@). Edit here once and both engines stay aligned.",rules:[{id:"aws-access-key",subkind:"aws_access_key",name:"AWS Access Key",severity:"critical",pattern:"(?:^|[^A-Z0-9])AKIA(?!X{16})[A-Z2-7]{16}(?:[^A-Z2-7]|$)",hint:"AWS access key id detected. Rotate via IAM and move to an environment variable."},{id:"aws-secret-key",subkind:"aws_secret_key",name:"AWS Secret Key",severity:"critical",pattern:`(?:aws_secret_access_key|aws_secret_key|secret_access_key)\\s*[=:]\\s*['"]?[A-Za-z0-9/+=]{40}['"]?`,hint:"AWS secret access key detected. Rotate immediately."},{id:"gcp-api-key",subkind:"gcp_api_key",name:"GCP API Key",severity:"critical",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Google API key detected. Restrict or rotate it in the Google Cloud console."},{id:"gcp-service-account",subkind:"gcp_service_account",name:"GCP Service Account",severity:"critical",pattern:'"type"\\s*:\\s*"service_account"',hint:"GCP service-account JSON detected. Move it out of the repo and rotate the key."},{id:"github-token",subkind:"github_token",name:"GitHub Token",severity:"critical",pattern:"gh[pousr]_[0-9a-zA-Z]{36,}",hint:"GitHub token detected. Revoke at https://github.com/settings/tokens."},{id:"github-fine-grained",subkind:"github_fine_grained_token",name:"GitHub Fine-Grained Token",severity:"critical",pattern:"github_pat_[0-9a-zA-Z_]{22,}",hint:"GitHub fine-grained token detected. Revoke it in GitHub settings."},{id:"gitlab-token",subkind:"gitlab_token",name:"GitLab Token",severity:"critical",pattern:"glpat-[0-9a-zA-Z_-]{20,}",hint:"GitLab token detected. Revoke it in GitLab access tokens."},{id:"stripe-secret",subkind:"stripe_key",name:"Stripe Secret Key",severity:"critical",pattern:"sk_live_[0-9a-zA-Z]{24,}",hint:"Stripe live secret key detected. Roll it in the Stripe dashboard."},{id:"stripe-restricted",subkind:"stripe_restricted_key",name:"Stripe Restricted Key",severity:"critical",pattern:"rk_live_[0-9a-zA-Z]{24,}",hint:"Stripe restricted key detected. Roll it in the Stripe dashboard."},{id:"slack-token",subkind:"slack_token",name:"Slack Token",severity:"high",pattern:"xox[baprs]-[0-9a-zA-Z-]{10,}",hint:"Slack token detected. Revoke it in the Slack app settings."},{id:"slack-webhook",subkind:"slack_webhook",name:"Slack Webhook",severity:"high",pattern:"hooks\\.slack\\.com/services/T[0-9A-Z]{8,}/B[0-9A-Z]{8,}/[0-9a-zA-Z]{24}",hint:"Slack incoming-webhook URL detected. Regenerate it."},{id:"twilio-api-key",subkind:"twilio_api_key",name:"Twilio API Key",severity:"high",pattern:"SK[0-9a-fA-F]{32}",hint:"Twilio API key detected. Rotate it in the Twilio console."},{id:"sendgrid-api-key",subkind:"sendgrid_api_key",name:"SendGrid API Key",severity:"critical",pattern:"SG\\.[0-9a-zA-Z_-]{22}\\.[0-9a-zA-Z_-]{43}",hint:"SendGrid API key detected. Rotate it in the SendGrid console."},{id:"postgres-uri",subkind:"postgres_uri",name:"PostgreSQL Connection String",severity:"critical",pattern:`postgres(?:ql)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"PostgreSQL connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"mongodb-uri",subkind:"mongodb_uri",name:"MongoDB Connection String",severity:"critical",pattern:`mongodb(?:\\+srv)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"MongoDB connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"redis-uri",subkind:"redis_uri",name:"Redis Connection String",severity:"high",pattern:`redis(?:s)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"Redis connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"openai-key",subkind:"openai_key",name:"OpenAI API Key",severity:"critical",pattern:"sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}",hint:"OpenAI API key detected. Rotate at https://platform.openai.com/api-keys."},{id:"anthropic-key",subkind:"anthropic_key",name:"Anthropic API Key",severity:"critical",pattern:"sk-ant-[0-9a-zA-Z_-]{40,}",hint:"Anthropic API key detected. Rotate at https://console.anthropic.com/."},{id:"firebase-key",subkind:"firebase_key",name:"Firebase API Key",severity:"high",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Firebase API key detected. Restrict it in the Firebase console."},{id:"supabase-key",subkind:"supabase_key",name:"Supabase Service Key",severity:"critical",pattern:"eyJ[0-9a-zA-Z_-]{100,}",hint:"Long JWT (possible Supabase service key) detected. Rotate it and keep it server-side only."},{id:"private-key",subkind:"private_key",name:"Private Key",severity:"critical",pattern:"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",hint:"Private key material in plaintext. Rotate immediately and move to a key manager (KMS/Vault).",skipPlaceholder:!0},{id:"jwt-secret",subkind:"jwt_secret",name:"JWT/Generic Secret",severity:"high",pattern:`(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded signing/API secret detected. Move it to an environment variable and rotate it."},{id:"password-in-code",subkind:"password_in_code",name:"Password in Code",severity:"high",pattern:`(?:password|passwd|pwd)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded password detected. Move it to a secret manager and rotate it."},{id:"bearer-token",subkind:"bearer_token",name:"Bearer Token in Code",severity:"high",pattern:`['"]Bearer\\s+[0-9a-zA-Z._-]{20,}['"]`,hint:"Hardcoded bearer token detected. Move it to a secret manager and rotate it."},{id:"hex-secret-32",subkind:"hex_secret",name:"Hardcoded 32+ Hex Secret",severity:"medium",pattern:`['"][0-9a-f]{32,}['"]`,hint:"Long hex string that looks like a secret/hash. Confirm it is not a live credential."},{id:"base64-secret",subkind:"base64_secret",name:"Hardcoded Base64 Secret (long)",severity:"medium",pattern:`['"][A-Za-z0-9+/]{64,}={0,2}['"]`,hint:"Long base64 blob that looks like an embedded secret. Confirm it is not a live credential."}]};var Vl=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name",labelHe:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA \u05D0\u05D9\u05DE\u05D9\u05D9\u05DC"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05DE\u05D6\u05D4\u05D4"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth",labelHe:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account",labelHe:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card",labelHe:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Financial data",labelHe:"\u05E0\u05EA\u05D5\u05DF \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication)$/i,type:"medical",label:"Medical data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(ip_?address)$/i,type:"tracking",label:"IP address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA IP"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D3\u05E8\u05DB\u05D5\u05DF"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license",labelHe:"\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4"},{pattern:/^(iban|swift_?code|bic)$/i,type:"financial",label:"Banking code",labelHe:"\u05E7\u05D5\u05D3 \u05D1\u05E0\u05E7\u05D0\u05D9"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05DE\u05E1"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Member ID",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D1\u05D9\u05D8\u05D5\u05D7/\u05D7\u05D1\u05E8"},{pattern:/^(blood_?type|allergy|allergies|prescription)$/i,type:"medical",label:"Medical data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation",labelHe:"\u05DE\u05D9\u05E7\u05D5\u05DD \u05D2\u05D9\u05D0\u05D5\u05D2\u05E8\u05E4\u05D9"},{pattern:/^(mac_?address|device_?fingerprint|imei|serial_?number)$/i,type:"tracking",label:"Device identifier",labelHe:"\u05DE\u05D6\u05D4\u05D4 \u05DE\u05DB\u05E9\u05D9\u05E8"},{pattern:/^(ethnicity|race|religion|political_?affiliation|sexual_?orientation)$/i,type:"sensitive_personal",label:"Sensitive personal",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(minor|child_?name|child_?age|dependent)$/i,type:"minor_data",label:"Minor data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05E0\u05D9\u05DD"},{pattern:/^(signature|digital_?signature)$/i,type:"id",label:"Signature",labelHe:"\u05D7\u05EA\u05D9\u05DE\u05D4"},{pattern:/^(vehicle_?number|license_?plate|plate_?number)$/i,type:"tracking",label:"Vehicle ID",labelHe:"\u05DE\u05D6\u05D4\u05D4 \u05E8\u05DB\u05D1"}],Gl=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|sort_?order|position|enabled|active|public|version|metadata|config|settings|options|data|content|body|raw|json|text|note|comment|label|color|icon|image|avatar|logo|thumbnail|preview|template|schema|format|mode|level|priority|severity|source|target|parent|child|owner|creator|modifier|assignee|project|workspace|organization|team|group|channel|thread|room|session|device|platform|browser|locale|timezone|currency|country|region|city|zip|postal|state|province|name|display_?name|user_?agent|password_?hash|secret|token|private_?key|auth_?token|constraint|index|sequence|trigger|function|procedure|database|namespace|migration|revision)$/i,Xl=/^(beacon_?registr|device_?config|hardware|sensor|firmware|telemetry|metric|analytic|log_?event|audit_?log|system_?config|cache|queue|job|migration|schema_?version|spatial_?ref)/i,Kl=/^(minor|major|uuid|rssi|tx_?power|beacon_?id|device_?type|firmware_?version|batch_?id|zone_?id)$/i;function Gs(e,t){if(Gl.test(e)||/^name$/i.test(e)||t&&Xl.test(t)||Kl.test(e))return null;for(let n of Vl)if(n.pattern.test(e))return n.type;let r=Us(e);return r?r.type:null}var Lh=we.rules.map(e=>({id:e.id,name:e.name,pattern:new RegExp(e.pattern),severity:e.severity}));var Nh=512*1024,Oh=50*1024*1024;var Zl=new Set(["hex-secret-32","base64-secret"]),Wh=we.rules.filter(e=>!Zl.has(e.id)).map(e=>new RegExp(e.pattern,"g"));var Ks={id:"critical",agent_id:"high",policy:"high",financial:"critical",medical:"critical",sensitive_personal:"critical",minor_data:"critical",biometric:"critical",auth:"critical",name:"high",email:"high",phone:"high",address:"high",dob:"high",location:"high",tracking:"medium",employment:"high",education:"medium",behavior:"high"};function Zs(e){return Ks[e]}function Yl(e){return Ks[e]??"low"}function Ys(e,t){let r=[];for(let n of t){let s=n.rows.length;for(let o=0;o<n.headers.length;o++){let i=n.headers[o]??"",a=i?Gs(i.trim().replace(/["'`׳״:]/g,"").replace(/\s+/g,"_"),n.name)??Et(i)?.type??null:null,c=[];for(let f of n.rows){let d=f[o];typeof d=="string"&&d.length>0&&c.push(d)}let l=c.length>0?Bs(c):null;l?r.push(Xs(e,n.name,i,l.type,l.label,"value",l.matchedSample,s)):a&&r.push(Xs(e,n.name,i,a,At(a),"header",0,s))}}return r}function Xs(e,t,r,n,s,o,i,a){return{file:e,location:t,column:r,type:n,label:s,category:At(n),severity:Yl(n),matchKind:o,hits:i,sampleSize:a}}var Jl=new Set(["hex-secret-32","base64-secret"]),ql=[/(?:[$€£]|USD|EUR|GBP)\s?\d[\d,]*(?:\.\d+)?/g,/\d[\d,]*(?:\.\d+)?\s?(?:[$€£]|USD|EUR|GBP|דולר|יורו)/g,/\b\d{1,3}(?:,\d{3})+(?:\.\d+)?\b/g];function Ql(e){let t=new xe(["financial_amount"]);return{kind:"amount",severity:"medium",hint:"A money amount (the amounts dial is on: amounts are treated as sensitive here).",find:r=>{if(!e())return[];let n=t.detect(r).map(o=>({start:o.startIndex,end:o.endIndex}));for(let o of ql){o.lastIndex=0;for(let i of r.matchAll(o))n.push({start:i.index,end:i.index+i[0].length})}n.sort((o,i)=>o.start-i.start||i.end-o.end);let s=[];for(let o of n){let i=s[s.length-1];i&&o.start<i.end?i.end=Math.max(i.end,o.end):s.push({...o})}return s}}}function Js(e={}){let t=e.amounts??(()=>!1),r=[...Vs(),Ql(t)],n=we.rules.filter(s=>!Jl.has(s.id)).map(s=>({id:s.id,name:s.name,severity:s.severity,pattern:new RegExp(s.pattern)}));return{text:r,amounts:t,header:s=>{let o=Et(s);return o?{type:o.type,label:o.labelHe||o.label}:null},secrets:n,table:s=>Ys("",[s]).filter(o=>o.column).map(o=>({column:o.column,type:o.type,category:o.category,severity:o.severity,hits:o.hits,how:o.matchKind==="value"?"value":"header"})),severity:s=>Zs(s)}}var qs=!1;function Qs(){qs||(qs=!0,$t(Js({amounts:Fr})))}Qs();Fs(process.argv.slice(2)).catch(()=>{process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"ask",permissionDecisionReason:"NoData could not check this file before it is read. Allow anyway?"}}))});
|