@openauditmodel/cli 0.1.0

package/dist/conformance/src/privacy/field-names.js

@@ -0,0 +1,121 @@
+/**
+ * Property-name registries.
+ *
+ * Matching is **exact after normalization**, never substring. Substring
+ * matching is what makes name-based linters unusable: `passwordPolicy`,
+ * `secretRotationEnabled`, `tokenCount`, `authorizationDecision` and
+ * `cookieConsent` are all legitimate audit fields that a substring rule would
+ * flag, and a rule that cries wolf is a rule that gets switched off.
+ *
+ * Normalization removes only case and the separators that the same concept is
+ * spelled with in different systems: `clientSecret`, `client_secret`,
+ * `client-secret` and `Client.Secret` are one name.
+ */
+/** Lower-cases a property name and removes `-`, `_`, `.` and spaces. */
+export function normalizeFieldName(name) {
+    return name.toLowerCase().replaceAll(/[-_. ]/g, "");
+}
+/**
+ * Property names whose value is a credential by definition. A field with one of
+ * these names has no non-sensitive interpretation.
+ */
+export const PROHIBITED_CREDENTIAL_FIELD_NAMES = new Set([
+    // Passwords
+    "password",
+    "passwd",
+    "pwd",
+    "passphrase",
+    // Generic secrets
+    "secret",
+    "clientsecret",
+    "secretkey",
+    "credential",
+    "credentials",
+    // Tokens
+    "accesstoken",
+    "refreshtoken",
+    "idtoken",
+    "authtoken",
+    "bearertoken",
+    "sessiontoken",
+    // Keys
+    "apikey",
+    "privatekey",
+    "signingkey",
+    "encryptionkey",
+    // Transport credentials
+    "connectionstring",
+    "authorization",
+    "proxyauthorization",
+    "sessioncookie",
+    "cookie",
+    "setcookie",
+]);
+/**
+ * Property names that carry whole request, response or message bodies. These
+ * are prohibited by specification/privacy.md §2 from being captured
+ * automatically, and a populated field with one of these names is evidence that
+ * they were.
+ */
+export const RAW_PAYLOAD_FIELD_NAMES = new Set([
+    "requestbody",
+    "responsebody",
+    "rawrequest",
+    "rawresponse",
+    "httpbody",
+    "messagepayload",
+    "messagebody",
+    "brokerpayload",
+    "databaserow",
+    "fullrecord",
+]);
+/**
+ * Names that are not credentials by themselves but that make a high-entropy
+ * value more suspicious. Used only to raise the confidence of the entropy rule
+ * from `low` to `medium`; never to raise a finding on its own.
+ */
+export const SUSPICIOUS_FIELD_NAME_HINTS = new Set([
+    "token",
+    "key",
+    "secretvalue",
+    "credentialvalue",
+    "auth",
+    "authvalue",
+    "signature",
+    "nonce",
+    "salt",
+    "seed",
+    "apitoken",
+    "accesskey",
+    "secretaccesskey",
+]);
+/**
+ * The names a property should be tested under.
+ *
+ * Extension keys are reverse-domain namespaced, so the field name is the final
+ * dot-separated segment: `com.example.audit.password` names a password, and
+ * normalizing the whole key would fold the namespace into it and hide that.
+ * Both forms are therefore tested. Because matching stays exact, a key ending in
+ * `.passwordPolicy` is still not a password.
+ */
+function candidateNames(name) {
+    const candidates = [normalizeFieldName(name)];
+    const lastDot = name.lastIndexOf(".");
+    if (lastDot > 0 && lastDot < name.length - 1) {
+        candidates.push(normalizeFieldName(name.slice(lastDot + 1)));
+    }
+    return candidates;
+}
+function matchesAny(registry, name) {
+    return candidateNames(name).some((candidate) => registry.has(candidate));
+}
+export function isProhibitedCredentialFieldName(name) {
+    return matchesAny(PROHIBITED_CREDENTIAL_FIELD_NAMES, name);
+}
+export function isRawPayloadFieldName(name) {
+    return matchesAny(RAW_PAYLOAD_FIELD_NAMES, name);
+}
+export function isSuspiciousFieldName(name) {
+    return matchesAny(SUSPICIOUS_FIELD_NAME_HINTS, name);
+}
+//# sourceMappingURL=field-names.js.map

package/dist/conformance/src/privacy/field-names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-names.js","sourceRoot":"","sources":["../../../../conformance/src/privacy/field-names.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,wEAAwE;AACxE,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAwB,IAAI,GAAG,CAAC;IAC5E,YAAY;IACZ,UAAU;IACV,QAAQ;IACR,KAAK;IACL,YAAY;IACZ,kBAAkB;IAClB,QAAQ;IACR,cAAc;IACd,WAAW;IACX,YAAY;IACZ,aAAa;IACb,SAAS;IACT,aAAa;IACb,cAAc;IACd,SAAS;IACT,WAAW;IACX,aAAa;IACb,cAAc;IACd,OAAO;IACP,QAAQ;IACR,YAAY;IACZ,YAAY;IACZ,eAAe;IACf,wBAAwB;IACxB,kBAAkB;IAClB,eAAe;IACf,oBAAoB;IACpB,eAAe;IACf,QAAQ;IACR,WAAW;CACZ,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAClE,aAAa;IACb,cAAc;IACd,YAAY;IACZ,aAAa;IACb,UAAU;IACV,gBAAgB;IAChB,aAAa;IACb,eAAe;IACf,aAAa;IACb,YAAY;CACb,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAwB,IAAI,GAAG,CAAC;IACtE,OAAO;IACP,KAAK;IACL,aAAa;IACb,iBAAiB;IACjB,MAAM;IACN,WAAW;IACX,WAAW;IACX,OAAO;IACP,MAAM;IACN,MAAM;IACN,UAAU;IACV,WAAW;IACX,iBAAiB;CAClB,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,UAAU,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IAE9C,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,UAAU,CAAC,QAA6B,EAAE,IAAY;IAC7D,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,IAAY;IAC1D,OAAO,UAAU,CAAC,iCAAiC,EAAE,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,UAAU,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,UAAU,CAAC,2BAA2B,EAAE,IAAI,CAAC,CAAC;AACvD,CAAC"}

package/dist/conformance/src/privacy/lint-event.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Privacy linting of a single audit event.
+ *
+ * The linter is deterministic, local and read-only. It resolves nothing, fetches
+ * nothing, opens no referenced file, sends nothing anywhere and never modifies
+ * or redacts an event. It reports suspicions about the values it was given.
+ *
+ * No finding ever carries the value that produced it. See
+ * specification/privacy.md §6 for what this can and cannot detect.
+ */
+import type { EventValidator } from "../validate-core.js";
+import { type EventLintResult } from "./types.js";
+export interface LintOptions {
+    /** Validate against the canonical schema first. Defaults to true. */
+    readonly validateSchema?: boolean;
+}
+/** Lints one event and returns its findings, most severe first. */
+export declare function lintEvent(event: unknown, label: string, validator: EventValidator, options?: LintOptions): EventLintResult;

package/dist/conformance/src/privacy/lint-event.js

@@ -0,0 +1,272 @@
+import { isProhibitedCredentialFieldName, isRawPayloadFieldName, isSuspiciousFieldName, } from "./field-names.js";
+import { isHighEntropyTokenCandidate } from "./entropy.js";
+import { isRedactionPlaceholder } from "./safe-formats.js";
+import { containsPrivateKeyMaterial, matchKnownTokenFormat, matchesAuthorizationHeader, } from "./token-patterns.js";
+import { analyzeConnectionString, analyzeUrl, isDataSystemScheme } from "./url-analysis.js";
+import { exceededSignals, profileValue } from "./size-analysis.js";
+import { ALL_RULES, RULES } from "./rules.js";
+import { readPath, traverse } from "./traverse.js";
+import { SEVERITY_ORDER } from "./types.js";
+/** Containers traversed in full, for both property names and values. */
+function deepRoots(event) {
+    const roots = [];
+    const add = (path, value) => {
+        if (value !== undefined) {
+            roots.push({ path, value });
+        }
+    };
+    add("/metadata", readPath(event, ["metadata"]));
+    add("/extensions", readPath(event, ["extensions"]));
+    add("/actor/attributes", readPath(event, ["actor", "attributes"]));
+    add("/subject/attributes", readPath(event, ["subject", "attributes"]));
+    add("/resource/attributes", readPath(event, ["resource", "attributes"]));
+    add("/change/before", readPath(event, ["change", "before"]));
+    add("/change/after", readPath(event, ["change", "after"]));
+    const related = readPath(event, ["relatedResources"]);
+    if (Array.isArray(related)) {
+        for (const [index, entry] of related.entries()) {
+            add(`/relatedResources/${index}/attributes`, readPath(entry, ["attributes"]));
+        }
+    }
+    return roots;
+}
+/** Single values inspected for credential-shaped content, but not traversed. */
+function scalarLocations(event) {
+    const locations = [];
+    const add = (path, value) => {
+        if (typeof value === "string") {
+            locations.push({ path, value });
+        }
+    };
+    add("/event/summary", readPath(event, ["event", "summary"]));
+    add("/event/error/message", readPath(event, ["event", "error", "message"]));
+    add("/reason/text", readPath(event, ["reason", "text"]));
+    add("/reason/reference", readPath(event, ["reason", "reference"]));
+    add("/request/route", readPath(event, ["request", "route"]));
+    add("/authorization/reason", readPath(event, ["authorization", "reason"]));
+    add("/delegation/reason", readPath(event, ["delegation", "reason"]));
+    return locations;
+}
+/** Containers measured by the minimization rule. */
+function sizeRoots(event) {
+    return deepRoots(event).filter((root) => root.value !== null && typeof root.value === "object");
+}
+/** Evidence references, which have a rule of their own. */
+function evidenceReferences(event) {
+    const evidence = readPath(event, ["evidence"]);
+    if (!Array.isArray(evidence)) {
+        return [];
+    }
+    const references = [];
+    for (const [index, entry] of evidence.entries()) {
+        const reference = readPath(entry, ["reference"]);
+        if (typeof reference === "string") {
+            references.push({ path: `/evidence/${index}/reference`, value: reference });
+        }
+    }
+    return references;
+}
+/**
+ * True when a value under a prohibited property name counts as populated.
+ *
+ * Booleans are excluded: a credential cannot be `true`, so a boolean under a
+ * name like `secret` is a flag. Recognised redaction placeholders are excluded
+ * because reporting them punishes the behaviour the specification asks for; that
+ * choice is a deliberate false negative, documented in privacy.md §6.
+ */
+/**
+ * True when a value under a credential-named property is itself a credential.
+ *
+ * A **scalar** under a name like `password` is the credential. A **container**
+ * is a descriptor: `credential: { type: "api-key" }` describes a credential
+ * without carrying one, and the identity-and-access-management profile requires
+ * exactly that shape for `identity.credential.rotate`. Flagging the container
+ * would fire on every conforming credential rotation event, which is how a
+ * linter earns the reputation that gets it switched off.
+ *
+ * Containers are still traversed, so a credential-named member or a
+ * credential-shaped value inside one is reported on its own. The cost is a
+ * secret stored under a harmless member name inside such a container, which is
+ * an accepted false negative documented in privacy.md §6.9.
+ */
+function isCredentialValue(value) {
+    if (typeof value === "string") {
+        return !isRedactionPlaceholder(value);
+    }
+    return typeof value === "number";
+}
+function isPopulated(value) {
+    if (value === null || value === undefined || typeof value === "boolean") {
+        return false;
+    }
+    if (typeof value === "string") {
+        return !isRedactionPlaceholder(value);
+    }
+    if (Array.isArray(value)) {
+        return value.length > 0;
+    }
+    if (typeof value === "object") {
+        return Object.keys(value).length > 0;
+    }
+    return true;
+}
+function finding(rule, path, overrides = {}) {
+    return {
+        ruleId: rule.id,
+        severity: rule.severity,
+        confidence: rule.confidence,
+        category: rule.category,
+        path,
+        message: rule.message,
+        recommendation: rule.recommendation,
+        ...overrides,
+    };
+}
+const RULES_BY_ID = new Map(ALL_RULES.map((rule) => [rule.id, rule]));
+/**
+ * Applies every value rule to one string.
+ *
+ * Returns strong findings first; the entropy heuristic is applied only when
+ * nothing stronger matched, so a recognised token is never also reported as an
+ * anonymous high-entropy candidate.
+ */
+function valueFindings(value, path, key) {
+    const findings = [];
+    if (matchesAuthorizationHeader(value)) {
+        findings.push(finding(RULES.AUTHORIZATION_HEADER_VALUE, path));
+    }
+    if (containsPrivateKeyMaterial(value)) {
+        findings.push(finding(RULES.PRIVATE_KEY_MATERIAL, path));
+    }
+    const tokenRuleId = matchKnownTokenFormat(value);
+    if (tokenRuleId !== undefined) {
+        const rule = RULES_BY_ID.get(tokenRuleId);
+        if (rule !== undefined) {
+            findings.push(finding(rule, path));
+        }
+    }
+    const connection = analyzeConnectionString(value);
+    if (connection === "credentialed") {
+        findings.push(finding(RULES.CONNECTION_STRING_WITH_CREDENTIALS, path));
+    }
+    else if (connection === "uncredentialed") {
+        findings.push(finding(RULES.CONNECTION_STRING_WITHOUT_CREDENTIALS, path));
+    }
+    // A data-system URL is already described by the connection-string rules;
+    // reporting it again as generic userinfo would say the same thing twice.
+    const url = analyzeUrl(value);
+    if (url?.hasUserinfo === true && !isDataSystemScheme(url.scheme)) {
+        findings.push(finding(RULES.URL_USERINFO, path));
+    }
+    if (findings.length === 0 && isHighEntropyTokenCandidate(value)) {
+        findings.push(finding(RULES.HIGH_ENTROPY_TOKEN_CANDIDATE, path, {
+            confidence: key !== undefined && isSuspiciousFieldName(key) ? "medium" : "low",
+        }));
+    }
+    return findings;
+}
+/** Applies the property-name rules to one member. */
+function nameFindings(key, value, path) {
+    const findings = [];
+    if (isProhibitedCredentialFieldName(key) && isCredentialValue(value)) {
+        findings.push(finding(RULES.PROHIBITED_CREDENTIAL_FIELD, path));
+    }
+    if (isRawPayloadFieldName(key) && isPopulated(value)) {
+        findings.push(finding(RULES.RAW_PAYLOAD_FIELD, path));
+    }
+    return findings;
+}
+/** Applies the evidence reference rule. */
+function evidenceFindings(value, path) {
+    const url = analyzeUrl(value);
+    if (url !== undefined) {
+        if (url.hasQuery || url.hasFragment) {
+            return [finding(RULES.EVIDENCE_REFERENCE_QUERY, path)];
+        }
+        return [];
+    }
+    // References are frequently opaque identifiers or paths rather than URLs, so a
+    // question mark is treated as a query string when the value does not parse.
+    if (value.includes("?") || value.includes("#")) {
+        return [finding(RULES.EVIDENCE_REFERENCE_QUERY, path)];
+    }
+    return [];
+}
+function severityRank(finding) {
+    const index = SEVERITY_ORDER.indexOf(finding.severity);
+    return index === -1 ? SEVERITY_ORDER.length : index;
+}
+/** Lints one event and returns its findings, most severe first. */
+export function lintEvent(event, label, validator, options = {}) {
+    const eventId = typeof readPath(event, ["id"]) === "string" ? readPath(event, ["id"]) : undefined;
+    const identity = eventId === undefined ? {} : { eventId };
+    if (options.validateSchema !== false) {
+        const issues = validator.validateEvent(event);
+        if (issues.length > 0) {
+            const shown = issues.slice(0, 5).map((issue) => `${issue.path}  ${issue.message}`);
+            return {
+                label,
+                ...identity,
+                status: "schema-invalid",
+                findings: [],
+                schemaIssues: issues.length > shown.length
+                    ? [...shown, `and ${issues.length - shown.length} further schema issues`]
+                    : shown,
+            };
+        }
+    }
+    const collected = [];
+    for (const root of deepRoots(event)) {
+        traverse(root.value, root.path, ({ path, key, value }) => {
+            if (key !== undefined) {
+                collected.push(...nameFindings(key, value, path));
+            }
+            if (typeof value === "string") {
+                collected.push(...valueFindings(value, path, key));
+            }
+        });
+    }
+    for (const location of scalarLocations(event)) {
+        collected.push(...valueFindings(location.value, location.path, undefined));
+    }
+    for (const reference of evidenceReferences(event)) {
+        collected.push(...evidenceFindings(reference.value, reference.path));
+        collected.push(...valueFindings(reference.value, reference.path, undefined));
+    }
+    for (const root of sizeRoots(event)) {
+        const signals = exceededSignals(profileValue(root.value));
+        if (signals.length > 0) {
+            collected.push(finding(RULES.OVERSIZED_UNFILTERED_VALUE, root.path, {
+                message: `${RULES.OVERSIZED_UNFILTERED_VALUE.message} Signals: ${signals.join("; ")}.`,
+            }));
+        }
+    }
+    // One finding per rule per location, however many ways it was reached.
+    const seen = new Set();
+    const findings = collected
+        .filter((entry) => {
+        const key = `${entry.ruleId}|${entry.path}`;
+        if (seen.has(key)) {
+            return false;
+        }
+        seen.add(key);
+        return true;
+    })
+        .map((entry) => ({ ...entry, ...identity }))
+        .sort((left, right) => {
+        const bySeverity = severityRank(left) - severityRank(right);
+        if (bySeverity !== 0) {
+            return bySeverity;
+        }
+        const byPath = left.path.localeCompare(right.path, "en");
+        return byPath === 0 ? left.ruleId.localeCompare(right.ruleId, "en") : byPath;
+    });
+    return {
+        label,
+        ...identity,
+        status: findings.length === 0 ? "clean" : "findings",
+        findings,
+        schemaIssues: [],
+    };
+}
+//# sourceMappingURL=lint-event.js.map

package/dist/conformance/src/privacy/lint-event.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lint-event.js","sourceRoot":"","sources":["../../../../conformance/src/privacy/lint-event.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,+BAA+B,EAC/B,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAuB,MAAM,YAAY,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,cAAc,EAA6C,MAAM,YAAY,CAAC;AAYvF,wEAAwE;AACxE,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,KAAc,EAAQ,EAAE;QACjD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC;IAEF,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChD,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACpD,GAAG,CAAC,mBAAmB,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IACnE,GAAG,CAAC,qBAAqB,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IACvE,GAAG,CAAC,sBAAsB,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IACzE,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC7D,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAE3D,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/C,GAAG,CAAC,qBAAqB,KAAK,aAAa,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,SAAS,GAAW,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,KAAc,EAAQ,EAAE;QACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC;IAEF,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAC7D,GAAG,CAAC,sBAAsB,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAC5E,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,mBAAmB,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IACnE,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7D,GAAG,CAAC,uBAAuB,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3E,GAAG,CAAC,oBAAoB,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAErE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oDAAoD;AACpD,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC;AAClG,CAAC;AAED,2DAA2D;AAC3D,SAAS,kBAAkB,CAAC,KAAc;IACxC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,UAAU,GAAW,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QACjD,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,KAAK,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;GAOG;AACH;;;;;;;;;;;;;;GAcG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC;AACnC,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,IAAoB,EAAE,IAAY,EAAE,YAAqC,EAAE;IAC1F,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI;QACJ,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,GAAG,SAAS;KACY,CAAC;AAC7B,CAAC;AAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAEtE;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY,EAAE,GAAuB;IACzE,MAAM,QAAQ,GAAqB,EAAE,CAAC;IAEtC,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;QAClC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,IAAI,CAAC,CAAC,CAAC;IACzE,CAAC;SAAM,IAAI,UAAU,KAAK,gBAAgB,EAAE,CAAC;QAC3C,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,GAAG,EAAE,WAAW,KAAK,IAAI,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,2BAA2B,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,IAAI,EAAE;YAChD,UAAU,EAAE,GAAG,KAAK,SAAS,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;SAC/E,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,qDAAqD;AACrD,SAAS,YAAY,CAAC,GAAW,EAAE,KAAc,EAAE,IAAY;IAC7D,MAAM,QAAQ,GAAqB,EAAE,CAAC;IAEtC,IAAI,+BAA+B,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,IAAI,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,2CAA2C;AAC3C,SAAS,gBAAgB,CAAC,KAAa,EAAE,IAAY;IACnD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAE9B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACpC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,+EAA+E;IAC/E,4EAA4E;IAC5E,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,YAAY,CAAC,OAAuB;IAC3C,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvD,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AACtD,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,SAAS,CACvB,KAAc,EACd,KAAa,EACb,SAAyB,EACzB,UAAuB,EAAE;IAEzB,MAAM,OAAO,GACX,OAAO,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,MAAM,QAAQ,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;IAE1D,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACnF,OAAO;gBACL,KAAK;gBACL,GAAG,QAAQ;gBACX,MAAM,EAAE,gBAAgB;gBACxB,QAAQ,EAAE,EAAE;gBACZ,YAAY,EACV,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;oBAC1B,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,OAAO,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,wBAAwB,CAAC;oBACzE,CAAC,CAAC,KAAK;aACZ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAqB,EAAE,CAAC;IAEvC,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;YACvD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,SAAS,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,SAAS,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,SAAS,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,KAAe,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IACvF,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,SAAS,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,SAAS,CAAC,KAAe,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/E,SAAS,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,SAAS,CAAC,KAAe,EAAE,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,SAAS,CAAC,IAAI,CACZ,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,IAAI,CAAC,IAAI,EAAE;gBACnD,OAAO,EAAE,GAAG,KAAK,CAAC,0BAA0B,CAAC,OAAO,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aACvF,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,QAAQ,GAAG,SAAS;SACvB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAChB,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;SAC3C,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACpB,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzD,OAAO,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEL,OAAO;QACL,KAAK;QACL,GAAG,QAAQ;QACX,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU;QACpD,QAAQ;QACR,YAAY,EAAE,EAAE;KACjB,CAAC;AACJ,CAAC"}

package/dist/conformance/src/privacy/rules.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The v0.1 privacy rule catalogue.
+ *
+ * Severity and confidence are properties of the rule, not of an individual
+ * finding, so that a report can be filtered predictably. Severity says how bad
+ * the risk would be if the suspicion is correct; confidence says how likely the
+ * suspicion is to be correct. They are deliberately independent: a field
+ * literally named `password` is critical and high-confidence, while a
+ * high-entropy string in an arbitrary field is medium and low-confidence.
+ *
+ * Thresholds and vocabularies are hard-coded in v0.1. Configuration is a future
+ * design question; see decisions/0007-deterministic-privacy-linting.md.
+ */
+import type { Confidence, Severity } from "./types.js";
+export interface RuleDefinition {
+    readonly id: string;
+    readonly name: string;
+    readonly severity: Severity;
+    readonly confidence: Confidence;
+    readonly category: string;
+    readonly message: string;
+    readonly recommendation: string;
+}
+export declare const RULES: {
+    readonly PROHIBITED_CREDENTIAL_FIELD: RuleDefinition;
+    readonly AUTHORIZATION_HEADER_VALUE: RuleDefinition;
+    readonly PRIVATE_KEY_MATERIAL: RuleDefinition;
+    readonly JWT_TOKEN: RuleDefinition;
+    readonly AWS_ACCESS_KEY_ID: RuleDefinition;
+    readonly GITHUB_TOKEN: RuleDefinition;
+    readonly GITLAB_TOKEN: RuleDefinition;
+    readonly SLACK_TOKEN: RuleDefinition;
+    readonly PAYMENT_SECRET_KEY: RuleDefinition;
+    readonly CLOUD_API_KEY: RuleDefinition;
+    readonly URL_USERINFO: RuleDefinition;
+    readonly EVIDENCE_REFERENCE_QUERY: RuleDefinition;
+    readonly CONNECTION_STRING_WITH_CREDENTIALS: RuleDefinition;
+    readonly CONNECTION_STRING_WITHOUT_CREDENTIALS: RuleDefinition;
+    readonly HIGH_ENTROPY_TOKEN_CANDIDATE: RuleDefinition;
+    readonly OVERSIZED_UNFILTERED_VALUE: RuleDefinition;
+    readonly RAW_PAYLOAD_FIELD: RuleDefinition;
+};
+/** Every rule, ordered by identifier, for documentation and tests. */
+export declare const ALL_RULES: readonly RuleDefinition[];

package/dist/conformance/src/privacy/rules.js

@@ -0,0 +1,161 @@
+function rule(definition) {
+    return definition;
+}
+export const RULES = {
+    PROHIBITED_CREDENTIAL_FIELD: rule({
+        id: "OAM-PRIV-001",
+        name: "prohibited-credential-field",
+        severity: "critical",
+        confidence: "high",
+        category: "credential-field-name",
+        message: "A property name associated with credentials carries a non-empty value.",
+        recommendation: "Remove the value. Record only the fact of the operation, or a non-sensitive identifier for the credential.",
+    }),
+    AUTHORIZATION_HEADER_VALUE: rule({
+        id: "OAM-PRIV-002",
+        name: "authorization-header-value",
+        severity: "critical",
+        confidence: "high",
+        category: "credential-shaped-value",
+        message: "A value is shaped like an authorization header credential.",
+        recommendation: "Never record authorization headers. Record the authentication method and outcome instead.",
+    }),
+    PRIVATE_KEY_MATERIAL: rule({
+        id: "OAM-PRIV-003",
+        name: "private-key-material",
+        severity: "critical",
+        confidence: "high",
+        category: "credential-shaped-value",
+        message: "A value contains a marker used by private key material.",
+        recommendation: "Remove the key material. Record a key identifier that cannot be used to reconstruct the key.",
+    }),
+    JWT_TOKEN: rule({
+        id: "OAM-PRIV-010",
+        name: "jwt-token",
+        severity: "critical",
+        confidence: "high",
+        category: "known-token-format",
+        message: "A value is structured as a JSON Web Token: three segments whose header and payload decode to JSON objects.",
+        recommendation: "Remove the token. Record the subject identifier and the authentication method instead. Validity was not checked.",
+    }),
+    AWS_ACCESS_KEY_ID: rule({
+        id: "OAM-PRIV-011",
+        name: "aws-access-key-id",
+        severity: "high",
+        confidence: "high",
+        category: "known-token-format",
+        message: "A value matches the published shape of a cloud access key identifier. An identifier alone is not a complete credential.",
+        recommendation: "Remove the identifier, or record a non-sensitive reference to the principal it belongs to.",
+    }),
+    GITHUB_TOKEN: rule({
+        id: "OAM-PRIV-012",
+        name: "github-token",
+        severity: "critical",
+        confidence: "high",
+        category: "known-token-format",
+        message: "A value matches a published personal access token prefix.",
+        recommendation: "Remove the token and rotate it. Validity was not checked.",
+    }),
+    GITLAB_TOKEN: rule({
+        id: "OAM-PRIV-013",
+        name: "gitlab-token",
+        severity: "critical",
+        confidence: "high",
+        category: "known-token-format",
+        message: "A value matches a published personal access token prefix.",
+        recommendation: "Remove the token and rotate it. Validity was not checked.",
+    }),
+    SLACK_TOKEN: rule({
+        id: "OAM-PRIV-014",
+        name: "slack-token",
+        severity: "critical",
+        confidence: "high",
+        category: "known-token-format",
+        message: "A value matches a published messaging platform token prefix.",
+        recommendation: "Remove the token and rotate it. Validity was not checked.",
+    }),
+    PAYMENT_SECRET_KEY: rule({
+        id: "OAM-PRIV-015",
+        name: "payment-secret-key",
+        severity: "critical",
+        confidence: "high",
+        category: "known-token-format",
+        message: "A value matches a published secret API key prefix.",
+        recommendation: "Remove the key and rotate it. Validity was not checked.",
+    }),
+    CLOUD_API_KEY: rule({
+        id: "OAM-PRIV-016",
+        name: "cloud-api-key",
+        severity: "critical",
+        confidence: "high",
+        category: "known-token-format",
+        message: "A value matches a published API key prefix.",
+        recommendation: "Remove the key and rotate it. Validity was not checked.",
+    }),
+    URL_USERINFO: rule({
+        id: "OAM-PRIV-030",
+        name: "url-userinfo",
+        severity: "critical",
+        confidence: "high",
+        category: "url",
+        message: "A URL embeds user information, which commonly carries a password.",
+        recommendation: "Remove the credentials from the URL. Record the location without any embedded user information.",
+    }),
+    EVIDENCE_REFERENCE_QUERY: rule({
+        id: "OAM-PRIV-031",
+        name: "evidence-reference-query",
+        severity: "medium",
+        confidence: "medium",
+        category: "url",
+        message: "An evidence reference carries a query string or fragment, which may hold signed access parameters, identifiers or search terms.",
+        recommendation: "Store a stable, access-controlled reference without embedded parameters. A query string is not always sensitive; review this one.",
+    }),
+    CONNECTION_STRING_WITH_CREDENTIALS: rule({
+        id: "OAM-PRIV-040",
+        name: "connection-string-with-credentials",
+        severity: "critical",
+        confidence: "high",
+        category: "connection-string",
+        message: "A value is shaped like a connection string that carries a password.",
+        recommendation: "Remove the connection string and rotate the credential it exposes.",
+    }),
+    CONNECTION_STRING_WITHOUT_CREDENTIALS: rule({
+        id: "OAM-PRIV-041",
+        name: "connection-string-without-credentials",
+        severity: "low",
+        confidence: "medium",
+        category: "connection-string",
+        message: "A value is shaped like a connection string. No credential was detected in it; it may still disclose internal infrastructure.",
+        recommendation: "Record a logical name for the system rather than a connection string. This is not reported as a credential.",
+    }),
+    HIGH_ENTROPY_TOKEN_CANDIDATE: rule({
+        id: "OAM-PRIV-050",
+        name: "high-entropy-token-candidate",
+        severity: "medium",
+        confidence: "low",
+        category: "heuristic",
+        message: "A value is long, has no whitespace and has high character entropy, which is consistent with a token or key.",
+        recommendation: "Confirm what this value is. Many high-entropy values are legitimate identifiers; this rule is a heuristic and is expected to produce false positives.",
+    }),
+    OVERSIZED_UNFILTERED_VALUE: rule({
+        id: "OAM-PRIV-060",
+        name: "oversized-unfiltered-value",
+        severity: "medium",
+        confidence: "medium",
+        category: "minimization",
+        message: "A value is large enough to suggest that an object was captured rather than selected.",
+        recommendation: "Record the fields the audit purpose requires. Prefer changed field names, hashes or references over whole objects.",
+    }),
+    RAW_PAYLOAD_FIELD: rule({
+        id: "OAM-PRIV-061",
+        name: "raw-payload-field",
+        severity: "high",
+        confidence: "high",
+        category: "minimization",
+        message: "A property name associated with raw request, response or message bodies is populated.",
+        recommendation: "Do not capture whole payloads. Record selected, named fields, or a reference to the payload held under its own controls.",
+    }),
+};
+/** Every rule, ordered by identifier, for documentation and tests. */
+export const ALL_RULES = Object.values(RULES).sort((left, right) => left.id.localeCompare(right.id, "en"));
+//# sourceMappingURL=rules.js.map

package/dist/conformance/src/privacy/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../../../conformance/src/privacy/rules.ts"],"names":[],"mappings":"AAyBA,SAAS,IAAI,CAAC,UAA0B;IACtC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,2BAA2B,EAAE,IAAI,CAAC;QAChC,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,uBAAuB;QACjC,OAAO,EAAE,wEAAwE;QACjF,cAAc,EACZ,4GAA4G;KAC/G,CAAC;IAEF,0BAA0B,EAAE,IAAI,CAAC;QAC/B,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,yBAAyB;QACnC,OAAO,EAAE,4DAA4D;QACrE,cAAc,EACZ,2FAA2F;KAC9F,CAAC;IAEF,oBAAoB,EAAE,IAAI,CAAC;QACzB,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,yBAAyB;QACnC,OAAO,EAAE,yDAAyD;QAClE,cAAc,EACZ,8FAA8F;KACjG,CAAC;IAEF,SAAS,EAAE,IAAI,CAAC;QACd,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,oBAAoB;QAC9B,OAAO,EACL,4GAA4G;QAC9G,cAAc,EACZ,kHAAkH;KACrH,CAAC;IAEF,iBAAiB,EAAE,IAAI,CAAC;QACtB,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,oBAAoB;QAC9B,OAAO,EACL,yHAAyH;QAC3H,cAAc,EACZ,4FAA4F;KAC/F,CAAC;IAEF,YAAY,EAAE,IAAI,CAAC;QACjB,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,oBAAoB;QAC9B,OAAO,EAAE,2DAA2D;QACpE,cAAc,EAAE,2DAA2D;KAC5E,CAAC;IAEF,YAAY,EAAE,IAAI,CAAC;QACjB,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,oBAAoB;QAC9B,OAAO,EAAE,2DAA2D;QACpE,cAAc,EAAE,2DAA2D;KAC5E,CAAC;IAEF,WAAW,EAAE,IAAI,CAAC;QAChB,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,oBAAoB;QAC9B,OAAO,EAAE,8DAA8D;QACvE,cAAc,EAAE,2DAA2D;KAC5E,CAAC;IAEF,kBAAkB,EAAE,IAAI,CAAC;QACvB,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,oBAAoB;QAC9B,OAAO,EAAE,oDAAoD;QAC7D,cAAc,EAAE,yDAAyD;KAC1E,CAAC;IAEF,aAAa,EAAE,IAAI,CAAC;QAClB,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,oBAAoB;QAC9B,OAAO,EAAE,6CAA6C;QACtD,cAAc,EAAE,yDAAyD;KAC1E,CAAC;IAEF,YAAY,EAAE,IAAI,CAAC;QACjB,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,mEAAmE;QAC5E,cAAc,EACZ,iGAAiG;KACpG,CAAC;IAEF,wBAAwB,EAAE,IAAI,CAAC;QAC7B,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,QAAQ;QACpB,QAAQ,EAAE,KAAK;QACf,OAAO,EACL,iIAAiI;QACnI,cAAc,EACZ,mIAAmI;KACtI,CAAC;IAEF,kCAAkC,EAAE,IAAI,CAAC;QACvC,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,oCAAoC;QAC1C,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,mBAAmB;QAC7B,OAAO,EAAE,qEAAqE;QAC9E,cAAc,EAAE,oEAAoE;KACrF,CAAC;IAEF,qCAAqC,EAAE,IAAI,CAAC;QAC1C,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,uCAAuC;QAC7C,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,QAAQ;QACpB,QAAQ,EAAE,mBAAmB;QAC7B,OAAO,EACL,8HAA8H;QAChI,cAAc,EACZ,6GAA6G;KAChH,CAAC;IAEF,4BAA4B,EAAE,IAAI,CAAC;QACjC,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,8BAA8B;QACpC,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,WAAW;QACrB,OAAO,EACL,6GAA6G;QAC/G,cAAc,EACZ,uJAAuJ;KAC1J,CAAC;IAEF,0BAA0B,EAAE,IAAI,CAAC;QAC/B,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,QAAQ;QACpB,QAAQ,EAAE,cAAc;QACxB,OAAO,EAAE,sFAAsF;QAC/F,cAAc,EACZ,oHAAoH;KACvH,CAAC;IAEF,iBAAiB,EAAE,IAAI,CAAC;QACtB,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,cAAc;QACxB,OAAO,EACL,uFAAuF;QACzF,cAAc,EACZ,0HAA0H;KAC7H,CAAC;CAC+C,CAAC;AAEpD,sEAAsE;AACtE,MAAM,CAAC,MAAM,SAAS,GAA8B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC5F,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CACtC,CAAC"}