@skillsmith/core 0.12.1 → 0.12.3

package/dist/src/security/scanner/SecurityScanner.helpers.js

@@ -132,28 +132,36 @@ export function isWithinInlineCode(line, matchIndex) {
     }
     return false;
 }
+// ============================================================================
+// Shared Pattern Scanning
+// ============================================================================
 /**
- * Scan content for patterns that may span multiple lines.
- * Multi-line patterns are tested against full content; single-line patterns per-line.
- *
- * SMI-5876: patterns within a single category (jailbreak / ai_defence) can now
- * carry DIFFERENT evidence tiers (a bare "jailbreak" mention vs. an explicit
- * "ignore all previous instructions" override), so array-declaration order is
- * no longer sufficient to decide which match wins on a line where multiple
- * patterns fire — the STRONGEST evidence tier per line wins, computed via a
- * merge across both passes (`bestByLine`), not "first match, in array order."
- *
- * Two hazards this closes (see the SMI-5876 design doc §5 for the full
- * argument):
- *   Hazard A — pass 2 used to `break` on the FIRST matching pattern
- *     regardless of tier, so a weaker mention declared earlier in the array
- *     could shadow a stronger directive declared later on the same line.
- *   Hazard B — a multiline pattern match used to suppress ALL single-line
- *     patterns on that line (`flaggedLines`), so a mention-tier multiline
- *     match could hide a directive-tier single-line match on the same line.
- *     `bestByLine` SEEDS pass 2 with pass 1's result instead of skipping the
- *     line outright, so pass 2 can still find something stronger.
+ * SMI-5879 (design §3.3.4): correctness ceiling on distinct lines recorded per
+ * pattern in the pass-1 full-content scan — score-neutral by proof (Lemma
+ * 3.3-B): once one pattern alone has pushed its category's raw subtotal past
+ * the per-category `Math.min(100, …)` cap, no further line from that SAME
+ * pattern can change the post-cap value. Derived floor:
+ * `ceil(100 / min_raw_per_finding)` where `min_raw_per_finding` is the
+ * smallest (severity × category-weight × confidence) reachable from the
+ * multiline pass — today an `ai_defence` `mention` in either context:
+ * `low(5) × 1.9 × low(0.3) = 2.85`, giving `ceil(100/2.85) = 36`. Set to 64
+ * (1.78x headroom over the derived floor) so a future weight change that
+ * lowers the minimum per-finding contribution doesn't immediately breach it;
+ * `scanner-multiline-cap.test.ts` recomputes the floor from the live weight
+ * tables and asserts this constant stays `>=` it.
  */
+export const MAX_MULTILINE_LINES_PER_PATTERN = 64;
+/**
+ * SMI-5879 (design §3.3.3/3.3.6): wall-clock LIVENESS bound on a single
+ * pattern's pass-1 loop — NOT score-neutral (unlike the line cap above). A
+ * same-line repetition (e.g. 200 matches on one line) costs one iteration per
+ * match even though `seenLines` never grows past 1, so this bounds worst-case
+ * iteration count on a pathological same-line-repetition input. Binding marks
+ * the scan `multilineTruncated`; a truncated scan may only ever RAISE a
+ * verdict, never lower one (design §3.3.6) — enforced by the write path, not
+ * here.
+ */
+export const MAX_MULTILINE_ITERATIONS_PER_PATTERN = 10_000;
 export function scanPatternsWithMultilineSupport(content, config, lineContexts, 
 /**
  * SMI-5881: explicit cap (UTF-16 code units) for the pass-1 full-content
@@ -166,38 +174,67 @@ maxLength) {
     const lines = content.split('\n');
     const contexts = lineContexts ?? analyzeMarkdownContext(content);
     const bestByLine = new Map();
+    let truncated = false;
     const rank = (t) => EVIDENCE_RANK[t];
-    // First pass: 'content' | 'both'-scope patterns against full content. No
-    // break — every such pattern is independently tested (same cost as before:
-    // at most one full-content scan per pattern), and the strongest tier per
-    // line wins.
+    // First pass: 'content' | 'both'-scope patterns against full content.
+    //
+    // SMI-5879 (design §3.3): each multiline pattern gets its OWN global-flag
+    // clone (never mutating the shared pattern object) and its own per-pattern
+    // `seenLines` set. A second match on a line already recorded by THIS
+    // pattern is a provable no-op (Lemma 3.3-A: same tier, same line, strict
+    // `>` merge comparison) and costs nothing once skipped. The effective input
+    // is truncated to `maxLength` up front (mirroring safeRegexTest's own
+    // truncation) so `lineNumberOf` never reads past what was actually scanned.
+    const scannedContent = maxLength !== undefined && content.length > maxLength ? content.slice(0, maxLength) : content;
     for (const pattern of config.patterns) {
         if (resolvePatternScope(pattern) === 'line')
             continue;
-        const match = safeRegexTest(pattern, content, maxLength);
-        if (!match)
-            continue;
-        // SMI-5876: use the match's own reported index rather than a fresh
-        // content.indexOf(match[0]) — the latter misreports the line whenever the
-        // matched text ALSO occurs earlier in the content (a real hazard fixed in
-        // the same pass as the evidence-tier merge).
-        const matchIndex = match.index ?? content.indexOf(match[0]);
-        const lineNumber = content.slice(0, matchIndex).split('\n').length;
-        const ctx = contexts[lineNumber - 1];
-        const matchLine = lines[lineNumber - 1] ?? '';
-        const lineOffset = content.lastIndexOf('\n', matchIndex - 1) + 1;
-        const matchCol = matchIndex - lineOffset;
-        const inInlineCode = ctx?.isInlineCode && isWithinInlineCode(matchLine, matchCol);
-        const inDocContext = ctx ? isDocumentationContext(ctx) || inInlineCode : false;
-        const tier = config.classify(pattern);
-        const incumbent = bestByLine.get(lineNumber);
-        if (!incumbent || rank(tier) > rank(incumbent.tier)) {
-            bestByLine.set(lineNumber, {
-                tier,
-                matchText: match[0],
-                location: match[0].trim().slice(0, 100),
-                inDocContext,
-            });
+        const flags = pattern.flags.includes('g') ? pattern.flags : pattern.flags + 'g';
+        const g = new RegExp(pattern.source, flags);
+        const seenLines = new Set();
+        let iterations = 0;
+        let m;
+        while ((m = g.exec(scannedContent)) !== null) {
+            if (m[0].length === 0)
+                g.lastIndex++; // zero-length-match advance
+            if (++iterations > MAX_MULTILINE_ITERATIONS_PER_PATTERN) {
+                truncated = true;
+                break;
+            }
+            // SMI-5879: many content-scope patterns lead with a captured `(?:^|\n)`
+            // (a line-start anchor), so `m.index` for the 2nd+ occurrence points at
+            // the NEWLINE ending the PREVIOUS line, not at the matched line's own
+            // content — attributing raw `m.index` directly under-counts the target
+            // line by one and (worse) collides with an already-seen earlier line,
+            // silently dropping the real match. Skip past any leading `\n`
+            // character(s) to the match's actual content start before resolving
+            // the line/column.
+            const matchIndex = m.index;
+            let contentIndex = matchIndex;
+            while (scannedContent[contentIndex] === '\n')
+                contentIndex++;
+            const lineNumber = scannedContent.slice(0, contentIndex).split('\n').length;
+            if (seenLines.has(lineNumber))
+                continue; // Lemma 3.3-A: costs nothing
+            if (seenLines.size >= MAX_MULTILINE_LINES_PER_PATTERN)
+                break; // score-neutral (Lemma 3.3-B)
+            seenLines.add(lineNumber);
+            const ctx = contexts[lineNumber - 1];
+            const matchLine = lines[lineNumber - 1] ?? '';
+            const lineOffset = scannedContent.lastIndexOf('\n', contentIndex - 1) + 1;
+            const matchCol = contentIndex - lineOffset;
+            const inInlineCode = ctx?.isInlineCode && isWithinInlineCode(matchLine, matchCol);
+            const inDocContext = ctx ? isDocumentationContext(ctx) || inInlineCode : false;
+            const tier = config.classify(pattern);
+            const incumbent = bestByLine.get(lineNumber);
+            if (!incumbent || rank(tier) > rank(incumbent.tier)) {
+                bestByLine.set(lineNumber, {
+                    tier,
+                    matchText: m[0],
+                    location: m[0].trim().slice(0, 100),
+                    inDocContext,
+                });
+            }
         }
     }
     // Second pass: 'line' | 'both'-scope patterns, per-line. Seeds `best` from
@@ -243,11 +280,11 @@ maxLength) {
         if (!candidate)
             continue;
         const { severity, confidence } = resolveEvidenceSeverity(candidate.tier, candidate.inDocContext);
-        const truncated = candidate.matchText.slice(0, 50);
+        const truncatedText = candidate.matchText.slice(0, 50);
         findings.push({
             type: config.type,
             severity,
-            message: `${config.messagePrefix}: "${truncated}${candidate.matchText.length > 50 ? '...' : ''}"`,
+            message: `${config.messagePrefix}: "${truncatedText}${candidate.matchText.length > 50 ? '...' : ''}"`,
             location: candidate.location,
             lineNumber,
             category: config.type,
@@ -256,7 +293,7 @@ maxLength) {
             evidenceType: candidate.tier,
         });
     }
-    return findings;
+    return { findings, truncated };
 }
 // ============================================================================
 // Risk Score Calculation

package/dist/src/security/scanner/SecurityScanner.helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.helpers.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAyBzD,+EAA+E;AAC/E,4BAA4B;AAC5B,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAU,GAAG,IAAI;IACvE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAkB,EAAE,CAAA;IAClC,IAAI,iBAAiB,GAAG,KAAK,CAAA;IAC7B,6CAA6C;IAC7C,2GAA2G;IAC3G,IAAI,gBAAgB,GAAkC,SAAS,CAAA;IAC/D,IAAI,uBAAuB,GAAG,CAAC,CAAC,CAAA;IAEhC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAE/B,6DAA6D;QAC7D,uEAAuE;QACvE,oDAAoD;QACpD,IAAI,iBAAiB,GAAG,KAAK,CAAA;QAC7B,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;YAC1B,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACnC,+DAA+D;gBAC/D,gBAAgB,GAAG,MAAM,CAAA;gBACzB,uBAAuB,GAAG,CAAC,CAAA;gBAC3B,iBAAiB,GAAG,IAAI,CAAA,CAAC,0CAA0C;YACrE,CAAC;iBAAM,IAAI,gBAAgB,KAAK,MAAM,EAAE,CAAC;gBACvC,gBAAgB,GAAG,QAAQ,CAAA;gBAC3B,iBAAiB,GAAG,IAAI,CAAA,CAAC,wBAAwB;YACnD,CAAC;QACH,CAAC;aAAM,IAAI,gBAAgB,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpE,qFAAqF;YACrF,gBAAgB,GAAG,QAAQ,CAAA;QAC7B,CAAC;aAAM,IAAI,gBAAgB,KAAK,MAAM,EAAE,CAAC;YACvC,iBAAiB,GAAG,IAAI,CAAA;QAC1B,CAAC;QAED,yEAAyE;QACzE,wDAAwD;QACxD,IAAI,CAAC,iBAAiB,IAAI,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7D,iBAAiB,GAAG,CAAC,iBAAiB,CAAA;QACxC,CAAC;QAED,sCAAsC;QACtC,MAAM,OAAO,GAAG,CAAC,iBAAiB,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAEjE,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,8BAA8B;QAC9B,MAAM,cAAc,GAClB,UAAU;YACV,CAAC,iBAAiB;YAClB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;YACxB,CAAC,iBAAiB;YAClB,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC;YAC5B,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAE9B,iEAAiE;QACjE,MAAM,YAAY,GAAG,CAAC,iBAAiB,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAA;QAErF,QAAQ,CAAC,IAAI,CAAC;YACZ,UAAU,EAAE,CAAC,GAAG,CAAC;YACjB,WAAW,EAAE,iBAAiB;YAC9B,OAAO;YACP,cAAc;YACd,YAAY;YACZ,aAAa,EAAE,iBAAiB;SACjC,CAAC,CAAA;IACJ,CAAC;IAED,yEAAyE;IACzE,uEAAuE;IACvE,gDAAgD;IAChD,IAAI,gBAAgB,KAAK,MAAM,IAAI,uBAAuB,IAAI,CAAC,EAAE,CAAC;QAChE,KAAK,IAAI,CAAC,GAAG,uBAAuB,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/D,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,GAAG,KAAK,CAAA;QACnC,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAgB;IACrD,OAAO,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,aAAa,CAAA;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,UAAkB;IACjE,MAAM,aAAa,GAAG,YAAY,CAAA;IAClC,IAAI,KAAK,CAAA;IACT,OAAO,CAAC,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAA;QAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QAC7C,IAAI,UAAU,IAAI,SAAS,IAAI,UAAU,GAAG,OAAO,EAAE,CAAC;YACpD,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AA2BD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,gCAAgC,CAC9C,OAAe,EACf,MAA2B,EAC3B,YAA4B;AAC5B;;;;;;GAMG;AACH,SAAkB;IAElB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAChE,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAA;IAEvD,MAAM,IAAI,GAAG,CAAC,CAAe,EAAU,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;IAE1D,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,aAAa;IACb,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,mBAAmB,CAAC,OAAO,CAAC,KAAK,MAAM;YAAE,SAAQ;QACrD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;QACxD,IAAI,CAAC,KAAK;YAAE,SAAQ;QAEpB,mEAAmE;QACnE,0EAA0E;QAC1E,0EAA0E;QAC1E,6CAA6C;QAC7C,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3D,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAA;QAClE,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC,CAAA;QACpC,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;QAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,CAAA;QAChE,MAAM,QAAQ,GAAG,UAAU,GAAG,UAAU,CAAA;QACxC,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QACjF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;QAC9E,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QAErC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAC5C,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE;gBACzB,IAAI;gBACJ,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;gBACnB,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBACvC,YAAY;aACb,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,uEAAuE;IACvE,cAAc;IACd,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAA;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC3B,IAAI,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAA;QAE7C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,IAAI,mBAAmB,CAAC,OAAO,CAAC,KAAK,SAAS;gBAAE,SAAQ;YACxD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,CAAC,KAAK;gBAAE,SAAQ;YAEpB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YACrC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,IAAI,GAAG;oBACL,IAAI;oBACJ,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;oBACnB,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,YAAY;iBACb,CAAA;YACH,CAAC;YACD,mEAAmE;YACnE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,iBAAiB;gBAAE,MAAK;QAC7C,CAAC;QAED,IAAI,IAAI;YAAE,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,oEAAoE;IACpE,uEAAuE;IACvE,2EAA2E;IAC3E,uCAAuC;IACvC,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACxE,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAC5C,IAAI,CAAC,SAAS;YAAE,SAAQ;QACxB,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,uBAAuB,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,YAAY,CAAC,CAAA;QAChG,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAElD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ;YACR,OAAO,EAAE,GAAG,MAAM,CAAC,aAAa,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG;YACjG,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,UAAU;YACV,QAAQ,EAAE,MAAM,CAAC,IAAI;YACrB,sBAAsB,EAAE,SAAS,CAAC,YAAY;YAC9C,UAAU;YACV,YAAY,EAAE,SAAS,CAAC,IAAI;SAC7B,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAC/E,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,+CAA+C"}
+{"version":3,"file":"SecurityScanner.helpers.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAyBzD,+EAA+E;AAC/E,4BAA4B;AAC5B,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAU,GAAG,IAAI;IACvE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAkB,EAAE,CAAA;IAClC,IAAI,iBAAiB,GAAG,KAAK,CAAA;IAC7B,6CAA6C;IAC7C,2GAA2G;IAC3G,IAAI,gBAAgB,GAAkC,SAAS,CAAA;IAC/D,IAAI,uBAAuB,GAAG,CAAC,CAAC,CAAA;IAEhC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAE/B,6DAA6D;QAC7D,uEAAuE;QACvE,oDAAoD;QACpD,IAAI,iBAAiB,GAAG,KAAK,CAAA;QAC7B,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;YAC1B,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACnC,+DAA+D;gBAC/D,gBAAgB,GAAG,MAAM,CAAA;gBACzB,uBAAuB,GAAG,CAAC,CAAA;gBAC3B,iBAAiB,GAAG,IAAI,CAAA,CAAC,0CAA0C;YACrE,CAAC;iBAAM,IAAI,gBAAgB,KAAK,MAAM,EAAE,CAAC;gBACvC,gBAAgB,GAAG,QAAQ,CAAA;gBAC3B,iBAAiB,GAAG,IAAI,CAAA,CAAC,wBAAwB;YACnD,CAAC;QACH,CAAC;aAAM,IAAI,gBAAgB,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpE,qFAAqF;YACrF,gBAAgB,GAAG,QAAQ,CAAA;QAC7B,CAAC;aAAM,IAAI,gBAAgB,KAAK,MAAM,EAAE,CAAC;YACvC,iBAAiB,GAAG,IAAI,CAAA;QAC1B,CAAC;QAED,yEAAyE;QACzE,wDAAwD;QACxD,IAAI,CAAC,iBAAiB,IAAI,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7D,iBAAiB,GAAG,CAAC,iBAAiB,CAAA;QACxC,CAAC;QAED,sCAAsC;QACtC,MAAM,OAAO,GAAG,CAAC,iBAAiB,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAEjE,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,8BAA8B;QAC9B,MAAM,cAAc,GAClB,UAAU;YACV,CAAC,iBAAiB;YAClB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;YACxB,CAAC,iBAAiB;YAClB,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC;YAC5B,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAE9B,iEAAiE;QACjE,MAAM,YAAY,GAAG,CAAC,iBAAiB,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAA;QAErF,QAAQ,CAAC,IAAI,CAAC;YACZ,UAAU,EAAE,CAAC,GAAG,CAAC;YACjB,WAAW,EAAE,iBAAiB;YAC9B,OAAO;YACP,cAAc;YACd,YAAY;YACZ,aAAa,EAAE,iBAAiB;SACjC,CAAC,CAAA;IACJ,CAAC;IAED,yEAAyE;IACzE,uEAAuE;IACvE,gDAAgD;IAChD,IAAI,gBAAgB,KAAK,MAAM,IAAI,uBAAuB,IAAI,CAAC,EAAE,CAAC;QAChE,KAAK,IAAI,CAAC,GAAG,uBAAuB,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/D,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,GAAG,KAAK,CAAA;QACnC,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAgB;IACrD,OAAO,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,aAAa,CAAA;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,UAAkB;IACjE,MAAM,aAAa,GAAG,YAAY,CAAA;IAClC,IAAI,KAAK,CAAA;IACT,OAAO,CAAC,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAA;QAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QAC7C,IAAI,UAAU,IAAI,SAAS,IAAI,UAAU,GAAG,OAAO,EAAE,CAAC;YACpD,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,CAAA;AAEjD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,MAAM,CAAA;AA0D1D,MAAM,UAAU,gCAAgC,CAC9C,OAAe,EACf,MAA2B,EAC3B,YAA4B;AAC5B;;;;;;GAMG;AACH,SAAkB;IAElB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAChE,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAA;IACvD,IAAI,SAAS,GAAG,KAAK,CAAA;IAErB,MAAM,IAAI,GAAG,CAAC,CAAe,EAAU,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;IAE1D,sEAAsE;IACtE,EAAE;IACF,0EAA0E;IAC1E,2EAA2E;IAC3E,qEAAqE;IACrE,yEAAyE;IACzE,4EAA4E;IAC5E,sEAAsE;IACtE,4EAA4E;IAC5E,MAAM,cAAc,GAClB,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;IAE/F,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,mBAAmB,CAAC,OAAO,CAAC,KAAK,MAAM;YAAE,SAAQ;QAErD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,GAAG,GAAG,CAAA;QAC/E,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAC3C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;QACnC,IAAI,UAAU,GAAG,CAAC,CAAA;QAClB,IAAI,CAAyB,CAAA;QAE7B,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,CAAC,CAAC,SAAS,EAAE,CAAA,CAAC,4BAA4B;YAEjE,IAAI,EAAE,UAAU,GAAG,oCAAoC,EAAE,CAAC;gBACxD,SAAS,GAAG,IAAI,CAAA;gBAChB,MAAK;YACP,CAAC;YAED,wEAAwE;YACxE,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,sEAAsE;YACtE,+DAA+D;YAC/D,oEAAoE;YACpE,mBAAmB;YACnB,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAA;YAC1B,IAAI,YAAY,GAAG,UAAU,CAAA;YAC7B,OAAO,cAAc,CAAC,YAAY,CAAC,KAAK,IAAI;gBAAE,YAAY,EAAE,CAAA;YAE5D,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAA;YAC3E,IAAI,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,SAAQ,CAAC,6BAA6B;YAErE,IAAI,SAAS,CAAC,IAAI,IAAI,+BAA+B;gBAAE,MAAK,CAAC,8BAA8B;YAE3F,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YAEzB,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC,CAAA;YACpC,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;YAC7C,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,CAAC,IAAI,EAAE,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,CAAA;YACzE,MAAM,QAAQ,GAAG,YAAY,GAAG,UAAU,CAAA;YAC1C,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;YACjF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;YAC9E,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YAErC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YAC5C,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpD,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE;oBACzB,IAAI;oBACJ,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;oBACf,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,YAAY;iBACb,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,uEAAuE;IACvE,cAAc;IACd,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAA;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC3B,IAAI,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAA;QAE7C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,IAAI,mBAAmB,CAAC,OAAO,CAAC,KAAK,SAAS;gBAAE,SAAQ;YACxD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,CAAC,KAAK;gBAAE,SAAQ;YAEpB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YACrC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,IAAI,GAAG;oBACL,IAAI;oBACJ,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;oBACnB,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,YAAY;iBACb,CAAA;YACH,CAAC;YACD,mEAAmE;YACnE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,iBAAiB;gBAAE,MAAK;QAC7C,CAAC;QAED,IAAI,IAAI;YAAE,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,oEAAoE;IACpE,uEAAuE;IACvE,2EAA2E;IAC3E,uCAAuC;IACvC,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACxE,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAC5C,IAAI,CAAC,SAAS;YAAE,SAAQ;QACxB,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,uBAAuB,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,YAAY,CAAC,CAAA;QAChG,MAAM,aAAa,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAEtD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ;YACR,OAAO,EAAE,GAAG,MAAM,CAAC,aAAa,MAAM,aAAa,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG;YACrG,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,UAAU;YACV,QAAQ,EAAE,MAAM,CAAC,IAAI;YACrB,sBAAsB,EAAE,SAAS,CAAC,YAAY;YAC9C,UAAU;YACV,YAAY,EAAE,SAAS,CAAC,IAAI;SAC7B,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAA;AAChC,CAAC;AAED,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAC/E,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,+CAA+C"}

package/dist/src/security/scanner/SecurityScanner.js

@@ -37,6 +37,14 @@ import { toMinimalRefs, toSARIF, toGitHubAnnotations, toSummary, } from './Secur
 export { analyzeMarkdownContext, isDocumentationContext, isWithinInlineCode, calculateRiskScore, extractUrls, };
 export { scanSsrfPatterns };
 export { toMinimalRefs, toSARIF, toGitHubAnnotations, toSummary };
+/**
+ * SMI-5879 (design §5): quickCheck is a fast pre-filter, not the full scan —
+ * a bare mention-tier match (a documentation page discussing "jailbreak" or
+ * "DAN") should not by itself fail the quick path. Derived ONCE at module
+ * load, not hand-maintained, so it can never silently drift from
+ * JAILBREAK_PATTERNS' own evidence-tier classification.
+ */
+export const DIRECTIVE_JAILBREAK_PATTERNS = JAILBREAK_PATTERNS.filter((p) => classifyEvidence(p) !== 'mention');
 export class SecurityScanner {
     allowedDomains;
     blockedPatterns;
@@ -161,8 +169,20 @@ export class SecurityScanner {
      * text contains. This disables ONLY the encoded-payload detector on the
      * inner call, not the rest of the suite — a decoded `curl|bash` still
      * trips `code_execution`, decoded secrets still trip `sensitive_path`, etc.
+     *
+     * SMI-5879: `EncodedPayloadRescanner`'s contract is a bare
+     * `SecurityFinding[]` return (SecurityScanner.encoding.ts, out of scope for
+     * this change), so a recursive `runDetectors` call for decoded content has
+     * no return channel of its own to report multiline truncation.
+     * `truncationRef` is a shared mutable out-param instead: every call (outer
+     * and any recursive rescan) ORs its own jailbreak/AI-defence truncation
+     * into it, so truncation anywhere in the recursion is visible to the
+     * original (outermost) caller. Per `ScanReport.multilineTruncated`'s own
+     * doc: being truncated is only ever used to RAISE caution, never to lower
+     * it, so over-reporting here (e.g. attributing an inner rescan's
+     * truncation to the whole document) is safe by that same design.
      */
-    runDetectors(content, lineContexts, skipEncodedPayload, isHighTrustAuthor = false, isMarkdown = true) {
+    runDetectors(content, lineContexts, skipEncodedPayload, isHighTrustAuthor = false, isMarkdown = true, truncationRef) {
         const findings = [];
         // SMI-5881: the multiline (full-content) regex pass has its OWN, much
         // smaller cap than maxContentLength — a ReDoS budget input, not a free
@@ -174,7 +194,8 @@ export class SecurityScanner {
         const effectiveMultilineLimit = Math.min(MAX_CONTENT_LENGTH_FOR_REGEX, this.maxContentLength);
         findings.push(...this.scanUrls(content));
         findings.push(...scanSensitivePaths(content, lineContexts));
-        findings.push(...this.scanJailbreakPatterns(content, lineContexts, effectiveMultilineLimit));
+        const jailbreakResult = this.scanJailbreakPatterns(content, lineContexts, effectiveMultilineLimit);
+        findings.push(...jailbreakResult.findings);
         findings.push(...this.scanSuspiciousPatterns(content, lineContexts));
         findings.push(...scanSocialEngineering(content, lineContexts));
         findings.push(...scanPromptLeaking(content, lineContexts));
@@ -210,7 +231,12 @@ export class SecurityScanner {
         // run before escalateCodeExecution below since a later dispatch wires
         // this finding type into that co-signal mechanism.
         findings.push(...scanDecoyMisdirection(content, lineContexts));
-        findings.push(...this.scanAIDefenceVulnerabilities(content, lineContexts, effectiveMultilineLimit));
+        const aiDefenceResult = this.scanAIDefenceVulnerabilities(content, lineContexts, effectiveMultilineLimit);
+        findings.push(...aiDefenceResult.findings);
+        if (truncationRef) {
+            truncationRef.truncated =
+                truncationRef.truncated || jailbreakResult.truncated || aiDefenceResult.truncated;
+        }
         findings.push(...scanSsrfPatterns(content, lineContexts, effectiveMultilineLimit));
         findings.push(...scanPiiPatterns(content, lineContexts));
         findings.push(...scanCodeExecution(content, lineContexts));
@@ -236,7 +262,7 @@ export class SecurityScanner {
         // (inner) call to this same method — so no finding is ever run through
         // escalateCodeExecution/escalateCorroboratedMentions twice.
         if (!skipEncodedPayload) {
-            findings.push(...scanEncodedPayload(content, lineContexts, (decodedContent) => this.runDetectors(decodedContent, analyzeMarkdownContext(decodedContent, isMarkdown), true, isHighTrustAuthor, isMarkdown)));
+            findings.push(...scanEncodedPayload(content, lineContexts, (decodedContent) => this.runDetectors(decodedContent, analyzeMarkdownContext(decodedContent, isMarkdown), true, isHighTrustAuthor, isMarkdown, truncationRef)));
         }
         return findings;
     }
@@ -282,7 +308,8 @@ export class SecurityScanner {
                     `${this.maxContentLength} code units)`,
             });
         }
-        findings.push(...this.runDetectors(content, lineContexts, false, isHighTrustAuthor, isMarkdown));
+        const truncationRef = { truncated: false };
+        findings.push(...this.runDetectors(content, lineContexts, false, isHighTrustAuthor, isMarkdown, truncationRef));
         const endTime = performance.now();
         const { total: riskScore, breakdown: riskBreakdown } = calculateRiskScore(findings);
         const hasCritical = findings.some((f) => f.severity === 'critical');
@@ -296,10 +323,16 @@ export class SecurityScanner {
             scanDurationMs: endTime - startTime,
             riskScore,
             riskBreakdown,
+            multilineTruncated: truncationRef.truncated,
         };
     }
+    /**
+     * SMI-5879 (design §5): tests only the directive-tier derived subset (a
+     * bare mention like "jailbreak" or "DAN" alone should not fail the quick
+     * path — see DIRECTIVE_JAILBREAK_PATTERNS above).
+     */
     quickCheck(content) {
-        for (const pattern of JAILBREAK_PATTERNS) {
+        for (const pattern of DIRECTIVE_JAILBREAK_PATTERNS) {
             if (safeRegexCheck(pattern, content))
                 return false;
         }

package/dist/src/security/scanner/SecurityScanner.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAA;AAI9F,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,gCAAgC,GACjC,MAAM,8BAA8B,CAAA;AACrC,+EAA+E;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AACvD,gFAAgF;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AAEpE,sBAAsB;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAE5D,+EAA+E;AAC/E,sEAAsE;AACtE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,eAAe,GAChB,MAAM,+BAA+B,CAAA;AAEtC,qEAAqE;AACrE,6DAA6D;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AACpE,+DAA+D;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AACjE,qFAAqF;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AACpE,sFAAsF;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAClE,oEAAoE;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAElE,8EAA8E;AAC9E,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,2BAA2B,CAAA;AAElC,wEAAwE;AACxE,iCAAiC;AACjC,OAAO,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAA;AAE9F,iEAAiE;AACjE,OAAO,EACL,aAAa,EACb,OAAO,EACP,mBAAmB,EACnB,SAAS,GACV,MAAM,iCAAiC,CAAA;AAExC,kDAAkD;AAClD,OAAO,EAEL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,GACZ,CAAA;AACD,OAAO,EAAE,gBAAgB,EAAE,CAAA;AAC3B,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAA;AAEjE,MAAM,OAAO,eAAe;IAClB,cAAc,CAAa;IAC3B,eAAe,CAAU;IACzB,gBAAgB,CAAQ;IACxB,aAAa,CAAQ;IAE7B,YAAY,UAA0B,EAAE;QACtC,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,uBAAuB,CAAC,CAAA;QAChF,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAA;QACpD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,SAAS,CAAA,CAAC,MAAM;QACpE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;IAClD,CAAC;IAEO,eAAe,CAAC,GAAW;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;YAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;YAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CACzC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC,CACnE,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,OAAe;QAC9B,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;QAEjC,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,KAAK;oBACX,QAAQ,EAAE,QAAQ;oBAClB,OAAO,EAAE,kCAAkC,GAAG,EAAE;oBAChD,QAAQ,EAAE,GAAG;oBACb,UAAU,EAAE,IAAI;iBACjB,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC;IAEO,qBAAqB,CAC3B,OAAe,EACf,YAAuC,EACvC,kBAA0B;QAE1B,OAAO,gCAAgC,CACrC,OAAO,EACP;YACE,IAAI,EAAE,WAAW;YACjB,aAAa,EAAE,sCAAsC;YACrD,QAAQ,EAAE,kBAAkB;YAC5B,QAAQ,EAAE,gBAAgB;SAC3B,EACD,YAAY,EACZ,kBAAkB,CACnB,CAAA;IACH,CAAC;IAEO,sBAAsB,CAAC,OAAe,EAAE,YAA4B;QAC1E,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;QAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;YAE3B,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;gBAC1C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAC1C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;oBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;oBAC9E,oEAAoE;oBACpE,sEAAsE;oBACtE,2EAA2E;oBAC3E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;oBACnE,MAAM,QAAQ,GAAgC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAA;oBAE7E,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,oBAAoB;wBAC1B,QAAQ;wBACR,OAAO,EAAE,iCAAiC,KAAK,CAAC,CAAC,CAAC,GAAG;wBACrD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;wBACrB,QAAQ,EAAE,oBAAoB;wBAC9B,sBAAsB,EAAE,YAAY;wBACpC,UAAU;qBACX,CAAC,CAAA;oBACF,MAAK;gBACP,CAAC;YACH,CAAC;YAED,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC3C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAC1C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;oBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;oBAC9E,qEAAqE;oBACrE,gEAAgE;oBAChE,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;oBACnE,MAAM,QAAQ,GAAgC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;oBAE9E,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,oBAAoB;wBAC1B,QAAQ;wBACR,OAAO,EAAE,8BAA8B,KAAK,CAAC,CAAC,CAAC,GAAG;wBAClD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;wBACrB,QAAQ,EAAE,oBAAoB;wBAC9B,sBAAsB,EAAE,YAAY;wBACpC,UAAU;qBACX,CAAC,CAAA;oBACF,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAEO,4BAA4B,CAClC,OAAe,EACf,YAAuC,EACvC,kBAA0B;QAE1B,OAAO,gCAAgC,CACrC,OAAO,EACP;YACE,IAAI,EAAE,YAAY;YAClB,aAAa,EAAE,+BAA+B;YAC9C,QAAQ,EAAE,mBAAmB;YAC7B,QAAQ,EAAE,gBAAgB;SAC3B,EACD,YAAY,EACZ,kBAAkB,CACnB,CAAA;IACH,CAAC;IAED,0EAA0E;IAC1E,kBAAkB,GAAG,kBAAkB,CAAA;IAEvC;;;;;;;;;;;;;;;OAeG;IACK,YAAY,CAClB,OAAe,EACf,YAA2B,EAC3B,kBAA2B,EAC3B,iBAAiB,GAAG,KAAK,EACzB,UAAU,GAAG,IAAI;QAEjB,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,qEAAqE;QACrE,sEAAsE;QACtE,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,uBAAuB,GAAG,IAAI,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAE7F,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;QACxC,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,YAAY,EAAE,uBAAuB,CAAC,CAAC,CAAA;QAC5F,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC9D,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC1D,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC7D,QAAQ,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAChE,uEAAuE;QACvE,2EAA2E;QAC3E,sEAAsE;QACtE,4EAA4E;QAC5E,6CAA6C;QAC7C,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,QAAQ;aACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,sBAAsB,IAAI,CAAC,CAAC,UAAU,CAAC;aAChE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAoB,CAAC,CACtC,CAAA;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,OAAO,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,CAAA;QAC7E,0EAA0E;QAC1E,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAA;QAChF,gEAAgE;QAChE,oEAAoE;QACpE,oEAAoE;QACpE,mBAAmB;QACnB,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC3D,wEAAwE;QACxE,sEAAsE;QACtE,kEAAkE;QAClE,oEAAoE;QACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC3D,qEAAqE;QACrE,kEAAkE;QAClE,uEAAuE;QACvE,sEAAsE;QACtE,mDAAmD;QACnD,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC9D,QAAQ,CAAC,IAAI,CACX,GAAG,IAAI,CAAC,4BAA4B,CAAC,OAAO,EAAE,YAAY,EAAE,uBAAuB,CAAC,CACrF,CAAA;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,uBAAuB,CAAC,CAAC,CAAA;QAClF,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QACxD,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC1D,QAAQ,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAA;QAElD,iFAAiF;QACjF,gFAAgF;QAChF,2DAA2D;QAC3D,qBAAqB,CAAC,QAAQ,CAAC,CAAA;QAE/B,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,8DAA8D;QAC9D,gEAAgE;QAChE,qEAAqE;QACrE,gEAAgE;QAChE,sEAAsE;QACtE,8CAA8C;QAC9C,4BAA4B,CAAC,QAAQ,CAAC,CAAA;QAEtC,0EAA0E;QAC1E,kEAAkE;QAClE,yEAAyE;QACzE,uEAAuE;QACvE,4DAA4D;QAC5D,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CACX,GAAG,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,cAAc,EAAE,EAAE,CAC9D,IAAI,CAAC,YAAY,CACf,cAAc,EACd,sBAAsB,CAAC,cAAc,EAAE,UAAU,CAAC,EAClD,IAAI,EACJ,iBAAiB,EACjB,UAAU,CACX,CACF,CACF,CAAA;QACH,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,CAAC,OAAe,EAAE,OAAe,EAAE,iBAAiB,GAAG,KAAK,EAAE,UAAU,GAAG,IAAI;QACjF,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QACnC,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,YAAY,GAAG,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAEhE,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,mCAAmC,IAAI,CAAC,gBAAgB,cAAc;aAChF,CAAC,CAAA;QACJ,CAAC;QAED,wEAAwE;QACxE,sDAAsD;QACtD,MAAM,uBAAuB,GAAG,IAAI,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC7F,IAAI,OAAO,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,KAAK;gBACf,OAAO,EACL,qCAAqC,uBAAuB,cAAc;oBAC1E,eAAe,OAAO,CAAC,MAAM,8CAA8C;oBAC3E,GAAG,IAAI,CAAC,gBAAgB,cAAc;aACzC,CAAC,CAAA;QACJ,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAA;QAEhG,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QAEnF,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAA;QAC3D,MAAM,gBAAgB,GAAG,SAAS,IAAI,IAAI,CAAC,aAAa,CAAA;QAExD,OAAO;YACL,OAAO;YACP,MAAM,EAAE,CAAC,WAAW,IAAI,CAAC,OAAO,IAAI,CAAC,gBAAgB;YACrD,QAAQ;YACR,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,cAAc,EAAE,OAAO,GAAG,SAAS;YACnC,SAAS;YACT,aAAa;SACd,CAAA;IACH,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;YACzC,IAAI,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAA;QACpD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gBAAgB,CAAC,MAAc;QAC7B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;IAC/C,CAAC;IAED,iBAAiB,CAAC,OAAe;QAC/B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACpC,CAAC;IAED,oEAAoE;IACpE,MAAM,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,MAAM,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,MAAM,CAAC,mBAAmB,GAAG,mBAAmB,CAAA;IAChD,MAAM,CAAC,SAAS,GAAG,SAAS,CAAA;;AAG9B,eAAe,eAAe,CAAA"}
+{"version":3,"file":"SecurityScanner.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAA;AAI9F,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,gCAAgC,GACjC,MAAM,8BAA8B,CAAA;AACrC,+EAA+E;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AACvD,gFAAgF;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AAEpE,sBAAsB;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAE5D,+EAA+E;AAC/E,sEAAsE;AACtE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,eAAe,GAChB,MAAM,+BAA+B,CAAA;AAEtC,qEAAqE;AACrE,6DAA6D;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AACpE,+DAA+D;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AACjE,qFAAqF;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AACpE,sFAAsF;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAClE,oEAAoE;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAElE,8EAA8E;AAC9E,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,2BAA2B,CAAA;AAElC,wEAAwE;AACxE,iCAAiC;AACjC,OAAO,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAA;AAE9F,iEAAiE;AACjE,OAAO,EACL,aAAa,EACb,OAAO,EACP,mBAAmB,EACnB,SAAS,GACV,MAAM,iCAAiC,CAAA;AAExC,kDAAkD;AAClD,OAAO,EAEL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,GACZ,CAAA;AACD,OAAO,EAAE,gBAAgB,EAAE,CAAA;AAC3B,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAA;AAEjE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAsB,kBAAkB,CAAC,MAAM,CACtF,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,SAAS,CACzC,CAAA;AAED,MAAM,OAAO,eAAe;IAClB,cAAc,CAAa;IAC3B,eAAe,CAAU;IACzB,gBAAgB,CAAQ;IACxB,aAAa,CAAQ;IAE7B,YAAY,UAA0B,EAAE;QACtC,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,uBAAuB,CAAC,CAAA;QAChF,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAA;QACpD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,SAAS,CAAA,CAAC,MAAM;QACpE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;IAClD,CAAC;IAEO,eAAe,CAAC,GAAW;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;YAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;YAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CACzC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC,CACnE,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,OAAe;QAC9B,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;QAEjC,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,KAAK;oBACX,QAAQ,EAAE,QAAQ;oBAClB,OAAO,EAAE,kCAAkC,GAAG,EAAE;oBAChD,QAAQ,EAAE,GAAG;oBACb,UAAU,EAAE,IAAI;iBACjB,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC;IAEO,qBAAqB,CAC3B,OAAe,EACf,YAAuC,EACvC,kBAA0B;QAE1B,OAAO,gCAAgC,CACrC,OAAO,EACP;YACE,IAAI,EAAE,WAAW;YACjB,aAAa,EAAE,sCAAsC;YACrD,QAAQ,EAAE,kBAAkB;YAC5B,QAAQ,EAAE,gBAAgB;SAC3B,EACD,YAAY,EACZ,kBAAkB,CACnB,CAAA;IACH,CAAC;IAEO,sBAAsB,CAAC,OAAe,EAAE,YAA4B;QAC1E,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;QAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;YAE3B,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;gBAC1C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAC1C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;oBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;oBAC9E,oEAAoE;oBACpE,sEAAsE;oBACtE,2EAA2E;oBAC3E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;oBACnE,MAAM,QAAQ,GAAgC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAA;oBAE7E,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,oBAAoB;wBAC1B,QAAQ;wBACR,OAAO,EAAE,iCAAiC,KAAK,CAAC,CAAC,CAAC,GAAG;wBACrD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;wBACrB,QAAQ,EAAE,oBAAoB;wBAC9B,sBAAsB,EAAE,YAAY;wBACpC,UAAU;qBACX,CAAC,CAAA;oBACF,MAAK;gBACP,CAAC;YACH,CAAC;YAED,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC3C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAC1C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;oBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;oBAC9E,qEAAqE;oBACrE,gEAAgE;oBAChE,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;oBACnE,MAAM,QAAQ,GAAgC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;oBAE9E,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,oBAAoB;wBAC1B,QAAQ;wBACR,OAAO,EAAE,8BAA8B,KAAK,CAAC,CAAC,CAAC,GAAG;wBAClD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;wBACrB,QAAQ,EAAE,oBAAoB;wBAC9B,sBAAsB,EAAE,YAAY;wBACpC,UAAU;qBACX,CAAC,CAAA;oBACF,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAEO,4BAA4B,CAClC,OAAe,EACf,YAAuC,EACvC,kBAA0B;QAE1B,OAAO,gCAAgC,CACrC,OAAO,EACP;YACE,IAAI,EAAE,YAAY;YAClB,aAAa,EAAE,+BAA+B;YAC9C,QAAQ,EAAE,mBAAmB;YAC7B,QAAQ,EAAE,gBAAgB;SAC3B,EACD,YAAY,EACZ,kBAAkB,CACnB,CAAA;IACH,CAAC;IAED,0EAA0E;IAC1E,kBAAkB,GAAG,kBAAkB,CAAA;IAEvC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACK,YAAY,CAClB,OAAe,EACf,YAA2B,EAC3B,kBAA2B,EAC3B,iBAAiB,GAAG,KAAK,EACzB,UAAU,GAAG,IAAI,EACjB,aAAsC;QAEtC,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,qEAAqE;QACrE,sEAAsE;QACtE,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,uBAAuB,GAAG,IAAI,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAE7F,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;QACxC,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC3D,MAAM,eAAe,GAAwB,IAAI,CAAC,qBAAqB,CACrE,OAAO,EACP,YAAY,EACZ,uBAAuB,CACxB,CAAA;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;QAC1C,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC9D,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC1D,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC7D,QAAQ,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAChE,uEAAuE;QACvE,2EAA2E;QAC3E,sEAAsE;QACtE,4EAA4E;QAC5E,6CAA6C;QAC7C,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,QAAQ;aACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,sBAAsB,IAAI,CAAC,CAAC,UAAU,CAAC;aAChE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAoB,CAAC,CACtC,CAAA;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,OAAO,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,CAAA;QAC7E,0EAA0E;QAC1E,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAA;QAChF,gEAAgE;QAChE,oEAAoE;QACpE,oEAAoE;QACpE,mBAAmB;QACnB,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC3D,wEAAwE;QACxE,sEAAsE;QACtE,kEAAkE;QAClE,oEAAoE;QACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC3D,qEAAqE;QACrE,kEAAkE;QAClE,uEAAuE;QACvE,sEAAsE;QACtE,mDAAmD;QACnD,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC9D,MAAM,eAAe,GAAwB,IAAI,CAAC,4BAA4B,CAC5E,OAAO,EACP,YAAY,EACZ,uBAAuB,CACxB,CAAA;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;QAC1C,IAAI,aAAa,EAAE,CAAC;YAClB,aAAa,CAAC,SAAS;gBACrB,aAAa,CAAC,SAAS,IAAI,eAAe,CAAC,SAAS,IAAI,eAAe,CAAC,SAAS,CAAA;QACrF,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,uBAAuB,CAAC,CAAC,CAAA;QAClF,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QACxD,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC1D,QAAQ,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAA;QAElD,iFAAiF;QACjF,gFAAgF;QAChF,2DAA2D;QAC3D,qBAAqB,CAAC,QAAQ,CAAC,CAAA;QAE/B,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,8DAA8D;QAC9D,gEAAgE;QAChE,qEAAqE;QACrE,gEAAgE;QAChE,sEAAsE;QACtE,8CAA8C;QAC9C,4BAA4B,CAAC,QAAQ,CAAC,CAAA;QAEtC,0EAA0E;QAC1E,kEAAkE;QAClE,yEAAyE;QACzE,uEAAuE;QACvE,4DAA4D;QAC5D,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CACX,GAAG,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,cAAc,EAAE,EAAE,CAC9D,IAAI,CAAC,YAAY,CACf,cAAc,EACd,sBAAsB,CAAC,cAAc,EAAE,UAAU,CAAC,EAClD,IAAI,EACJ,iBAAiB,EACjB,UAAU,EACV,aAAa,CACd,CACF,CACF,CAAA;QACH,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,CAAC,OAAe,EAAE,OAAe,EAAE,iBAAiB,GAAG,KAAK,EAAE,UAAU,GAAG,IAAI;QACjF,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QACnC,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,YAAY,GAAG,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAEhE,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,mCAAmC,IAAI,CAAC,gBAAgB,cAAc;aAChF,CAAC,CAAA;QACJ,CAAC;QAED,wEAAwE;QACxE,sDAAsD;QACtD,MAAM,uBAAuB,GAAG,IAAI,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC7F,IAAI,OAAO,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,KAAK;gBACf,OAAO,EACL,qCAAqC,uBAAuB,cAAc;oBAC1E,eAAe,OAAO,CAAC,MAAM,8CAA8C;oBAC3E,GAAG,IAAI,CAAC,gBAAgB,cAAc;aACzC,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;QAC1C,QAAQ,CAAC,IAAI,CACX,GAAG,IAAI,CAAC,YAAY,CAClB,OAAO,EACP,YAAY,EACZ,KAAK,EACL,iBAAiB,EACjB,UAAU,EACV,aAAa,CACd,CACF,CAAA;QAED,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QAEnF,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAA;QAC3D,MAAM,gBAAgB,GAAG,SAAS,IAAI,IAAI,CAAC,aAAa,CAAA;QAExD,OAAO;YACL,OAAO;YACP,MAAM,EAAE,CAAC,WAAW,IAAI,CAAC,OAAO,IAAI,CAAC,gBAAgB;YACrD,QAAQ;YACR,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,cAAc,EAAE,OAAO,GAAG,SAAS;YACnC,SAAS;YACT,aAAa;YACb,kBAAkB,EAAE,aAAa,CAAC,SAAS;SAC5C,CAAA;IACH,CAAC;IAED;;;;OAIG;IACH,UAAU,CAAC,OAAe;QACxB,KAAK,MAAM,OAAO,IAAI,4BAA4B,EAAE,CAAC;YACnD,IAAI,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAA;QACpD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gBAAgB,CAAC,MAAc;QAC7B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;IAC/C,CAAC;IAED,iBAAiB,CAAC,OAAe;QAC/B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACpC,CAAC;IAED,oEAAoE;IACpE,MAAM,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,MAAM,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,MAAM,CAAC,mBAAmB,GAAG,mBAAmB,CAAA;IAChD,MAAM,CAAC,SAAS,GAAG,SAAS,CAAA;;AAG9B,eAAe,eAAe,CAAA"}

package/dist/src/security/scanner/SecurityScanner.pii.d.ts

@@ -8,6 +8,36 @@
  */
 import type { SecurityFinding } from './types.js';
 import type { LineContext } from './SecurityScanner.helpers.js';
+/**
+ * SMI-5420: named-placeholder markers that indicate an example, not a real
+ * secret. Intentionally NO `X{4,}` rule — it would test the raw match string and
+ * short-circuit before the entropy check, downgrading a REAL high-entropy secret
+ * that coincidentally contains `xxxx` (governance FN). An all-repeated-char value
+ * (e.g. `xxxx…`) is caught by the `/^(.)\1+$/` check in looksLikePlaceholderSecret
+ * instead, and partial-repeat low-variety values by the entropy floor.
+ *
+ * SMI-5423: the SHORT markers (FAKE/DUMMY/SAMPLE/YOUR, ≤6 chars) are guarded with
+ * a negative lookbehind `(?<![A-Za-z0-9])` so they only match as a delimited token
+ * (`FAKE_KEY`, `<FAKE>`, value-start) — NOT mid-random-string (`k7FAKE1abc`), which
+ * is the same raw-match short-circuit FN class as the removed `X{4,}`. Longer
+ * markers (EXAMPLE/PLACEHOLDER/CHANGEME/REDACTED, 7+ chars) stay unbounded: their
+ * coincidence probability is negligible AND `AKIA…7EXAMPLE` needs EXAMPLE to match
+ * mid-token.
+ *
+ * Accepted tradeoff (SMI-5423 governance): a digit-immediately-prefixed token like
+ * `1FAKE_KEY` fails the lookbehind and scores critical rather than low. This is the
+ * FP-SAFE direction (over-flag a rare contrived placeholder) — strictly preferable
+ * in a security scanner to the FN it replaces (a real secret downgraded); and a
+ * longer such value falls under the entropy floor anyway.
+ *
+ * SMI-5207: exported (additively — `looksLikePlaceholderSecret` below is
+ * unchanged, and MF-1 / scanPiiPatterns keep sharing it byte-identically) so
+ * MF-4's isProseValue() can reuse the same placeholder vocabulary when
+ * deciding whether an assigned credential value references a secret rather
+ * than containing one. No `g` flag, so `.test()` is stateless and safe to
+ * share across call sites.
+ */
+export declare const PLACEHOLDER_SECRET_RE: RegExp;
 /** SMI-5420: Shannon entropy (bits per character) of a string. */
 export declare function shannonEntropy(s: string): number;
 /**

package/dist/src/security/scanner/SecurityScanner.pii.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.pii.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.pii.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAqB,MAAM,YAAY,CAAA;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAmD/D,kEAAkE;AAClE,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAUhD;AAaD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMjE;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CAgFhG"}
+{"version":3,"file":"SecurityScanner.pii.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.pii.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAqB,MAAM,YAAY,CAAA;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAiB/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,qBAAqB,QACmI,CAAA;AAWrK,kEAAkE;AAClE,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAUhD;AAaD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMjE;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CAgFhG"}

package/dist/src/security/scanner/SecurityScanner.pii.js

@@ -37,8 +37,15 @@ const CREDENTIAL_PII_INDICES = new Set([0, 1, 2, 3, 4, 5, 6, 10]);
  * FP-SAFE direction (over-flag a rare contrived placeholder) — strictly preferable
  * in a security scanner to the FN it replaces (a real secret downgraded); and a
  * longer such value falls under the entropy floor anyway.
+ *
+ * SMI-5207: exported (additively — `looksLikePlaceholderSecret` below is
+ * unchanged, and MF-1 / scanPiiPatterns keep sharing it byte-identically) so
+ * MF-4's isProseValue() can reuse the same placeholder vocabulary when
+ * deciding whether an assigned credential value references a secret rather
+ * than containing one. No `g` flag, so `.test()` is stateless and safe to
+ * share across call sites.
  */
-const PLACEHOLDER_SECRET_RE = /EXAMPLE|(?<![A-Za-z0-9])YOUR[_-]?|PLACEHOLDER|CHANGE[_-]?ME|(?<![A-Za-z0-9])DUMMY|(?<![A-Za-z0-9])FAKE|(?<![A-Za-z0-9])SAMPLE|REDACTED|INSERT[_-]|\.\.\.|<[^>]+>/i;
+export const PLACEHOLDER_SECRET_RE = /EXAMPLE|(?<![A-Za-z0-9])YOUR[_-]?|PLACEHOLDER|CHANGE[_-]?ME|(?<![A-Za-z0-9])DUMMY|(?<![A-Za-z0-9])FAKE|(?<![A-Za-z0-9])SAMPLE|REDACTED|INSERT[_-]|\.\.\.|<[^>]+>/i;
 /**
  * SMI-5420: minimum Shannon entropy (bits/char) for a value to read as a real secret.
  * SMI-5424 PR2 (accepted tradeoff): a hardcoded credential value shorter than ~8 chars

package/dist/src/security/scanner/SecurityScanner.pii.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.pii.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.pii.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAE5C;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;AAEjE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,qBAAqB,GACzB,mKAAmK,CAAA;AAErK;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEhC,kEAAkE;AAClE,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAA;IAChB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAA;IACtC,KAAK,MAAM,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACzD,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;QACtB,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvB,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK;SACT,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;SAC7B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,IAAI,EAAE,CAAA;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAClD,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACvC,OAAO,cAAc,CAAC,KAAK,CAAC,GAAG,oBAAoB,CAAA;AACrD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,YAA4B;IAC3E,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAChE,IAAI,cAAc,GAAG,CAAC,CAAC,CAAA;IACvB,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;gBAC9B,cAAc,GAAG,CAAC,CAAA;gBAClB,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,iBAAiB,GAAG,CAAC,CAAA;IAC3B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC3B,MAAM,aAAa,GAAG,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,cAAc,CAAA;QACzD,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,CAAC,CAAA;YAChC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,cAAc,GAAG,EAAE,KAAK,iBAAiB,CAAA;gBAC/C,uEAAuE;gBACvE,oDAAoD;gBACpD,uEAAuE;gBACvE,qEAAqE;gBACrE,sEAAsE;gBACtE,8DAA8D;gBAC9D,qEAAqE;gBACrE,+DAA+D;gBAC/D,0CAA0C;gBAC1C,yDAAyD;gBACzD,4CAA4C;gBAC5C,EAAE;gBACF,mEAAmE;gBACnE,oEAAoE;gBACpE,gEAAgE;gBAChE,6DAA6D;gBAC7D,+DAA+D;gBAC/D,oEAAoE;gBACpE,+DAA+D;gBAC/D,+DAA+D;gBAC/D,8DAA8D;gBAC9D,6DAA6D;gBAC7D,MAAM,YAAY,GAChB,iHAAiH,CAAC,IAAI,CACpH,IAAI,CACL,CAAA;gBACH,MAAM,kBAAkB,GAAG,cAAc,IAAI,CAAC,aAAa,IAAI,YAAY,CAAC,CAAA;gBAC5E,IAAI,QAAgD,CAAA;gBACpD,IAAI,kBAAkB;oBAAE,QAAQ,GAAG,KAAK,CAAA;qBACnC,IAAI,YAAY;oBAAE,QAAQ,GAAG,QAAQ,CAAA;qBACrC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;oBAAE,QAAQ,GAAG,UAAU,CAAA;;oBAC9C,QAAQ,GAAG,MAAM,CAAA;gBACtB,IAAI,UAAU,GAAsB,YAAY,IAAI,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACvF,yEAAyE;gBACzE,mEAAmE;gBACnE,wEAAwE;gBACxE,yEAAyE;gBACzE,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3E,QAAQ,GAAG,KAAK,CAAA;oBAChB,UAAU,GAAG,KAAK,CAAA;gBACpB,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,KAAK;oBACX,QAAQ;oBACR,OAAO,EAAE,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;oBACrF,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,KAAK;oBACf,sBAAsB,EAAE,YAAY,IAAI,kBAAkB;oBAC1D,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IACF,OAAO,QAAQ,CAAA;AACjB,CAAC"}
+{"version":3,"file":"SecurityScanner.pii.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.pii.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAE5C;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAChC,mKAAmK,CAAA;AAErK;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEhC,kEAAkE;AAClE,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAA;IAChB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAA;IACtC,KAAK,MAAM,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACzD,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;QACtB,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvB,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK;SACT,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;SAC7B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,IAAI,EAAE,CAAA;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAClD,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACvC,OAAO,cAAc,CAAC,KAAK,CAAC,GAAG,oBAAoB,CAAA;AACrD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,YAA4B;IAC3E,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAChE,IAAI,cAAc,GAAG,CAAC,CAAC,CAAA;IACvB,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;gBAC9B,cAAc,GAAG,CAAC,CAAA;gBAClB,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,iBAAiB,GAAG,CAAC,CAAA;IAC3B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC3B,MAAM,aAAa,GAAG,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,cAAc,CAAA;QACzD,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,CAAC,CAAA;YAChC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,cAAc,GAAG,EAAE,KAAK,iBAAiB,CAAA;gBAC/C,uEAAuE;gBACvE,oDAAoD;gBACpD,uEAAuE;gBACvE,qEAAqE;gBACrE,sEAAsE;gBACtE,8DAA8D;gBAC9D,qEAAqE;gBACrE,+DAA+D;gBAC/D,0CAA0C;gBAC1C,yDAAyD;gBACzD,4CAA4C;gBAC5C,EAAE;gBACF,mEAAmE;gBACnE,oEAAoE;gBACpE,gEAAgE;gBAChE,6DAA6D;gBAC7D,+DAA+D;gBAC/D,oEAAoE;gBACpE,+DAA+D;gBAC/D,+DAA+D;gBAC/D,8DAA8D;gBAC9D,6DAA6D;gBAC7D,MAAM,YAAY,GAChB,iHAAiH,CAAC,IAAI,CACpH,IAAI,CACL,CAAA;gBACH,MAAM,kBAAkB,GAAG,cAAc,IAAI,CAAC,aAAa,IAAI,YAAY,CAAC,CAAA;gBAC5E,IAAI,QAAgD,CAAA;gBACpD,IAAI,kBAAkB;oBAAE,QAAQ,GAAG,KAAK,CAAA;qBACnC,IAAI,YAAY;oBAAE,QAAQ,GAAG,QAAQ,CAAA;qBACrC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;oBAAE,QAAQ,GAAG,UAAU,CAAA;;oBAC9C,QAAQ,GAAG,MAAM,CAAA;gBACtB,IAAI,UAAU,GAAsB,YAAY,IAAI,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACvF,yEAAyE;gBACzE,mEAAmE;gBACnE,wEAAwE;gBACxE,yEAAyE;gBACzE,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3E,QAAQ,GAAG,KAAK,CAAA;oBAChB,UAAU,GAAG,KAAK,CAAA;gBACpB,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,KAAK;oBACX,QAAQ;oBACR,OAAO,EAAE,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;oBACrF,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,KAAK;oBACf,sBAAsB,EAAE,YAAY,IAAI,kBAAkB;oBAC1D,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IACF,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/src/security/scanner/SecurityScanner.prose-lexicon.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Security Scanner — prose lexicons for the SMI-5207 sensitive_path gates
+ * @module @skillsmith/core/security/scanner/SecurityScanner.prose-lexicon
+ *
+ * SMI-5207: NEGATION_TOKENS (MF-3) and PROSE_STOPWORDS (MF-4) split out of
+ * SecurityScanner.scanners.ts purely for the 500-line pre-commit gate — the
+ * two word lists are ~120 lines once Prettier expands them one entry per
+ * line, which would push that file past the limit. No logic lives here; both
+ * gates' behaviour is entirely in SecurityScanner.scanners.ts.
+ *
+ * The two lists have no consumer in common (round 6 deleted MF-3's
+ * blockquote-vs-operator content classification, which was the only thing
+ * that ever made MF-3 read PROSE_STOPWORDS) — they share a file for the line
+ * budget, not because they are one concept. Keep them independently editable.
+ */
+/**
+ * MF-3 (SMI-5207, round 3): negation lookaround. A negated verb is not action
+ * evidence — "This guide downloads no files and explains ~/.ssh/config"
+ * (round-3 counter-example, unquoted prose) must not fire HIGH. The negation
+ * token can appear BEFORE ("never uploads") or AFTER ("downloads no files")
+ * the verb, so the window is bidirectional. Deliberately narrow: same line
+ * only, small window, no general negation engine.
+ */
+export declare const NEGATION_TOKENS: Set<string>;
+/**
+ * MF-3 (SMI-5207, round 10): determiners that force the NOUN reading of a
+ * token which is otherwise spelled like an action verb — "The Downloads
+ * folder", "the uploads dashboard", "your downloads".
+ *
+ * This is a hard grammatical invariant, not a heuristic: an article or
+ * possessive determiner cannot be immediately followed by a finite verb in
+ * English. So it is applied at distance EXACTLY 1 and nowhere else — "This
+ * skill downloads ~/.ssh/id_rsa" keeps firing, because `skill` sits between
+ * the determiner and the verb. Demonstratives (this/these/those) are
+ * deliberately EXCLUDED: "This downloads the key" is a legitimate verb
+ * reading, so they carry real FN risk that the/a/an/possessives do not.
+ */
+export declare const NOUN_DETERMINERS: Set<string>;
+/**
+ * MF-3 (SMI-5207, round 10): verbs and agent nouns that mark a sentence as
+ * DESCRIBING detection rather than instructing an action — "This rule detects
+ * malware that steals ~/.ssh/id_rsa". Used only in combination with
+ * RELATIVE_MARKERS (see hasActionEvidence); neither signal suppresses on its
+ * own, and neither ever suppresses a shell operator.
+ */
+export declare const DETECTION_FRAMING: Set<string>;
+/**
+ * MF-3 (SMI-5207, round 10): relative pronouns. Their presence immediately
+ * before an action verb marks it as the verb of a SUBORDINATE descriptive
+ * clause ("code that exfiltrates X"), never an imperative.
+ */
+export declare const RELATIVE_MARKERS: Set<string>;
+/**
+ * MF-4 (SMI-5207): English function words. A passphrase is nouns; an
+ * explanatory sentence is not. The only signal separating `correct horse
+ * battery staple` from `never paste your password into chat` — both lowercase
+ * multi-word spans.
+ */
+export declare const PROSE_STOPWORDS: Set<string>;
+//# sourceMappingURL=SecurityScanner.prose-lexicon.d.ts.map

package/dist/src/security/scanner/SecurityScanner.prose-lexicon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.prose-lexicon.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.prose-lexicon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,aAe1B,CAAA;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gBAAgB,aAW3B,CAAA;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,aA0C5B,CAAA;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,aAAqD,CAAA;AAElF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,aAoG1B,CAAA"}