@skillsmith/core 0.12.1 → 0.12.3

package/dist/src/security/scanner/SecurityScanner.prose-lexicon.js

@@ -0,0 +1,228 @@
+/**
+ * Security Scanner — prose lexicons for the SMI-5207 sensitive_path gates
+ * @module @skillsmith/core/security/scanner/SecurityScanner.prose-lexicon
+ *
+ * SMI-5207: NEGATION_TOKENS (MF-3) and PROSE_STOPWORDS (MF-4) split out of
+ * SecurityScanner.scanners.ts purely for the 500-line pre-commit gate — the
+ * two word lists are ~120 lines once Prettier expands them one entry per
+ * line, which would push that file past the limit. No logic lives here; both
+ * gates' behaviour is entirely in SecurityScanner.scanners.ts.
+ *
+ * The two lists have no consumer in common (round 6 deleted MF-3's
+ * blockquote-vs-operator content classification, which was the only thing
+ * that ever made MF-3 read PROSE_STOPWORDS) — they share a file for the line
+ * budget, not because they are one concept. Keep them independently editable.
+ */
+/**
+ * MF-3 (SMI-5207, round 3): negation lookaround. A negated verb is not action
+ * evidence — "This guide downloads no files and explains ~/.ssh/config"
+ * (round-3 counter-example, unquoted prose) must not fire HIGH. The negation
+ * token can appear BEFORE ("never uploads") or AFTER ("downloads no files")
+ * the verb, so the window is bidirectional. Deliberately narrow: same line
+ * only, small window, no general negation engine.
+ */
+export const NEGATION_TOKENS = new Set([
+    'no',
+    'not',
+    'never',
+    'without',
+    'cannot',
+    "can't",
+    "doesn't",
+    "don't",
+    "won't",
+    "didn't",
+    "isn't",
+    "aren't",
+    'nor',
+    'neither',
+]);
+/**
+ * MF-3 (SMI-5207, round 10): determiners that force the NOUN reading of a
+ * token which is otherwise spelled like an action verb — "The Downloads
+ * folder", "the uploads dashboard", "your downloads".
+ *
+ * This is a hard grammatical invariant, not a heuristic: an article or
+ * possessive determiner cannot be immediately followed by a finite verb in
+ * English. So it is applied at distance EXACTLY 1 and nowhere else — "This
+ * skill downloads ~/.ssh/id_rsa" keeps firing, because `skill` sits between
+ * the determiner and the verb. Demonstratives (this/these/those) are
+ * deliberately EXCLUDED: "This downloads the key" is a legitimate verb
+ * reading, so they carry real FN risk that the/a/an/possessives do not.
+ */
+export const NOUN_DETERMINERS = new Set([
+    'the',
+    'a',
+    'an',
+    'my',
+    'your',
+    'our',
+    'their',
+    'its',
+    'his',
+    'her',
+]);
+/**
+ * MF-3 (SMI-5207, round 10): verbs and agent nouns that mark a sentence as
+ * DESCRIBING detection rather than instructing an action — "This rule detects
+ * malware that steals ~/.ssh/id_rsa". Used only in combination with
+ * RELATIVE_MARKERS (see hasActionEvidence); neither signal suppresses on its
+ * own, and neither ever suppresses a shell operator.
+ */
+export const DETECTION_FRAMING = new Set([
+    'detect',
+    'detects',
+    'detecting',
+    'detection',
+    'detector',
+    'detectors',
+    'flag',
+    'flags',
+    'flagging',
+    'flagged',
+    'identify',
+    'identifies',
+    'block',
+    'blocks',
+    'blocking',
+    'prevent',
+    'prevents',
+    'warn',
+    'warns',
+    'describe',
+    'describes',
+    'explain',
+    'explains',
+    'scan',
+    'scans',
+    'scanning',
+    'scanner',
+    'audit',
+    'audits',
+    'monitor',
+    'monitors',
+    'catch',
+    'catches',
+    'guard',
+    'guards',
+    'protect',
+    'protects',
+    'rule',
+    'rules',
+    'linter',
+    'analyzer',
+]);
+/**
+ * MF-3 (SMI-5207, round 10): relative pronouns. Their presence immediately
+ * before an action verb marks it as the verb of a SUBORDINATE descriptive
+ * clause ("code that exfiltrates X"), never an imperative.
+ */
+export const RELATIVE_MARKERS = new Set(['that', 'which', 'who', 'whom', 'whose']);
+/**
+ * MF-4 (SMI-5207): English function words. A passphrase is nouns; an
+ * explanatory sentence is not. The only signal separating `correct horse
+ * battery staple` from `never paste your password into chat` — both lowercase
+ * multi-word spans.
+ */
+export const PROSE_STOPWORDS = new Set([
+    'never',
+    'not',
+    'your',
+    'you',
+    'this',
+    'that',
+    'these',
+    'those',
+    'is',
+    'are',
+    'was',
+    'were',
+    'be',
+    'been',
+    'will',
+    'would',
+    'can',
+    'could',
+    'should',
+    'must',
+    'do',
+    'does',
+    'into',
+    'onto',
+    'from',
+    'with',
+    'without',
+    'by',
+    'for',
+    'of',
+    'to',
+    'in',
+    'on',
+    'at',
+    'as',
+    'and',
+    'or',
+    'but',
+    'if',
+    'when',
+    'where',
+    'how',
+    'why',
+    'use',
+    'using',
+    'used',
+    'see',
+    'via',
+    'per',
+    'they',
+    'them',
+    'their',
+    'it',
+    'its',
+    'we',
+    'our',
+    'us',
+    'please',
+    'ensure',
+    'make',
+    'sure',
+    'the',
+    'a',
+    'an',
+    'all',
+    'any',
+    'each',
+    'no',
+    'nor',
+    'so',
+    'than',
+    'then',
+    'there',
+    'here',
+    'what',
+    'which',
+    'who',
+    'while',
+    'during',
+    'after',
+    'before',
+    'above',
+    'below',
+    'up',
+    'down',
+    'out',
+    'off',
+    'over',
+    'under',
+    'again',
+    'further',
+    'once',
+    'only',
+    'own',
+    'same',
+    'too',
+    'very',
+    'just',
+    'now',
+]);
+//# sourceMappingURL=SecurityScanner.prose-lexicon.js.map

package/dist/src/security/scanner/SecurityScanner.prose-lexicon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.prose-lexicon.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.prose-lexicon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IACrC,IAAI;IACJ,KAAK;IACL,OAAO;IACP,SAAS;IACT,QAAQ;IACR,OAAO;IACP,SAAS;IACT,OAAO;IACP,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,KAAK;IACL,SAAS;CACV,CAAC,CAAA;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IACtC,KAAK;IACL,GAAG;IACH,IAAI;IACJ,IAAI;IACJ,MAAM;IACN,KAAK;IACL,OAAO;IACP,KAAK;IACL,KAAK;IACL,KAAK;CACN,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACvC,QAAQ;IACR,SAAS;IACT,WAAW;IACX,WAAW;IACX,UAAU;IACV,WAAW;IACX,MAAM;IACN,OAAO;IACP,UAAU;IACV,SAAS;IACT,UAAU;IACV,YAAY;IACZ,OAAO;IACP,QAAQ;IACR,UAAU;IACV,SAAS;IACT,UAAU;IACV,MAAM;IACN,OAAO;IACP,UAAU;IACV,WAAW;IACX,SAAS;IACT,UAAU;IACV,MAAM;IACN,OAAO;IACP,UAAU;IACV,SAAS;IACT,OAAO;IACP,QAAQ;IACR,SAAS;IACT,UAAU;IACV,OAAO;IACP,SAAS;IACT,OAAO;IACP,QAAQ;IACR,SAAS;IACT,UAAU;IACV,MAAM;IACN,OAAO;IACP,QAAQ;IACR,UAAU;CACX,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;AAElF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IACrC,OAAO;IACP,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,IAAI;IACJ,KAAK;IACL,KAAK;IACL,MAAM;IACN,IAAI;IACJ,MAAM;IACN,MAAM;IACN,OAAO;IACP,KAAK;IACL,OAAO;IACP,QAAQ;IACR,MAAM;IACN,IAAI;IACJ,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;IACT,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,MAAM;IACN,OAAO;IACP,KAAK;IACL,KAAK;IACL,KAAK;IACL,OAAO;IACP,MAAM;IACN,KAAK;IACL,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,OAAO;IACP,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,MAAM;IACN,KAAK;IACL,GAAG;IACH,IAAI;IACJ,KAAK;IACL,KAAK;IACL,MAAM;IACN,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,KAAK;IACL,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,OAAO;IACP,OAAO;IACP,IAAI;IACJ,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,OAAO;IACP,OAAO;IACP,SAAS;IACT,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;CACN,CAAC,CAAA"}

package/dist/src/security/scanner/SecurityScanner.scanners.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.scanners.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.scanners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAqB,MAAM,YAAY,CAAA;AAYpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAM/D,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,eAAe,EAChB,MAAM,0BAA0B,CAAA;AAuBjC,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAoDnB;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CA4CnB;AAED,sEAAsE;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AACtE,iEAAiE;AACjE,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,CAAA"}
+{"version":3,"file":"SecurityScanner.scanners.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.scanners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAqB,MAAM,YAAY,CAAA;AAcpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAM/D,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,eAAe,EAChB,MAAM,0BAA0B,CAAA;AA4BjC,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CA2EnB;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CA4CnB;AAED,sEAAsE;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AACtE,iEAAiE;AACjE,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,CAAA"}

package/dist/src/security/scanner/SecurityScanner.scanners.js

@@ -10,10 +10,15 @@
  * them out is behaviour-preserving (guarded by the scoring + regression-guard
  * + ai-defence test suites).
  */
-import { SENSITIVE_PATH_PATTERNS, ENV_PATH_PATTERN, VALUE_GATED_KEYWORD_PATTERNS, SOCIAL_ENGINEERING_PATTERNS, PROMPT_LEAKING_PATTERNS, DATA_EXFILTRATION_PATTERNS, PRIVILEGE_ESCALATION_PATTERNS, CREDENTIAL_SUBSTITUTION_PATTERNS, } from './patterns.js';
+import { SENSITIVE_PATH_PATTERNS, ENV_PATH_PATTERN, VALUE_GATED_KEYWORD_PATTERNS, PATH_FORM_PATTERNS, VALUE_GATED_ASSIGNMENT_PATTERNS, SOCIAL_ENGINEERING_PATTERNS, PROMPT_LEAKING_PATTERNS, DATA_EXFILTRATION_PATTERNS, PRIVILEGE_ESCALATION_PATTERNS, CREDENTIAL_SUBSTITUTION_PATTERNS, } from './patterns.js';
 import { safeRegexTest, safeRegexCheck } from './regex-utils.js';
 import { analyzeMarkdownContext, isDocumentationContext, isWithinInlineCode, } from './SecurityScanner.helpers.js';
 import { looksLikePlaceholderSecret, shannonEntropy, scanPiiPatterns, } from './SecurityScanner.pii.js';
+// SMI-5207: the two sensitive_path severity gates, each split into its own
+// module for the 500-line gate. MF-3 answers "is this path being acted on?";
+// MF-4 answers "does this assignment carry a real credential?".
+import { hasPathActionContext } from './SecurityScanner.action-context.js';
+import { assignmentHasRealValue } from './SecurityScanner.value-gate.js';
 /**
  * SMI-5359 Wave 4 (MF-2): a `.env` reference is an active read/exfiltration only when
  * it co-occurs with a read/copy/transfer verb or a shell pipe/redirect on the same line
@@ -53,16 +58,28 @@ export function scanSensitivePaths(content, lineContexts) {
                     continue;
             }
             // MF-2: lone `.env` → MEDIUM; `.env` + read/exfil verb or pipe/redirect → HIGH.
+            // MF-3 (SMI-5207): a path-form match → HIGH only with an action verb or shell
+            // operator within +/-1 line; a bare path MENTION is the common case, so evidence
+            // is required to escalate.
+            // MF-4 (SMI-5207): an assignment-form match → HIGH by DEFAULT (a `keyword: value`
+            // credential shape is rare in innocent prose), downgraded only on positive prose
+            // evidence about the assigned value.
             // Doc-context keeps the existing MEDIUM downgrade for every pattern.
             let severity;
             if (inDocContext) {
-                severity = 'medium';
+                severity = 'medium'; // unchanged
             }
             else if (pattern === ENV_PATH_PATTERN) {
-                severity = safeRegexCheck(ENV_EXFIL_CONTEXT, line) ? 'high' : 'medium';
+                severity = safeRegexCheck(ENV_EXFIL_CONTEXT, line) ? 'high' : 'medium'; // MF-2, unchanged
+            }
+            else if (PATH_FORM_PATTERNS.has(pattern)) {
+                severity = hasPathActionContext(lines, index) ? 'high' : 'medium'; // MF-3
+            }
+            else if (VALUE_GATED_ASSIGNMENT_PATTERNS.has(pattern)) {
+                severity = assignmentHasRealValue(lines, index) ? 'high' : 'medium'; // MF-4
             }
             else {
-                severity = 'high';
+                severity = 'high'; // MF-1 survivors and any future unclassified pattern — fail CLOSED
             }
             const confidence = inDocContext
                 ? 'low'
@@ -72,7 +89,20 @@ export function scanSensitivePaths(content, lineContexts) {
             findings.push({
                 type: 'sensitive_path',
                 severity,
-                message: `Reference to potentially sensitive path: ${pattern.source}`,
+                // SMI-5207: the matched TEXT is prepended additively — `pattern.source` is
+                // deliberately retained, not swapped out, because allowlist entries'
+                // `messagePattern` values match on that regex-source substring.
+                // Governance review L-5: `match?.[0] ?? ''` is kept (a plain `match[0]`
+                // fails `tsc` — TS cannot correlate the separate `safeRegexCheck`/
+                // `safeRegexTest` calls the way it narrows a local `if (match)` block, the
+                // pattern this file's OTHER scanners use). Behaviorally the `?? ''`
+                // fallback is unreachable: `safeRegexCheck` (.test()) already gated the
+                // loop above on this same pattern/line pair, and for a non-`g` pattern
+                // .test() and .match() can never disagree on the same input. If it ever
+                // WAS reached, it would silently diverge from the edge twins (which emit
+                // no finding at all rather than one with an empty quoted span) — a gap the
+                // twin-parity test can't catch, since it compares files, not behavior.
+                message: `Reference to potentially sensitive path: "${match?.[0]?.slice(0, 60) ?? ''}" (${pattern.source})`,
                 location: line.trim().slice(0, 100),
                 lineNumber: index + 1,
                 inDocumentationContext: inDocContext,

package/dist/src/security/scanner/SecurityScanner.scanners.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.scanners.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.scanners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEhE,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,eAAe,GAChB,MAAM,0BAA0B,CAAA;AAEjC;;;;;;GAMG;AACH,MAAM,iBAAiB,GACrB,8HAA8H,CAAA;AAEhI;;;;;;;;GAQG;AACH,MAAM,qBAAqB,GAAG,+DAA+D,CAAA;AAE7F,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC;gBAAE,SAAQ;YAC5C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC,CAAA;YACrF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;YAE9E,+EAA+E;YAC/E,kFAAkF;YAClF,6EAA6E;YAC7E,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9C,MAAM,MAAM,GAAG,aAAa,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAA;gBACzD,IAAI,CAAC,MAAM,IAAI,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAAE,SAAQ;YAChE,CAAC;YAED,gFAAgF;YAChF,qEAAqE;YACrE,IAAI,QAAqC,CAAA;YACzC,IAAI,YAAY,EAAE,CAAC;gBACjB,QAAQ,GAAG,QAAQ,CAAA;YACrB,CAAC;iBAAM,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;gBACxC,QAAQ,GAAG,cAAc,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA;YACxE,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,MAAM,CAAA;YACnB,CAAC;YACD,MAAM,UAAU,GAAsB,YAAY;gBAChD,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,QAAQ,KAAK,MAAM;oBACnB,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,QAAQ,CAAA;YAEd,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,QAAQ;gBACR,OAAO,EAAE,4CAA4C,OAAO,CAAC,MAAM,EAAE;gBACrE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;gBACrB,sBAAsB,EAAE,YAAY;gBACpC,UAAU;aACX,CAAC,CAAA;YACF,MAAK;QACP,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,2BAA2B,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;gBAEjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,oBAAoB;oBAC1B,QAAQ;oBACR,OAAO,EAAE,yCAAyC,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC7D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,oBAAoB;oBAC9B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;gBAEnD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,gBAAgB;oBACtB,QAAQ;oBACR,OAAO,EAAE,qCAAqC,KAAK,CAAC,CAAC,CAAC,GAAG;oBACzD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,gBAAgB;oBAC1B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,0BAA0B,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;gBAEjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,mBAAmB;oBACzB,QAAQ;oBACR,OAAO,EAAE,yCAAyC,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC7D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,mBAAmB;oBAC7B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,6BAA6B,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,0EAA0E;gBAC1E,yEAAyE;gBACzE,sEAAsE;gBACtE,oEAAoE;gBACpE,uEAAuE;gBACvE,yEAAyE;gBACzE,wEAAwE;gBACxE,MAAM,wBAAwB,GAAG,gCAAgC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;gBACnF,MAAM,UAAU,GAAsB,wBAAwB;oBAC5D,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,YAAY;wBACZ,CAAC,CAAC,KAAK;wBACP,CAAC,CAAC,MAAM,CAAA;gBACZ,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;gBAEzF,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,sBAAsB;oBAC5B,QAAQ;oBACR,OAAO,EAAE,2CAA2C,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC/D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,sBAAsB;oBAChC,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,sEAAsE;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AACtE,iEAAiE;AACjE,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,CAAA"}
+{"version":3,"file":"SecurityScanner.scanners.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.scanners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,4BAA4B,EAC5B,kBAAkB,EAClB,+BAA+B,EAC/B,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEhE,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,eAAe,GAChB,MAAM,0BAA0B,CAAA;AACjC,2EAA2E;AAC3E,6EAA6E;AAC7E,gEAAgE;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAA;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AAExE;;;;;;GAMG;AACH,MAAM,iBAAiB,GACrB,8HAA8H,CAAA;AAEhI;;;;;;;;GAQG;AACH,MAAM,qBAAqB,GAAG,+DAA+D,CAAA;AAE7F,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC;gBAAE,SAAQ;YAC5C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC,CAAA;YACrF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;YAE9E,+EAA+E;YAC/E,kFAAkF;YAClF,6EAA6E;YAC7E,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9C,MAAM,MAAM,GAAG,aAAa,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAA;gBACzD,IAAI,CAAC,MAAM,IAAI,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAAE,SAAQ;YAChE,CAAC;YAED,gFAAgF;YAChF,8EAA8E;YAC9E,iFAAiF;YACjF,2BAA2B;YAC3B,kFAAkF;YAClF,iFAAiF;YACjF,qCAAqC;YACrC,qEAAqE;YACrE,IAAI,QAAqC,CAAA;YACzC,IAAI,YAAY,EAAE,CAAC;gBACjB,QAAQ,GAAG,QAAQ,CAAA,CAAC,YAAY;YAClC,CAAC;iBAAM,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;gBACxC,QAAQ,GAAG,cAAc,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA,CAAC,kBAAkB;YAC3F,CAAC;iBAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3C,QAAQ,GAAG,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA,CAAC,OAAO;YAC3E,CAAC;iBAAM,IAAI,+BAA+B,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxD,QAAQ,GAAG,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA,CAAC,OAAO;YAC7E,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,MAAM,CAAA,CAAC,mEAAmE;YACvF,CAAC;YACD,MAAM,UAAU,GAAsB,YAAY;gBAChD,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,QAAQ,KAAK,MAAM;oBACnB,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,QAAQ,CAAA;YAEd,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,QAAQ;gBACR,2EAA2E;gBAC3E,qEAAqE;gBACrE,gEAAgE;gBAChE,wEAAwE;gBACxE,mEAAmE;gBACnE,2EAA2E;gBAC3E,oEAAoE;gBACpE,wEAAwE;gBACxE,uEAAuE;gBACvE,wEAAwE;gBACxE,yEAAyE;gBACzE,2EAA2E;gBAC3E,uEAAuE;gBACvE,OAAO,EAAE,6CAA6C,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG;gBAC3G,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;gBACrB,sBAAsB,EAAE,YAAY;gBACpC,UAAU;aACX,CAAC,CAAA;YACF,MAAK;QACP,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,2BAA2B,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;gBAEjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,oBAAoB;oBAC1B,QAAQ;oBACR,OAAO,EAAE,yCAAyC,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC7D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,oBAAoB;oBAC9B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;gBAEnD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,gBAAgB;oBACtB,QAAQ;oBACR,OAAO,EAAE,qCAAqC,KAAK,CAAC,CAAC,CAAC,GAAG;oBACzD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,gBAAgB;oBAC1B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,0BAA0B,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;gBAEjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,mBAAmB;oBACzB,QAAQ;oBACR,OAAO,EAAE,yCAAyC,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC7D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,mBAAmB;oBAC7B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,6BAA6B,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,0EAA0E;gBAC1E,yEAAyE;gBACzE,sEAAsE;gBACtE,oEAAoE;gBACpE,uEAAuE;gBACvE,yEAAyE;gBACzE,wEAAwE;gBACxE,MAAM,wBAAwB,GAAG,gCAAgC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;gBACnF,MAAM,UAAU,GAAsB,wBAAwB;oBAC5D,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,YAAY;wBACZ,CAAC,CAAC,KAAK;wBACP,CAAC,CAAC,MAAM,CAAA;gBACZ,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;gBAEzF,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,sBAAsB;oBAC5B,QAAQ;oBACR,OAAO,EAAE,2CAA2C,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC/D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,sBAAsB;oBAChC,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,sEAAsE;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AACtE,iEAAiE;AACjE,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,CAAA"}

package/dist/src/security/scanner/SecurityScanner.value-gate.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Security Scanner — MF-4 assignment-value gate (SMI-5207)
+ * @module @skillsmith/core/security/scanner/SecurityScanner.value-gate
+ *
+ * The `sensitive_path` MF-4 gate: given a line that matched one of the three
+ * VALUE_GATED_ASSIGNMENT_PATTERNS, decide whether it assigns a REAL credential
+ * (→ HIGH) or only prose (→ MEDIUM). HIGH is the default; a downgrade requires
+ * positive prose evidence, and since HIGH is the pre-SMI-5207 unconditional
+ * behaviour that default can never regress detection.
+ *
+ * Split out of SecurityScanner.scanners.ts for the 500-line pre-commit gate
+ * once round 8's segmentation logic landed (that file is at 4xx with the MF-3
+ * gate and six per-category scanners already in it). Cohesive unit — every
+ * symbol here serves the single question "is this assignment's value real?".
+ */
+/**
+ * MF-4 value classification, SEGMENTED PER ASSIGNMENT (SMI-5207 adversarial
+ * review, round 8). Each assignment key on the line owns exactly the text
+ * between its own `:`/`=` and the NEXT key (or EOL); the finding stays HIGH if
+ * ANY of those values is a real credential, and downgrades only when EVERY one
+ * of them positively reads as prose.
+ *
+ * The plan's single-whole-line-span shape (`SPAN.exec(line)[1]`) leaks across
+ * assignments in THREE directions on a line carrying two keys. All three are
+ * false-negative REGRESSIONS (unconditionally HIGH pre-SMI-5207) and none is
+ * residual R-3, which is a stopword inside the assignment's OWN value — here
+ * the prose bleeds in from a DIFFERENT assignment entirely:
+ *
+ *   1. LEFT — `SPAN` is unanchored, so it captures from the LEFTMOST key, not
+ *      necessarily the one that produced the finding (scanSensitivePaths emits
+ *      for the first entry matching in ARRAY order, and CREDENTIALS(2)/
+ *      SECRETS(3) precede PASSWORD(8)). `password: this credentials:
+ *      Tr0ub4dor&3` → captured `this credentials: Tr0ub4dor&3` → `this` →
+ *      MEDIUM. This is the reviewer's reported counter-example.
+ *   2. RIGHT — `(\S.*)$` runs to EOL and swallows the next assignment's prose:
+ *      `credentials: Tr0ub4dor&3 password: this` → trailing `this` → MEDIUM.
+ *   3. Anchoring at the finding's own match (the narrow fix) closes 1, not 2,
+ *      and opens a mirror of 1: only ONE finding is emitted per line (the
+ *      scanner loop `break`s), so on `password: Tr0ub4dor&3 credentials: this`
+ *      the emitted finding sits RIGHT of the real credential, which a
+ *      match-anchored scan never sees → MEDIUM.
+ *
+ * Segmenting closes all three. It is also the correct granularity: severity
+ * attaches to the LINE (the finding's `location` is the whole trimmed line), so
+ * a line holding any real credential is HIGH. Monotonicity holds — this returns
+ * true at least as often as the per-span reading, and true is the status quo.
+ */
+export declare function assignmentHasRealValue(lines: string[], index: number): boolean;
+//# sourceMappingURL=SecurityScanner.value-gate.d.ts.map

package/dist/src/security/scanner/SecurityScanner.value-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.value-gate.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.value-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA2DH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CA0B9E"}

package/dist/src/security/scanner/SecurityScanner.value-gate.js

@@ -0,0 +1,134 @@
+/**
+ * Security Scanner — MF-4 assignment-value gate (SMI-5207)
+ * @module @skillsmith/core/security/scanner/SecurityScanner.value-gate
+ *
+ * The `sensitive_path` MF-4 gate: given a line that matched one of the three
+ * VALUE_GATED_ASSIGNMENT_PATTERNS, decide whether it assigns a REAL credential
+ * (→ HIGH) or only prose (→ MEDIUM). HIGH is the default; a downgrade requires
+ * positive prose evidence, and since HIGH is the pre-SMI-5207 unconditional
+ * behaviour that default can never regress detection.
+ *
+ * Split out of SecurityScanner.scanners.ts for the 500-line pre-commit gate
+ * once round 8's segmentation logic landed (that file is at 4xx with the MF-3
+ * gate and six per-category scanners already in it). Cohesive unit — every
+ * symbol here serves the single question "is this assignment's value real?".
+ */
+import { PLACEHOLDER_SECRET_RE } from './SecurityScanner.pii.js';
+import { PROSE_STOPWORDS } from './SecurityScanner.prose-lexicon.js';
+import { MAX_LINE_LENGTH_FOR_REGEX } from './regex-utils.js';
+/** A value that REFERENCES a secret rather than containing one. */
+const TEMPLATE_REFERENCE = /^\$|^\{\{|\$\{|^%[A-Za-z_]|^<%/;
+/**
+ * Max token count for an all-lowercase span to read as a doc LABEL rather
+ * than a passphrase. 2 dictionary words carry ~26 bits (2 x ~12.9 diceware),
+ * below any credible credential strength; 3 words (~39 bits) is defensibly a
+ * real passphrase. This is the narrowest value that closes `credentials:
+ * rotation policy` (2 words) without also swallowing a genuine 3-word
+ * passphrase — verified at both 2 and 3 against the full fixture set; 2 wins
+ * because it errs toward RETAINING detection on the ambiguous 3-token case.
+ */
+const MAX_LABEL_TOKENS = 2;
+/**
+ * The assignment KEY — the exact union of the three
+ * VALUE_GATED_ASSIGNMENT_PATTERNS it gates, `\b` included (only the secrets
+ * entry carries one), so every line reaching assignmentHasRealValue() through
+ * those patterns is covered. `g` is required by matchAll, which clones the
+ * regex, so there is no shared `lastIndex` state.
+ *
+ * DERIVATION NOTE — the plan's item-3 block sketches CREDENTIAL_ASSIGN_SPAN /
+ * BARE_ASSIGNMENT_EOL, a single-whole-line-span shape. Round 8 confirmed
+ * (two adversarial review rounds, six hand-traced counter-examples) that
+ * shape leaks across assignments in THREE directions on a line carrying two
+ * keys — see assignmentHasRealValue below — so this reconstruction segments
+ * the line by key instead of using one span regex.
+ */
+const ASSIGNMENT_HEAD = /(?:credentials|\bsecrets?|password)\s*[:=]\s*/gi;
+/**
+ * Positive prose evidence. Absence of evidence leaves the finding at HIGH.
+ * PROSE_STOPWORDS lives in SecurityScanner.prose-lexicon.ts — English function
+ * words: a passphrase is nouns, an explanatory sentence is not.
+ */
+function isProseValue(span) {
+    const v = span.replace(/^['"]|['"]$/g, '').trim();
+    if (v.length === 0)
+        return true;
+    if (TEMPLATE_REFERENCE.test(v))
+        return true; // $VAR, ${{ secrets.X }}
+    if (PLACEHOLDER_SECRET_RE.test(v))
+        return true; // <YOUR_PASSWORD>, changeme
+    if (/^(.)\1+$/.test(v))
+        return true; // xxxxxxxx
+    const tokens = v.split(/\s+/);
+    if (tokens.some((t) => PROSE_STOPWORDS.has(t.toLowerCase().replace(/[^a-z']/g, ''))))
+        return true; // sentence
+    if (tokens.length > 12)
+        return true; // long sentence
+    if (tokens.length > 1 &&
+        tokens.length <= MAX_LABEL_TOKENS &&
+        tokens.every((t) => /^[a-z]{1,19}$/.test(t)))
+        return true; // 2-word doc label
+    return false; // DEFAULT: stays HIGH
+}
+/**
+ * MF-4 value classification, SEGMENTED PER ASSIGNMENT (SMI-5207 adversarial
+ * review, round 8). Each assignment key on the line owns exactly the text
+ * between its own `:`/`=` and the NEXT key (or EOL); the finding stays HIGH if
+ * ANY of those values is a real credential, and downgrades only when EVERY one
+ * of them positively reads as prose.
+ *
+ * The plan's single-whole-line-span shape (`SPAN.exec(line)[1]`) leaks across
+ * assignments in THREE directions on a line carrying two keys. All three are
+ * false-negative REGRESSIONS (unconditionally HIGH pre-SMI-5207) and none is
+ * residual R-3, which is a stopword inside the assignment's OWN value — here
+ * the prose bleeds in from a DIFFERENT assignment entirely:
+ *
+ *   1. LEFT — `SPAN` is unanchored, so it captures from the LEFTMOST key, not
+ *      necessarily the one that produced the finding (scanSensitivePaths emits
+ *      for the first entry matching in ARRAY order, and CREDENTIALS(2)/
+ *      SECRETS(3) precede PASSWORD(8)). `password: this credentials:
+ *      Tr0ub4dor&3` → captured `this credentials: Tr0ub4dor&3` → `this` →
+ *      MEDIUM. This is the reviewer's reported counter-example.
+ *   2. RIGHT — `(\S.*)$` runs to EOL and swallows the next assignment's prose:
+ *      `credentials: Tr0ub4dor&3 password: this` → trailing `this` → MEDIUM.
+ *   3. Anchoring at the finding's own match (the narrow fix) closes 1, not 2,
+ *      and opens a mirror of 1: only ONE finding is emitted per line (the
+ *      scanner loop `break`s), so on `password: Tr0ub4dor&3 credentials: this`
+ *      the emitted finding sits RIGHT of the real credential, which a
+ *      match-anchored scan never sees → MEDIUM.
+ *
+ * Segmenting closes all three. It is also the correct granularity: severity
+ * attaches to the LINE (the finding's `location` is the whole trimmed line), so
+ * a line holding any real credential is HIGH. Monotonicity holds — this returns
+ * true at least as often as the per-span reading, and true is the status quo.
+ */
+export function assignmentHasRealValue(lines, index) {
+    // Same ReDoS input cap the safeRegex* helpers apply; matchAll has no
+    // equivalent wrapper, so the truncation is explicit here.
+    const line = lines[index].slice(0, MAX_LINE_LENGTH_FOR_REGEX);
+    const heads = [...line.matchAll(ASSIGNMENT_HEAD)];
+    if (heads.length === 0)
+        return false;
+    let trailingKeyIsBare = false;
+    for (let i = 0; i < heads.length; i++) {
+        const from = (heads[i].index ?? 0) + heads[i][0].length;
+        const to = i + 1 < heads.length ? (heads[i + 1].index ?? line.length) : line.length;
+        const value = line.slice(from, to);
+        if (value.trim().length === 0) {
+            // A key with nothing after it. Only the LAST one can take its value from
+            // the next line (YAML block form).
+            trailingKeyIsBare = i === heads.length - 1;
+            continue;
+        }
+        trailingKeyIsBare = false;
+        if (!isProseValue(value))
+            return true;
+    }
+    if (!trailingKeyIsBare)
+        return false;
+    // `| undefined` annotated (not in the plan's block) so the plan's own
+    // `next !== undefined` guard type-checks — `lines[index + 1]` is `string`
+    // here (no noUncheckedIndexedAccess), making the compare a TS2367 error.
+    const next = lines[index + 1];
+    return next !== undefined && !isProseValue(next.trim());
+}
+//# sourceMappingURL=SecurityScanner.value-gate.js.map

package/dist/src/security/scanner/SecurityScanner.value-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.value-gate.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.value-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAA;AACpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAA;AAE5D,mEAAmE;AACnE,MAAM,kBAAkB,GAAG,gCAAgC,CAAA;AAE3D;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GAAG,CAAC,CAAA;AAE1B;;;;;;;;;;;;;GAaG;AACH,MAAM,eAAe,GAAG,iDAAiD,CAAA;AAEzE;;;;GAIG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACjD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC/B,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,yBAAyB;IACrE,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,4BAA4B;IAC3E,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,WAAW;IAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC7B,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,WAAW;IAC7G,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,IAAI,CAAA,CAAC,gBAAgB;IACpD,IACE,MAAM,CAAC,MAAM,GAAG,CAAC;QACjB,MAAM,CAAC,MAAM,IAAI,gBAAgB;QACjC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE5C,OAAO,IAAI,CAAA,CAAC,mBAAmB;IACjC,OAAO,KAAK,CAAA,CAAC,sBAAsB;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAe,EAAE,KAAa;IACnE,qEAAqE;IACrE,0DAA0D;IAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAA;IAC7D,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAA;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,IAAI,iBAAiB,GAAG,KAAK,CAAA;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QACvD,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;QACnF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAClC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,yEAAyE;YACzE,mCAAmC;YACnC,iBAAiB,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;YAC1C,SAAQ;QACV,CAAC;QACD,iBAAiB,GAAG,KAAK,CAAA;QACzB,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;IACvC,CAAC;IACD,IAAI,CAAC,iBAAiB;QAAE,OAAO,KAAK,CAAA;IACpC,sEAAsE;IACtE,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,IAAI,GAAuB,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IACjD,OAAO,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;AACzD,CAAC"}

package/dist/src/security/scanner/SecurityScanner.weak-passwords.d.ts

@@ -0,0 +1,55 @@
+/**
+ * SMI-6441: generated common-password lexicon for the `sensitive_path`
+ * MF-4b veto (Wave 2). Vetoes MF-4's 2-token documentation-label
+ * carve-out when one of the tokens is a known common password.
+ * @module @skillsmith/core/security/scanner/SecurityScanner.weak-passwords
+ * @generated DO NOT EDIT — produced by scripts/gen-weak-password-lexicon.mjs
+ * from data/wordlists/{seclists-xato-top-10000.txt,doc-vocab-keeplist.txt}.
+ * Regenerate with `npm run lexicon:weak-passwords`; verify freshness with
+ * `npm run lexicon:weak-passwords:check`. A hand edit here is overwritten
+ * on the next --write and is caught by the L3 --check gate before merge.
+ *
+ * SECURITY-RELEVANT DUPLICATION (ADR-137 Decision point 4): this file is
+ * one of three byte-identical-modulo-@module copies of the same
+ * generated payload —
+ *   packages/core/src/security/scanner/SecurityScanner.weak-passwords.ts
+ *   scripts/indexer/_shared/security-scanner-edge.weak-passwords.ts
+ *   supabase/functions/_shared/security-scanner-edge.weak-passwords.ts
+ * A silent divergence between these three is a SECURITY GAP, not a
+ * cosmetic inconsistency: this data decides whether a `sensitive_path`
+ * finding is HIGH or MEDIUM (quarantine vs. pass on the weekly scan
+ * surface; blocked vs. permitted install). Enforced by three parity
+ * layers: L1 Deno<->Node byte identity
+ * (scripts/tests/indexer/security-scanner-edge.test.ts's
+ * PATHS_FAMILY_TWINS), L2 three-way literal payload identity
+ * (scripts/tests/indexer/parity-utils.ts's extractGeneratedPayload),
+ * and L3 freshness/anti-hand-edit (`npm run lexicon:weak-passwords:check`,
+ * wired into scripts/audit-standards.mjs).
+ *
+ * Source: SecLists (MIT license) — see data/wordlists/LICENSE-SecLists
+ * and WEAK_PASSWORD_LEXICON_SOURCE below for exact provenance.
+ *
+ * Full design: docs/internal/implementation/smi-6441-weak-password-veto.md
+ * See also: docs/internal/adr/149-generated-scanner-data-veto-severity-model.md
+ * and docs/internal/adr/137-cross-runtime-duplication-of-security-logic.md
+ */
+/** Provenance of the vendored upstream snapshot this file was generated from. */
+export declare const WEAK_PASSWORD_LEXICON_SOURCE: {
+    readonly upstream: "https://github.com/danielmiessler/SecLists";
+    readonly path: "Passwords/Common-Credentials/xato-net-10-million-passwords-10000.txt";
+    readonly license: "MIT";
+    readonly commit: "c205c36a445bff37f8e58a9ec829105cd4975c58";
+    readonly sha256: "c63d5e4ccc31344d662583cc39ca4bd5bd20517ff1d24501f0c4e0c22d9b722a";
+    readonly sourceRankLimit: 5000;
+    readonly entries: 4079;
+};
+/** Bumped whenever the emitted entry set changes. Deterministic, no timestamp. */
+export declare const WEAK_PASSWORD_LEXICON_VERSION: "2026-09-08.1";
+/**
+ * Lowercase-alphabetic common-password tokens, 3-19 chars, sorted, with the
+ * documentation vocabulary subtracted at generation time. Exact membership
+ * by design (see the ADR): the veto's failure direction is a false positive
+ * on ordinary documentation, so an approximate structure is not acceptable here.
+ */
+export declare const COMMON_WEAK_PASSWORDS: ReadonlySet<string>;
+//# sourceMappingURL=SecurityScanner.weak-passwords.d.ts.map

package/dist/src/security/scanner/SecurityScanner.weak-passwords.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.weak-passwords.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.weak-passwords.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,iFAAiF;AACjF,eAAO,MAAM,4BAA4B;;;;;;;;CAQ/B,CAAA;AAEV,kFAAkF;AAClF,eAAO,MAAM,6BAA6B,EAAG,cAAuB,CAAA;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,CAoQrD,CAAA"}