@skillsmith/core 0.12.2 → 0.12.4

package/dist/src/security/scanner/SecurityScanner.js

@@ -37,6 +37,14 @@ import { toMinimalRefs, toSARIF, toGitHubAnnotations, toSummary, } from './Secur
 export { analyzeMarkdownContext, isDocumentationContext, isWithinInlineCode, calculateRiskScore, extractUrls, };
 export { scanSsrfPatterns };
 export { toMinimalRefs, toSARIF, toGitHubAnnotations, toSummary };
+/**
+ * SMI-5879 (design §5): quickCheck is a fast pre-filter, not the full scan —
+ * a bare mention-tier match (a documentation page discussing "jailbreak" or
+ * "DAN") should not by itself fail the quick path. Derived ONCE at module
+ * load, not hand-maintained, so it can never silently drift from
+ * JAILBREAK_PATTERNS' own evidence-tier classification.
+ */
+export const DIRECTIVE_JAILBREAK_PATTERNS = JAILBREAK_PATTERNS.filter((p) => classifyEvidence(p) !== 'mention');
 export class SecurityScanner {
     allowedDomains;
     blockedPatterns;
@@ -161,8 +169,20 @@ export class SecurityScanner {
      * text contains. This disables ONLY the encoded-payload detector on the
      * inner call, not the rest of the suite — a decoded `curl|bash` still
      * trips `code_execution`, decoded secrets still trip `sensitive_path`, etc.
+     *
+     * SMI-5879: `EncodedPayloadRescanner`'s contract is a bare
+     * `SecurityFinding[]` return (SecurityScanner.encoding.ts, out of scope for
+     * this change), so a recursive `runDetectors` call for decoded content has
+     * no return channel of its own to report multiline truncation.
+     * `truncationRef` is a shared mutable out-param instead: every call (outer
+     * and any recursive rescan) ORs its own jailbreak/AI-defence truncation
+     * into it, so truncation anywhere in the recursion is visible to the
+     * original (outermost) caller. Per `ScanReport.multilineTruncated`'s own
+     * doc: being truncated is only ever used to RAISE caution, never to lower
+     * it, so over-reporting here (e.g. attributing an inner rescan's
+     * truncation to the whole document) is safe by that same design.
      */
-    runDetectors(content, lineContexts, skipEncodedPayload, isHighTrustAuthor = false, isMarkdown = true) {
+    runDetectors(content, lineContexts, skipEncodedPayload, isHighTrustAuthor = false, isMarkdown = true, truncationRef) {
         const findings = [];
         // SMI-5881: the multiline (full-content) regex pass has its OWN, much
         // smaller cap than maxContentLength — a ReDoS budget input, not a free
@@ -174,7 +194,8 @@ export class SecurityScanner {
         const effectiveMultilineLimit = Math.min(MAX_CONTENT_LENGTH_FOR_REGEX, this.maxContentLength);
         findings.push(...this.scanUrls(content));
         findings.push(...scanSensitivePaths(content, lineContexts));
-        findings.push(...this.scanJailbreakPatterns(content, lineContexts, effectiveMultilineLimit));
+        const jailbreakResult = this.scanJailbreakPatterns(content, lineContexts, effectiveMultilineLimit);
+        findings.push(...jailbreakResult.findings);
         findings.push(...this.scanSuspiciousPatterns(content, lineContexts));
         findings.push(...scanSocialEngineering(content, lineContexts));
         findings.push(...scanPromptLeaking(content, lineContexts));
@@ -210,7 +231,12 @@ export class SecurityScanner {
         // run before escalateCodeExecution below since a later dispatch wires
         // this finding type into that co-signal mechanism.
         findings.push(...scanDecoyMisdirection(content, lineContexts));
-        findings.push(...this.scanAIDefenceVulnerabilities(content, lineContexts, effectiveMultilineLimit));
+        const aiDefenceResult = this.scanAIDefenceVulnerabilities(content, lineContexts, effectiveMultilineLimit);
+        findings.push(...aiDefenceResult.findings);
+        if (truncationRef) {
+            truncationRef.truncated =
+                truncationRef.truncated || jailbreakResult.truncated || aiDefenceResult.truncated;
+        }
         findings.push(...scanSsrfPatterns(content, lineContexts, effectiveMultilineLimit));
         findings.push(...scanPiiPatterns(content, lineContexts));
         findings.push(...scanCodeExecution(content, lineContexts));
@@ -236,7 +262,7 @@ export class SecurityScanner {
         // (inner) call to this same method — so no finding is ever run through
         // escalateCodeExecution/escalateCorroboratedMentions twice.
         if (!skipEncodedPayload) {
-            findings.push(...scanEncodedPayload(content, lineContexts, (decodedContent) => this.runDetectors(decodedContent, analyzeMarkdownContext(decodedContent, isMarkdown), true, isHighTrustAuthor, isMarkdown)));
+            findings.push(...scanEncodedPayload(content, lineContexts, (decodedContent) => this.runDetectors(decodedContent, analyzeMarkdownContext(decodedContent, isMarkdown), true, isHighTrustAuthor, isMarkdown, truncationRef)));
         }
         return findings;
     }
@@ -282,7 +308,8 @@ export class SecurityScanner {
                     `${this.maxContentLength} code units)`,
             });
         }
-        findings.push(...this.runDetectors(content, lineContexts, false, isHighTrustAuthor, isMarkdown));
+        const truncationRef = { truncated: false };
+        findings.push(...this.runDetectors(content, lineContexts, false, isHighTrustAuthor, isMarkdown, truncationRef));
         const endTime = performance.now();
         const { total: riskScore, breakdown: riskBreakdown } = calculateRiskScore(findings);
         const hasCritical = findings.some((f) => f.severity === 'critical');
@@ -296,10 +323,16 @@ export class SecurityScanner {
             scanDurationMs: endTime - startTime,
             riskScore,
             riskBreakdown,
+            multilineTruncated: truncationRef.truncated,
         };
     }
+    /**
+     * SMI-5879 (design §5): tests only the directive-tier derived subset (a
+     * bare mention like "jailbreak" or "DAN" alone should not fail the quick
+     * path — see DIRECTIVE_JAILBREAK_PATTERNS above).
+     */
     quickCheck(content) {
-        for (const pattern of JAILBREAK_PATTERNS) {
+        for (const pattern of DIRECTIVE_JAILBREAK_PATTERNS) {
             if (safeRegexCheck(pattern, content))
                 return false;
         }

package/dist/src/security/scanner/SecurityScanner.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAA;AAI9F,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,gCAAgC,GACjC,MAAM,8BAA8B,CAAA;AACrC,+EAA+E;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AACvD,gFAAgF;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AAEpE,sBAAsB;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAE5D,+EAA+E;AAC/E,sEAAsE;AACtE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,eAAe,GAChB,MAAM,+BAA+B,CAAA;AAEtC,qEAAqE;AACrE,6DAA6D;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AACpE,+DAA+D;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AACjE,qFAAqF;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AACpE,sFAAsF;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAClE,oEAAoE;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAElE,8EAA8E;AAC9E,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,2BAA2B,CAAA;AAElC,wEAAwE;AACxE,iCAAiC;AACjC,OAAO,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAA;AAE9F,iEAAiE;AACjE,OAAO,EACL,aAAa,EACb,OAAO,EACP,mBAAmB,EACnB,SAAS,GACV,MAAM,iCAAiC,CAAA;AAExC,kDAAkD;AAClD,OAAO,EAEL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,GACZ,CAAA;AACD,OAAO,EAAE,gBAAgB,EAAE,CAAA;AAC3B,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAA;AAEjE,MAAM,OAAO,eAAe;IAClB,cAAc,CAAa;IAC3B,eAAe,CAAU;IACzB,gBAAgB,CAAQ;IACxB,aAAa,CAAQ;IAE7B,YAAY,UAA0B,EAAE;QACtC,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,uBAAuB,CAAC,CAAA;QAChF,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAA;QACpD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,SAAS,CAAA,CAAC,MAAM;QACpE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;IAClD,CAAC;IAEO,eAAe,CAAC,GAAW;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;YAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;YAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CACzC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC,CACnE,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,OAAe;QAC9B,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;QAEjC,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,KAAK;oBACX,QAAQ,EAAE,QAAQ;oBAClB,OAAO,EAAE,kCAAkC,GAAG,EAAE;oBAChD,QAAQ,EAAE,GAAG;oBACb,UAAU,EAAE,IAAI;iBACjB,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC;IAEO,qBAAqB,CAC3B,OAAe,EACf,YAAuC,EACvC,kBAA0B;QAE1B,OAAO,gCAAgC,CACrC,OAAO,EACP;YACE,IAAI,EAAE,WAAW;YACjB,aAAa,EAAE,sCAAsC;YACrD,QAAQ,EAAE,kBAAkB;YAC5B,QAAQ,EAAE,gBAAgB;SAC3B,EACD,YAAY,EACZ,kBAAkB,CACnB,CAAA;IACH,CAAC;IAEO,sBAAsB,CAAC,OAAe,EAAE,YAA4B;QAC1E,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;QAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;YAE3B,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;gBAC1C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAC1C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;oBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;oBAC9E,oEAAoE;oBACpE,sEAAsE;oBACtE,2EAA2E;oBAC3E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;oBACnE,MAAM,QAAQ,GAAgC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAA;oBAE7E,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,oBAAoB;wBAC1B,QAAQ;wBACR,OAAO,EAAE,iCAAiC,KAAK,CAAC,CAAC,CAAC,GAAG;wBACrD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;wBACrB,QAAQ,EAAE,oBAAoB;wBAC9B,sBAAsB,EAAE,YAAY;wBACpC,UAAU;qBACX,CAAC,CAAA;oBACF,MAAK;gBACP,CAAC;YACH,CAAC;YAED,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC3C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAC1C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;oBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;oBAC9E,qEAAqE;oBACrE,gEAAgE;oBAChE,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;oBACnE,MAAM,QAAQ,GAAgC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;oBAE9E,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,oBAAoB;wBAC1B,QAAQ;wBACR,OAAO,EAAE,8BAA8B,KAAK,CAAC,CAAC,CAAC,GAAG;wBAClD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;wBACrB,QAAQ,EAAE,oBAAoB;wBAC9B,sBAAsB,EAAE,YAAY;wBACpC,UAAU;qBACX,CAAC,CAAA;oBACF,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAEO,4BAA4B,CAClC,OAAe,EACf,YAAuC,EACvC,kBAA0B;QAE1B,OAAO,gCAAgC,CACrC,OAAO,EACP;YACE,IAAI,EAAE,YAAY;YAClB,aAAa,EAAE,+BAA+B;YAC9C,QAAQ,EAAE,mBAAmB;YAC7B,QAAQ,EAAE,gBAAgB;SAC3B,EACD,YAAY,EACZ,kBAAkB,CACnB,CAAA;IACH,CAAC;IAED,0EAA0E;IAC1E,kBAAkB,GAAG,kBAAkB,CAAA;IAEvC;;;;;;;;;;;;;;;OAeG;IACK,YAAY,CAClB,OAAe,EACf,YAA2B,EAC3B,kBAA2B,EAC3B,iBAAiB,GAAG,KAAK,EACzB,UAAU,GAAG,IAAI;QAEjB,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,qEAAqE;QACrE,sEAAsE;QACtE,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,uBAAuB,GAAG,IAAI,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAE7F,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;QACxC,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,YAAY,EAAE,uBAAuB,CAAC,CAAC,CAAA;QAC5F,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC9D,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC1D,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC7D,QAAQ,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAChE,uEAAuE;QACvE,2EAA2E;QAC3E,sEAAsE;QACtE,4EAA4E;QAC5E,6CAA6C;QAC7C,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,QAAQ;aACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,sBAAsB,IAAI,CAAC,CAAC,UAAU,CAAC;aAChE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAoB,CAAC,CACtC,CAAA;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,OAAO,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,CAAA;QAC7E,0EAA0E;QAC1E,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAA;QAChF,gEAAgE;QAChE,oEAAoE;QACpE,oEAAoE;QACpE,mBAAmB;QACnB,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC3D,wEAAwE;QACxE,sEAAsE;QACtE,kEAAkE;QAClE,oEAAoE;QACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC3D,qEAAqE;QACrE,kEAAkE;QAClE,uEAAuE;QACvE,sEAAsE;QACtE,mDAAmD;QACnD,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC9D,QAAQ,CAAC,IAAI,CACX,GAAG,IAAI,CAAC,4BAA4B,CAAC,OAAO,EAAE,YAAY,EAAE,uBAAuB,CAAC,CACrF,CAAA;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,uBAAuB,CAAC,CAAC,CAAA;QAClF,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QACxD,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC1D,QAAQ,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAA;QAElD,iFAAiF;QACjF,gFAAgF;QAChF,2DAA2D;QAC3D,qBAAqB,CAAC,QAAQ,CAAC,CAAA;QAE/B,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,8DAA8D;QAC9D,gEAAgE;QAChE,qEAAqE;QACrE,gEAAgE;QAChE,sEAAsE;QACtE,8CAA8C;QAC9C,4BAA4B,CAAC,QAAQ,CAAC,CAAA;QAEtC,0EAA0E;QAC1E,kEAAkE;QAClE,yEAAyE;QACzE,uEAAuE;QACvE,4DAA4D;QAC5D,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CACX,GAAG,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,cAAc,EAAE,EAAE,CAC9D,IAAI,CAAC,YAAY,CACf,cAAc,EACd,sBAAsB,CAAC,cAAc,EAAE,UAAU,CAAC,EAClD,IAAI,EACJ,iBAAiB,EACjB,UAAU,CACX,CACF,CACF,CAAA;QACH,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,CAAC,OAAe,EAAE,OAAe,EAAE,iBAAiB,GAAG,KAAK,EAAE,UAAU,GAAG,IAAI;QACjF,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QACnC,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,YAAY,GAAG,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAEhE,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,mCAAmC,IAAI,CAAC,gBAAgB,cAAc;aAChF,CAAC,CAAA;QACJ,CAAC;QAED,wEAAwE;QACxE,sDAAsD;QACtD,MAAM,uBAAuB,GAAG,IAAI,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC7F,IAAI,OAAO,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,KAAK;gBACf,OAAO,EACL,qCAAqC,uBAAuB,cAAc;oBAC1E,eAAe,OAAO,CAAC,MAAM,8CAA8C;oBAC3E,GAAG,IAAI,CAAC,gBAAgB,cAAc;aACzC,CAAC,CAAA;QACJ,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAA;QAEhG,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QAEnF,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAA;QAC3D,MAAM,gBAAgB,GAAG,SAAS,IAAI,IAAI,CAAC,aAAa,CAAA;QAExD,OAAO;YACL,OAAO;YACP,MAAM,EAAE,CAAC,WAAW,IAAI,CAAC,OAAO,IAAI,CAAC,gBAAgB;YACrD,QAAQ;YACR,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,cAAc,EAAE,OAAO,GAAG,SAAS;YACnC,SAAS;YACT,aAAa;SACd,CAAA;IACH,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;YACzC,IAAI,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAA;QACpD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gBAAgB,CAAC,MAAc;QAC7B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;IAC/C,CAAC;IAED,iBAAiB,CAAC,OAAe;QAC/B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACpC,CAAC;IAED,oEAAoE;IACpE,MAAM,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,MAAM,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,MAAM,CAAC,mBAAmB,GAAG,mBAAmB,CAAA;IAChD,MAAM,CAAC,SAAS,GAAG,SAAS,CAAA;;AAG9B,eAAe,eAAe,CAAA"}
+{"version":3,"file":"SecurityScanner.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAA;AAI9F,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,gCAAgC,GACjC,MAAM,8BAA8B,CAAA;AACrC,+EAA+E;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AACvD,gFAAgF;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AAEpE,sBAAsB;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAE5D,+EAA+E;AAC/E,sEAAsE;AACtE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,eAAe,GAChB,MAAM,+BAA+B,CAAA;AAEtC,qEAAqE;AACrE,6DAA6D;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AACpE,+DAA+D;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AACjE,qFAAqF;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AACpE,sFAAsF;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAClE,oEAAoE;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAElE,8EAA8E;AAC9E,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,2BAA2B,CAAA;AAElC,wEAAwE;AACxE,iCAAiC;AACjC,OAAO,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAA;AAE9F,iEAAiE;AACjE,OAAO,EACL,aAAa,EACb,OAAO,EACP,mBAAmB,EACnB,SAAS,GACV,MAAM,iCAAiC,CAAA;AAExC,kDAAkD;AAClD,OAAO,EAEL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,GACZ,CAAA;AACD,OAAO,EAAE,gBAAgB,EAAE,CAAA;AAC3B,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAA;AAEjE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAsB,kBAAkB,CAAC,MAAM,CACtF,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,SAAS,CACzC,CAAA;AAED,MAAM,OAAO,eAAe;IAClB,cAAc,CAAa;IAC3B,eAAe,CAAU;IACzB,gBAAgB,CAAQ;IACxB,aAAa,CAAQ;IAE7B,YAAY,UAA0B,EAAE;QACtC,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,uBAAuB,CAAC,CAAA;QAChF,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAA;QACpD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,SAAS,CAAA,CAAC,MAAM;QACpE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;IAClD,CAAC;IAEO,eAAe,CAAC,GAAW;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;YAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;YAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CACzC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC,CACnE,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,OAAe;QAC9B,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;QAEjC,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,KAAK;oBACX,QAAQ,EAAE,QAAQ;oBAClB,OAAO,EAAE,kCAAkC,GAAG,EAAE;oBAChD,QAAQ,EAAE,GAAG;oBACb,UAAU,EAAE,IAAI;iBACjB,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC;IAEO,qBAAqB,CAC3B,OAAe,EACf,YAAuC,EACvC,kBAA0B;QAE1B,OAAO,gCAAgC,CACrC,OAAO,EACP;YACE,IAAI,EAAE,WAAW;YACjB,aAAa,EAAE,sCAAsC;YACrD,QAAQ,EAAE,kBAAkB;YAC5B,QAAQ,EAAE,gBAAgB;SAC3B,EACD,YAAY,EACZ,kBAAkB,CACnB,CAAA;IACH,CAAC;IAEO,sBAAsB,CAAC,OAAe,EAAE,YAA4B;QAC1E,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;QAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;YAE3B,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;gBAC1C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAC1C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;oBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;oBAC9E,oEAAoE;oBACpE,sEAAsE;oBACtE,2EAA2E;oBAC3E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;oBACnE,MAAM,QAAQ,GAAgC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAA;oBAE7E,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,oBAAoB;wBAC1B,QAAQ;wBACR,OAAO,EAAE,iCAAiC,KAAK,CAAC,CAAC,CAAC,GAAG;wBACrD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;wBACrB,QAAQ,EAAE,oBAAoB;wBAC9B,sBAAsB,EAAE,YAAY;wBACpC,UAAU;qBACX,CAAC,CAAA;oBACF,MAAK;gBACP,CAAC;YACH,CAAC;YAED,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC3C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAC1C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;oBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;oBAC9E,qEAAqE;oBACrE,gEAAgE;oBAChE,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;oBACnE,MAAM,QAAQ,GAAgC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;oBAE9E,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,oBAAoB;wBAC1B,QAAQ;wBACR,OAAO,EAAE,8BAA8B,KAAK,CAAC,CAAC,CAAC,GAAG;wBAClD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;wBACrB,QAAQ,EAAE,oBAAoB;wBAC9B,sBAAsB,EAAE,YAAY;wBACpC,UAAU;qBACX,CAAC,CAAA;oBACF,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAEO,4BAA4B,CAClC,OAAe,EACf,YAAuC,EACvC,kBAA0B;QAE1B,OAAO,gCAAgC,CACrC,OAAO,EACP;YACE,IAAI,EAAE,YAAY;YAClB,aAAa,EAAE,+BAA+B;YAC9C,QAAQ,EAAE,mBAAmB;YAC7B,QAAQ,EAAE,gBAAgB;SAC3B,EACD,YAAY,EACZ,kBAAkB,CACnB,CAAA;IACH,CAAC;IAED,0EAA0E;IAC1E,kBAAkB,GAAG,kBAAkB,CAAA;IAEvC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACK,YAAY,CAClB,OAAe,EACf,YAA2B,EAC3B,kBAA2B,EAC3B,iBAAiB,GAAG,KAAK,EACzB,UAAU,GAAG,IAAI,EACjB,aAAsC;QAEtC,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,qEAAqE;QACrE,sEAAsE;QACtE,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,uBAAuB,GAAG,IAAI,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAE7F,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;QACxC,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC3D,MAAM,eAAe,GAAwB,IAAI,CAAC,qBAAqB,CACrE,OAAO,EACP,YAAY,EACZ,uBAAuB,CACxB,CAAA;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;QAC1C,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC9D,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC1D,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC7D,QAAQ,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAChE,uEAAuE;QACvE,2EAA2E;QAC3E,sEAAsE;QACtE,4EAA4E;QAC5E,6CAA6C;QAC7C,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,QAAQ;aACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,sBAAsB,IAAI,CAAC,CAAC,UAAU,CAAC;aAChE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAoB,CAAC,CACtC,CAAA;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,OAAO,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,CAAA;QAC7E,0EAA0E;QAC1E,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAA;QAChF,gEAAgE;QAChE,oEAAoE;QACpE,oEAAoE;QACpE,mBAAmB;QACnB,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC3D,wEAAwE;QACxE,sEAAsE;QACtE,kEAAkE;QAClE,oEAAoE;QACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC3D,qEAAqE;QACrE,kEAAkE;QAClE,uEAAuE;QACvE,sEAAsE;QACtE,mDAAmD;QACnD,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC9D,MAAM,eAAe,GAAwB,IAAI,CAAC,4BAA4B,CAC5E,OAAO,EACP,YAAY,EACZ,uBAAuB,CACxB,CAAA;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;QAC1C,IAAI,aAAa,EAAE,CAAC;YAClB,aAAa,CAAC,SAAS;gBACrB,aAAa,CAAC,SAAS,IAAI,eAAe,CAAC,SAAS,IAAI,eAAe,CAAC,SAAS,CAAA;QACrF,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,uBAAuB,CAAC,CAAC,CAAA;QAClF,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QACxD,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC1D,QAAQ,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAA;QAElD,iFAAiF;QACjF,gFAAgF;QAChF,2DAA2D;QAC3D,qBAAqB,CAAC,QAAQ,CAAC,CAAA;QAE/B,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,8DAA8D;QAC9D,gEAAgE;QAChE,qEAAqE;QACrE,gEAAgE;QAChE,sEAAsE;QACtE,8CAA8C;QAC9C,4BAA4B,CAAC,QAAQ,CAAC,CAAA;QAEtC,0EAA0E;QAC1E,kEAAkE;QAClE,yEAAyE;QACzE,uEAAuE;QACvE,4DAA4D;QAC5D,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CACX,GAAG,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,cAAc,EAAE,EAAE,CAC9D,IAAI,CAAC,YAAY,CACf,cAAc,EACd,sBAAsB,CAAC,cAAc,EAAE,UAAU,CAAC,EAClD,IAAI,EACJ,iBAAiB,EACjB,UAAU,EACV,aAAa,CACd,CACF,CACF,CAAA;QACH,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,CAAC,OAAe,EAAE,OAAe,EAAE,iBAAiB,GAAG,KAAK,EAAE,UAAU,GAAG,IAAI;QACjF,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QACnC,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,YAAY,GAAG,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAEhE,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,mCAAmC,IAAI,CAAC,gBAAgB,cAAc;aAChF,CAAC,CAAA;QACJ,CAAC;QAED,wEAAwE;QACxE,sDAAsD;QACtD,MAAM,uBAAuB,GAAG,IAAI,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC7F,IAAI,OAAO,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,KAAK;gBACf,OAAO,EACL,qCAAqC,uBAAuB,cAAc;oBAC1E,eAAe,OAAO,CAAC,MAAM,8CAA8C;oBAC3E,GAAG,IAAI,CAAC,gBAAgB,cAAc;aACzC,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;QAC1C,QAAQ,CAAC,IAAI,CACX,GAAG,IAAI,CAAC,YAAY,CAClB,OAAO,EACP,YAAY,EACZ,KAAK,EACL,iBAAiB,EACjB,UAAU,EACV,aAAa,CACd,CACF,CAAA;QAED,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QAEnF,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAA;QAC3D,MAAM,gBAAgB,GAAG,SAAS,IAAI,IAAI,CAAC,aAAa,CAAA;QAExD,OAAO;YACL,OAAO;YACP,MAAM,EAAE,CAAC,WAAW,IAAI,CAAC,OAAO,IAAI,CAAC,gBAAgB;YACrD,QAAQ;YACR,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,cAAc,EAAE,OAAO,GAAG,SAAS;YACnC,SAAS;YACT,aAAa;YACb,kBAAkB,EAAE,aAAa,CAAC,SAAS;SAC5C,CAAA;IACH,CAAC;IAED;;;;OAIG;IACH,UAAU,CAAC,OAAe;QACxB,KAAK,MAAM,OAAO,IAAI,4BAA4B,EAAE,CAAC;YACnD,IAAI,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAA;QACpD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gBAAgB,CAAC,MAAc;QAC7B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;IAC/C,CAAC;IAED,iBAAiB,CAAC,OAAe;QAC/B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACpC,CAAC;IAED,oEAAoE;IACpE,MAAM,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,MAAM,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,MAAM,CAAC,mBAAmB,GAAG,mBAAmB,CAAA;IAChD,MAAM,CAAC,SAAS,GAAG,SAAS,CAAA;;AAG9B,eAAe,eAAe,CAAA"}

package/dist/src/security/scanner/SecurityScanner.pii.d.ts

@@ -8,6 +8,36 @@
  */
 import type { SecurityFinding } from './types.js';
 import type { LineContext } from './SecurityScanner.helpers.js';
+/**
+ * SMI-5420: named-placeholder markers that indicate an example, not a real
+ * secret. Intentionally NO `X{4,}` rule — it would test the raw match string and
+ * short-circuit before the entropy check, downgrading a REAL high-entropy secret
+ * that coincidentally contains `xxxx` (governance FN). An all-repeated-char value
+ * (e.g. `xxxx…`) is caught by the `/^(.)\1+$/` check in looksLikePlaceholderSecret
+ * instead, and partial-repeat low-variety values by the entropy floor.
+ *
+ * SMI-5423: the SHORT markers (FAKE/DUMMY/SAMPLE/YOUR, ≤6 chars) are guarded with
+ * a negative lookbehind `(?<![A-Za-z0-9])` so they only match as a delimited token
+ * (`FAKE_KEY`, `<FAKE>`, value-start) — NOT mid-random-string (`k7FAKE1abc`), which
+ * is the same raw-match short-circuit FN class as the removed `X{4,}`. Longer
+ * markers (EXAMPLE/PLACEHOLDER/CHANGEME/REDACTED, 7+ chars) stay unbounded: their
+ * coincidence probability is negligible AND `AKIA…7EXAMPLE` needs EXAMPLE to match
+ * mid-token.
+ *
+ * Accepted tradeoff (SMI-5423 governance): a digit-immediately-prefixed token like
+ * `1FAKE_KEY` fails the lookbehind and scores critical rather than low. This is the
+ * FP-SAFE direction (over-flag a rare contrived placeholder) — strictly preferable
+ * in a security scanner to the FN it replaces (a real secret downgraded); and a
+ * longer such value falls under the entropy floor anyway.
+ *
+ * SMI-5207: exported (additively — `looksLikePlaceholderSecret` below is
+ * unchanged, and MF-1 / scanPiiPatterns keep sharing it byte-identically) so
+ * MF-4's isProseValue() can reuse the same placeholder vocabulary when
+ * deciding whether an assigned credential value references a secret rather
+ * than containing one. No `g` flag, so `.test()` is stateless and safe to
+ * share across call sites.
+ */
+export declare const PLACEHOLDER_SECRET_RE: RegExp;
 /** SMI-5420: Shannon entropy (bits per character) of a string. */
 export declare function shannonEntropy(s: string): number;
 /**

package/dist/src/security/scanner/SecurityScanner.pii.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.pii.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.pii.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAqB,MAAM,YAAY,CAAA;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAmD/D,kEAAkE;AAClE,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAUhD;AAaD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMjE;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CAgFhG"}
+{"version":3,"file":"SecurityScanner.pii.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.pii.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAqB,MAAM,YAAY,CAAA;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAiB/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,qBAAqB,QACmI,CAAA;AAWrK,kEAAkE;AAClE,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAUhD;AAaD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMjE;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CAgFhG"}

package/dist/src/security/scanner/SecurityScanner.pii.js

@@ -37,8 +37,15 @@ const CREDENTIAL_PII_INDICES = new Set([0, 1, 2, 3, 4, 5, 6, 10]);
  * FP-SAFE direction (over-flag a rare contrived placeholder) — strictly preferable
  * in a security scanner to the FN it replaces (a real secret downgraded); and a
  * longer such value falls under the entropy floor anyway.
+ *
+ * SMI-5207: exported (additively — `looksLikePlaceholderSecret` below is
+ * unchanged, and MF-1 / scanPiiPatterns keep sharing it byte-identically) so
+ * MF-4's isProseValue() can reuse the same placeholder vocabulary when
+ * deciding whether an assigned credential value references a secret rather
+ * than containing one. No `g` flag, so `.test()` is stateless and safe to
+ * share across call sites.
  */
-const PLACEHOLDER_SECRET_RE = /EXAMPLE|(?<![A-Za-z0-9])YOUR[_-]?|PLACEHOLDER|CHANGE[_-]?ME|(?<![A-Za-z0-9])DUMMY|(?<![A-Za-z0-9])FAKE|(?<![A-Za-z0-9])SAMPLE|REDACTED|INSERT[_-]|\.\.\.|<[^>]+>/i;
+export const PLACEHOLDER_SECRET_RE = /EXAMPLE|(?<![A-Za-z0-9])YOUR[_-]?|PLACEHOLDER|CHANGE[_-]?ME|(?<![A-Za-z0-9])DUMMY|(?<![A-Za-z0-9])FAKE|(?<![A-Za-z0-9])SAMPLE|REDACTED|INSERT[_-]|\.\.\.|<[^>]+>/i;
 /**
  * SMI-5420: minimum Shannon entropy (bits/char) for a value to read as a real secret.
  * SMI-5424 PR2 (accepted tradeoff): a hardcoded credential value shorter than ~8 chars

package/dist/src/security/scanner/SecurityScanner.pii.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.pii.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.pii.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAE5C;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;AAEjE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,qBAAqB,GACzB,mKAAmK,CAAA;AAErK;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEhC,kEAAkE;AAClE,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAA;IAChB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAA;IACtC,KAAK,MAAM,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACzD,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;QACtB,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvB,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK;SACT,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;SAC7B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,IAAI,EAAE,CAAA;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAClD,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACvC,OAAO,cAAc,CAAC,KAAK,CAAC,GAAG,oBAAoB,CAAA;AACrD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,YAA4B;IAC3E,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAChE,IAAI,cAAc,GAAG,CAAC,CAAC,CAAA;IACvB,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;gBAC9B,cAAc,GAAG,CAAC,CAAA;gBAClB,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,iBAAiB,GAAG,CAAC,CAAA;IAC3B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC3B,MAAM,aAAa,GAAG,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,cAAc,CAAA;QACzD,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,CAAC,CAAA;YAChC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,cAAc,GAAG,EAAE,KAAK,iBAAiB,CAAA;gBAC/C,uEAAuE;gBACvE,oDAAoD;gBACpD,uEAAuE;gBACvE,qEAAqE;gBACrE,sEAAsE;gBACtE,8DAA8D;gBAC9D,qEAAqE;gBACrE,+DAA+D;gBAC/D,0CAA0C;gBAC1C,yDAAyD;gBACzD,4CAA4C;gBAC5C,EAAE;gBACF,mEAAmE;gBACnE,oEAAoE;gBACpE,gEAAgE;gBAChE,6DAA6D;gBAC7D,+DAA+D;gBAC/D,oEAAoE;gBACpE,+DAA+D;gBAC/D,+DAA+D;gBAC/D,8DAA8D;gBAC9D,6DAA6D;gBAC7D,MAAM,YAAY,GAChB,iHAAiH,CAAC,IAAI,CACpH,IAAI,CACL,CAAA;gBACH,MAAM,kBAAkB,GAAG,cAAc,IAAI,CAAC,aAAa,IAAI,YAAY,CAAC,CAAA;gBAC5E,IAAI,QAAgD,CAAA;gBACpD,IAAI,kBAAkB;oBAAE,QAAQ,GAAG,KAAK,CAAA;qBACnC,IAAI,YAAY;oBAAE,QAAQ,GAAG,QAAQ,CAAA;qBACrC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;oBAAE,QAAQ,GAAG,UAAU,CAAA;;oBAC9C,QAAQ,GAAG,MAAM,CAAA;gBACtB,IAAI,UAAU,GAAsB,YAAY,IAAI,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACvF,yEAAyE;gBACzE,mEAAmE;gBACnE,wEAAwE;gBACxE,yEAAyE;gBACzE,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3E,QAAQ,GAAG,KAAK,CAAA;oBAChB,UAAU,GAAG,KAAK,CAAA;gBACpB,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,KAAK;oBACX,QAAQ;oBACR,OAAO,EAAE,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;oBACrF,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,KAAK;oBACf,sBAAsB,EAAE,YAAY,IAAI,kBAAkB;oBAC1D,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IACF,OAAO,QAAQ,CAAA;AACjB,CAAC"}
+{"version":3,"file":"SecurityScanner.pii.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.pii.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAE5C;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAChC,mKAAmK,CAAA;AAErK;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEhC,kEAAkE;AAClE,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAA;IAChB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAA;IACtC,KAAK,MAAM,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACzD,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;QACtB,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvB,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK;SACT,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;SAC7B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,IAAI,EAAE,CAAA;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAClD,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACvC,OAAO,cAAc,CAAC,KAAK,CAAC,GAAG,oBAAoB,CAAA;AACrD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,YAA4B;IAC3E,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAChE,IAAI,cAAc,GAAG,CAAC,CAAC,CAAA;IACvB,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;gBAC9B,cAAc,GAAG,CAAC,CAAA;gBAClB,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,iBAAiB,GAAG,CAAC,CAAA;IAC3B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC3B,MAAM,aAAa,GAAG,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,cAAc,CAAA;QACzD,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,CAAC,CAAA;YAChC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,cAAc,GAAG,EAAE,KAAK,iBAAiB,CAAA;gBAC/C,uEAAuE;gBACvE,oDAAoD;gBACpD,uEAAuE;gBACvE,qEAAqE;gBACrE,sEAAsE;gBACtE,8DAA8D;gBAC9D,qEAAqE;gBACrE,+DAA+D;gBAC/D,0CAA0C;gBAC1C,yDAAyD;gBACzD,4CAA4C;gBAC5C,EAAE;gBACF,mEAAmE;gBACnE,oEAAoE;gBACpE,gEAAgE;gBAChE,6DAA6D;gBAC7D,+DAA+D;gBAC/D,oEAAoE;gBACpE,+DAA+D;gBAC/D,+DAA+D;gBAC/D,8DAA8D;gBAC9D,6DAA6D;gBAC7D,MAAM,YAAY,GAChB,iHAAiH,CAAC,IAAI,CACpH,IAAI,CACL,CAAA;gBACH,MAAM,kBAAkB,GAAG,cAAc,IAAI,CAAC,aAAa,IAAI,YAAY,CAAC,CAAA;gBAC5E,IAAI,QAAgD,CAAA;gBACpD,IAAI,kBAAkB;oBAAE,QAAQ,GAAG,KAAK,CAAA;qBACnC,IAAI,YAAY;oBAAE,QAAQ,GAAG,QAAQ,CAAA;qBACrC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;oBAAE,QAAQ,GAAG,UAAU,CAAA;;oBAC9C,QAAQ,GAAG,MAAM,CAAA;gBACtB,IAAI,UAAU,GAAsB,YAAY,IAAI,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACvF,yEAAyE;gBACzE,mEAAmE;gBACnE,wEAAwE;gBACxE,yEAAyE;gBACzE,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3E,QAAQ,GAAG,KAAK,CAAA;oBAChB,UAAU,GAAG,KAAK,CAAA;gBACpB,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,KAAK;oBACX,QAAQ;oBACR,OAAO,EAAE,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;oBACrF,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,KAAK;oBACf,sBAAsB,EAAE,YAAY,IAAI,kBAAkB;oBAC1D,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IACF,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/src/security/scanner/SecurityScanner.prose-lexicon.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Security Scanner — prose lexicons for the SMI-5207 sensitive_path gates
+ * @module @skillsmith/core/security/scanner/SecurityScanner.prose-lexicon
+ *
+ * SMI-5207: NEGATION_TOKENS (MF-3) and PROSE_STOPWORDS (MF-4) split out of
+ * SecurityScanner.scanners.ts purely for the 500-line pre-commit gate — the
+ * two word lists are ~120 lines once Prettier expands them one entry per
+ * line, which would push that file past the limit. No logic lives here; both
+ * gates' behaviour is entirely in SecurityScanner.scanners.ts.
+ *
+ * The two lists have no consumer in common (round 6 deleted MF-3's
+ * blockquote-vs-operator content classification, which was the only thing
+ * that ever made MF-3 read PROSE_STOPWORDS) — they share a file for the line
+ * budget, not because they are one concept. Keep them independently editable.
+ */
+/**
+ * MF-3 (SMI-5207, round 3): negation lookaround. A negated verb is not action
+ * evidence — "This guide downloads no files and explains ~/.ssh/config"
+ * (round-3 counter-example, unquoted prose) must not fire HIGH. The negation
+ * token can appear BEFORE ("never uploads") or AFTER ("downloads no files")
+ * the verb, so the window is bidirectional. Deliberately narrow: same line
+ * only, small window, no general negation engine.
+ */
+export declare const NEGATION_TOKENS: Set<string>;
+/**
+ * MF-3 (SMI-5207, round 10): determiners that force the NOUN reading of a
+ * token which is otherwise spelled like an action verb — "The Downloads
+ * folder", "the uploads dashboard", "your downloads".
+ *
+ * This is a hard grammatical invariant, not a heuristic: an article or
+ * possessive determiner cannot be immediately followed by a finite verb in
+ * English. So it is applied at distance EXACTLY 1 and nowhere else — "This
+ * skill downloads ~/.ssh/id_rsa" keeps firing, because `skill` sits between
+ * the determiner and the verb. Demonstratives (this/these/those) are
+ * deliberately EXCLUDED: "This downloads the key" is a legitimate verb
+ * reading, so they carry real FN risk that the/a/an/possessives do not.
+ */
+export declare const NOUN_DETERMINERS: Set<string>;
+/**
+ * MF-3 (SMI-5207, round 10): verbs and agent nouns that mark a sentence as
+ * DESCRIBING detection rather than instructing an action — "This rule detects
+ * malware that steals ~/.ssh/id_rsa". Used only in combination with
+ * RELATIVE_MARKERS (see hasActionEvidence); neither signal suppresses on its
+ * own, and neither ever suppresses a shell operator.
+ */
+export declare const DETECTION_FRAMING: Set<string>;
+/**
+ * MF-3 (SMI-5207, round 10): relative pronouns. Their presence immediately
+ * before an action verb marks it as the verb of a SUBORDINATE descriptive
+ * clause ("code that exfiltrates X"), never an imperative.
+ */
+export declare const RELATIVE_MARKERS: Set<string>;
+/**
+ * MF-4 (SMI-5207): English function words. A passphrase is nouns; an
+ * explanatory sentence is not. The only signal separating `correct horse
+ * battery staple` from `never paste your password into chat` — both lowercase
+ * multi-word spans.
+ */
+export declare const PROSE_STOPWORDS: Set<string>;
+//# sourceMappingURL=SecurityScanner.prose-lexicon.d.ts.map

package/dist/src/security/scanner/SecurityScanner.prose-lexicon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.prose-lexicon.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.prose-lexicon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,aAe1B,CAAA;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gBAAgB,aAW3B,CAAA;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,aA0C5B,CAAA;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,aAAqD,CAAA;AAElF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,aAoG1B,CAAA"}

package/dist/src/security/scanner/SecurityScanner.prose-lexicon.js

@@ -0,0 +1,228 @@
+/**
+ * Security Scanner — prose lexicons for the SMI-5207 sensitive_path gates
+ * @module @skillsmith/core/security/scanner/SecurityScanner.prose-lexicon
+ *
+ * SMI-5207: NEGATION_TOKENS (MF-3) and PROSE_STOPWORDS (MF-4) split out of
+ * SecurityScanner.scanners.ts purely for the 500-line pre-commit gate — the
+ * two word lists are ~120 lines once Prettier expands them one entry per
+ * line, which would push that file past the limit. No logic lives here; both
+ * gates' behaviour is entirely in SecurityScanner.scanners.ts.
+ *
+ * The two lists have no consumer in common (round 6 deleted MF-3's
+ * blockquote-vs-operator content classification, which was the only thing
+ * that ever made MF-3 read PROSE_STOPWORDS) — they share a file for the line
+ * budget, not because they are one concept. Keep them independently editable.
+ */
+/**
+ * MF-3 (SMI-5207, round 3): negation lookaround. A negated verb is not action
+ * evidence — "This guide downloads no files and explains ~/.ssh/config"
+ * (round-3 counter-example, unquoted prose) must not fire HIGH. The negation
+ * token can appear BEFORE ("never uploads") or AFTER ("downloads no files")
+ * the verb, so the window is bidirectional. Deliberately narrow: same line
+ * only, small window, no general negation engine.
+ */
+export const NEGATION_TOKENS = new Set([
+    'no',
+    'not',
+    'never',
+    'without',
+    'cannot',
+    "can't",
+    "doesn't",
+    "don't",
+    "won't",
+    "didn't",
+    "isn't",
+    "aren't",
+    'nor',
+    'neither',
+]);
+/**
+ * MF-3 (SMI-5207, round 10): determiners that force the NOUN reading of a
+ * token which is otherwise spelled like an action verb — "The Downloads
+ * folder", "the uploads dashboard", "your downloads".
+ *
+ * This is a hard grammatical invariant, not a heuristic: an article or
+ * possessive determiner cannot be immediately followed by a finite verb in
+ * English. So it is applied at distance EXACTLY 1 and nowhere else — "This
+ * skill downloads ~/.ssh/id_rsa" keeps firing, because `skill` sits between
+ * the determiner and the verb. Demonstratives (this/these/those) are
+ * deliberately EXCLUDED: "This downloads the key" is a legitimate verb
+ * reading, so they carry real FN risk that the/a/an/possessives do not.
+ */
+export const NOUN_DETERMINERS = new Set([
+    'the',
+    'a',
+    'an',
+    'my',
+    'your',
+    'our',
+    'their',
+    'its',
+    'his',
+    'her',
+]);
+/**
+ * MF-3 (SMI-5207, round 10): verbs and agent nouns that mark a sentence as
+ * DESCRIBING detection rather than instructing an action — "This rule detects
+ * malware that steals ~/.ssh/id_rsa". Used only in combination with
+ * RELATIVE_MARKERS (see hasActionEvidence); neither signal suppresses on its
+ * own, and neither ever suppresses a shell operator.
+ */
+export const DETECTION_FRAMING = new Set([
+    'detect',
+    'detects',
+    'detecting',
+    'detection',
+    'detector',
+    'detectors',
+    'flag',
+    'flags',
+    'flagging',
+    'flagged',
+    'identify',
+    'identifies',
+    'block',
+    'blocks',
+    'blocking',
+    'prevent',
+    'prevents',
+    'warn',
+    'warns',
+    'describe',
+    'describes',
+    'explain',
+    'explains',
+    'scan',
+    'scans',
+    'scanning',
+    'scanner',
+    'audit',
+    'audits',
+    'monitor',
+    'monitors',
+    'catch',
+    'catches',
+    'guard',
+    'guards',
+    'protect',
+    'protects',
+    'rule',
+    'rules',
+    'linter',
+    'analyzer',
+]);
+/**
+ * MF-3 (SMI-5207, round 10): relative pronouns. Their presence immediately
+ * before an action verb marks it as the verb of a SUBORDINATE descriptive
+ * clause ("code that exfiltrates X"), never an imperative.
+ */
+export const RELATIVE_MARKERS = new Set(['that', 'which', 'who', 'whom', 'whose']);
+/**
+ * MF-4 (SMI-5207): English function words. A passphrase is nouns; an
+ * explanatory sentence is not. The only signal separating `correct horse
+ * battery staple` from `never paste your password into chat` — both lowercase
+ * multi-word spans.
+ */
+export const PROSE_STOPWORDS = new Set([
+    'never',
+    'not',
+    'your',
+    'you',
+    'this',
+    'that',
+    'these',
+    'those',
+    'is',
+    'are',
+    'was',
+    'were',
+    'be',
+    'been',
+    'will',
+    'would',
+    'can',
+    'could',
+    'should',
+    'must',
+    'do',
+    'does',
+    'into',
+    'onto',
+    'from',
+    'with',
+    'without',
+    'by',
+    'for',
+    'of',
+    'to',
+    'in',
+    'on',
+    'at',
+    'as',
+    'and',
+    'or',
+    'but',
+    'if',
+    'when',
+    'where',
+    'how',
+    'why',
+    'use',
+    'using',
+    'used',
+    'see',
+    'via',
+    'per',
+    'they',
+    'them',
+    'their',
+    'it',
+    'its',
+    'we',
+    'our',
+    'us',
+    'please',
+    'ensure',
+    'make',
+    'sure',
+    'the',
+    'a',
+    'an',
+    'all',
+    'any',
+    'each',
+    'no',
+    'nor',
+    'so',
+    'than',
+    'then',
+    'there',
+    'here',
+    'what',
+    'which',
+    'who',
+    'while',
+    'during',
+    'after',
+    'before',
+    'above',
+    'below',
+    'up',
+    'down',
+    'out',
+    'off',
+    'over',
+    'under',
+    'again',
+    'further',
+    'once',
+    'only',
+    'own',
+    'same',
+    'too',
+    'very',
+    'just',
+    'now',
+]);
+//# sourceMappingURL=SecurityScanner.prose-lexicon.js.map

package/dist/src/security/scanner/SecurityScanner.prose-lexicon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.prose-lexicon.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.prose-lexicon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IACrC,IAAI;IACJ,KAAK;IACL,OAAO;IACP,SAAS;IACT,QAAQ;IACR,OAAO;IACP,SAAS;IACT,OAAO;IACP,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,KAAK;IACL,SAAS;CACV,CAAC,CAAA;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IACtC,KAAK;IACL,GAAG;IACH,IAAI;IACJ,IAAI;IACJ,MAAM;IACN,KAAK;IACL,OAAO;IACP,KAAK;IACL,KAAK;IACL,KAAK;CACN,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACvC,QAAQ;IACR,SAAS;IACT,WAAW;IACX,WAAW;IACX,UAAU;IACV,WAAW;IACX,MAAM;IACN,OAAO;IACP,UAAU;IACV,SAAS;IACT,UAAU;IACV,YAAY;IACZ,OAAO;IACP,QAAQ;IACR,UAAU;IACV,SAAS;IACT,UAAU;IACV,MAAM;IACN,OAAO;IACP,UAAU;IACV,WAAW;IACX,SAAS;IACT,UAAU;IACV,MAAM;IACN,OAAO;IACP,UAAU;IACV,SAAS;IACT,OAAO;IACP,QAAQ;IACR,SAAS;IACT,UAAU;IACV,OAAO;IACP,SAAS;IACT,OAAO;IACP,QAAQ;IACR,SAAS;IACT,UAAU;IACV,MAAM;IACN,OAAO;IACP,QAAQ;IACR,UAAU;CACX,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;AAElF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IACrC,OAAO;IACP,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,IAAI;IACJ,KAAK;IACL,KAAK;IACL,MAAM;IACN,IAAI;IACJ,MAAM;IACN,MAAM;IACN,OAAO;IACP,KAAK;IACL,OAAO;IACP,QAAQ;IACR,MAAM;IACN,IAAI;IACJ,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;IACT,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,MAAM;IACN,OAAO;IACP,KAAK;IACL,KAAK;IACL,KAAK;IACL,OAAO;IACP,MAAM;IACN,KAAK;IACL,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,OAAO;IACP,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,MAAM;IACN,KAAK;IACL,GAAG;IACH,IAAI;IACJ,KAAK;IACL,KAAK;IACL,MAAM;IACN,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,KAAK;IACL,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,OAAO;IACP,OAAO;IACP,IAAI;IACJ,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,OAAO;IACP,OAAO;IACP,SAAS;IACT,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;CACN,CAAC,CAAA"}

package/dist/src/security/scanner/SecurityScanner.scanners.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.scanners.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.scanners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAqB,MAAM,YAAY,CAAA;AAYpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAM/D,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,eAAe,EAChB,MAAM,0BAA0B,CAAA;AAuBjC,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAoDnB;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CA4CnB;AAED,sEAAsE;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AACtE,iEAAiE;AACjE,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,CAAA"}
+{"version":3,"file":"SecurityScanner.scanners.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.scanners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAqB,MAAM,YAAY,CAAA;AAepE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAM/D,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,eAAe,EAChB,MAAM,0BAA0B,CAAA;AA4BjC,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAiFnB;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CA4CnB;AAED,sEAAsE;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AACtE,iEAAiE;AACjE,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,CAAA"}

package/dist/src/security/scanner/SecurityScanner.scanners.js

@@ -10,10 +10,15 @@
  * them out is behaviour-preserving (guarded by the scoring + regression-guard
  * + ai-defence test suites).
  */
-import { SENSITIVE_PATH_PATTERNS, ENV_PATH_PATTERN, VALUE_GATED_KEYWORD_PATTERNS, SOCIAL_ENGINEERING_PATTERNS, PROMPT_LEAKING_PATTERNS, DATA_EXFILTRATION_PATTERNS, PRIVILEGE_ESCALATION_PATTERNS, CREDENTIAL_SUBSTITUTION_PATTERNS, } from './patterns.js';
+import { SENSITIVE_PATH_PATTERNS, ENV_PATH_PATTERN, VALUE_GATED_KEYWORD_PATTERNS, PATH_FORM_PATTERNS, VALUE_GATED_ASSIGNMENT_PATTERNS, OBSERVE_ONLY_MEDIUM_PATTERNS, SOCIAL_ENGINEERING_PATTERNS, PROMPT_LEAKING_PATTERNS, DATA_EXFILTRATION_PATTERNS, PRIVILEGE_ESCALATION_PATTERNS, CREDENTIAL_SUBSTITUTION_PATTERNS, } from './patterns.js';
 import { safeRegexTest, safeRegexCheck } from './regex-utils.js';
 import { analyzeMarkdownContext, isDocumentationContext, isWithinInlineCode, } from './SecurityScanner.helpers.js';
 import { looksLikePlaceholderSecret, shannonEntropy, scanPiiPatterns, } from './SecurityScanner.pii.js';
+// SMI-5207: the two sensitive_path severity gates, each split into its own
+// module for the 500-line gate. MF-3 answers "is this path being acted on?";
+// MF-4 answers "does this assignment carry a real credential?".
+import { hasPathActionContext } from './SecurityScanner.action-context.js';
+import { assignmentHasRealValue } from './SecurityScanner.value-gate.js';
 /**
  * SMI-5359 Wave 4 (MF-2): a `.env` reference is an active read/exfiltration only when
  * it co-occurs with a read/copy/transfer verb or a shell pipe/redirect on the same line
@@ -53,16 +58,35 @@ export function scanSensitivePaths(content, lineContexts) {
                     continue;
             }
             // MF-2: lone `.env` → MEDIUM; `.env` + read/exfil verb or pipe/redirect → HIGH.
+            // MF-3 (SMI-5207): a path-form match → HIGH only with an action verb or shell
+            // operator within +/-1 line; a bare path MENTION is the common case, so evidence
+            // is required to escalate.
+            // MF-4 (SMI-5207): an assignment-form match → HIGH by DEFAULT (a `keyword: value`
+            // credential shape is rare in innocent prose), downgraded only on positive prose
+            // evidence about the assigned value.
             // Doc-context keeps the existing MEDIUM downgrade for every pattern.
             let severity;
             if (inDocContext) {
-                severity = 'medium';
+                severity = 'medium'; // unchanged
             }
             else if (pattern === ENV_PATH_PATTERN) {
-                severity = safeRegexCheck(ENV_EXFIL_CONTEXT, line) ? 'high' : 'medium';
+                severity = safeRegexCheck(ENV_EXFIL_CONTEXT, line) ? 'high' : 'medium'; // MF-2, unchanged
+            }
+            else if (PATH_FORM_PATTERNS.has(pattern)) {
+                severity = hasPathActionContext(lines, index) ? 'high' : 'medium'; // MF-3
+            }
+            else if (VALUE_GATED_ASSIGNMENT_PATTERNS.has(pattern)) {
+                severity = assignmentHasRealValue(lines, index) ? 'high' : 'medium'; // MF-4
+            }
+            else if (OBSERVE_ONLY_MEDIUM_PATTERNS.has(pattern)) {
+                // MF-5 (SMI-6508): always MEDIUM. Detection without an install block,
+                // pending real-world evidence on the FP rate. Deliberately NOT routed
+                // through assignmentHasRealValue — the measured HIGH rate for this
+                // shape was 191/418 lines, ~46% of which looked like false positives.
+                severity = 'medium';
             }
             else {
-                severity = 'high';
+                severity = 'high'; // MF-1 survivors and any future unclassified pattern — fail CLOSED
             }
             const confidence = inDocContext
                 ? 'low'
@@ -72,7 +96,20 @@ export function scanSensitivePaths(content, lineContexts) {
             findings.push({
                 type: 'sensitive_path',
                 severity,
-                message: `Reference to potentially sensitive path: ${pattern.source}`,
+                // SMI-5207: the matched TEXT is prepended additively — `pattern.source` is
+                // deliberately retained, not swapped out, because allowlist entries'
+                // `messagePattern` values match on that regex-source substring.
+                // Governance review L-5: `match?.[0] ?? ''` is kept (a plain `match[0]`
+                // fails `tsc` — TS cannot correlate the separate `safeRegexCheck`/
+                // `safeRegexTest` calls the way it narrows a local `if (match)` block, the
+                // pattern this file's OTHER scanners use). Behaviorally the `?? ''`
+                // fallback is unreachable: `safeRegexCheck` (.test()) already gated the
+                // loop above on this same pattern/line pair, and for a non-`g` pattern
+                // .test() and .match() can never disagree on the same input. If it ever
+                // WAS reached, it would silently diverge from the edge twins (which emit
+                // no finding at all rather than one with an empty quoted span) — a gap the
+                // twin-parity test can't catch, since it compares files, not behavior.
+                message: `Reference to potentially sensitive path: "${match?.[0]?.slice(0, 60) ?? ''}" (${pattern.source})`,
                 location: line.trim().slice(0, 100),
                 lineNumber: index + 1,
                 inDocumentationContext: inDocContext,