@skillsmith/core 0.12.2 → 0.12.4

package/dist/src/security/scanner/SecurityScanner.scanners.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.scanners.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.scanners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEhE,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,eAAe,GAChB,MAAM,0BAA0B,CAAA;AAEjC;;;;;;GAMG;AACH,MAAM,iBAAiB,GACrB,8HAA8H,CAAA;AAEhI;;;;;;;;GAQG;AACH,MAAM,qBAAqB,GAAG,+DAA+D,CAAA;AAE7F,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC;gBAAE,SAAQ;YAC5C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC,CAAA;YACrF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;YAE9E,+EAA+E;YAC/E,kFAAkF;YAClF,6EAA6E;YAC7E,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9C,MAAM,MAAM,GAAG,aAAa,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAA;gBACzD,IAAI,CAAC,MAAM,IAAI,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAAE,SAAQ;YAChE,CAAC;YAED,gFAAgF;YAChF,qEAAqE;YACrE,IAAI,QAAqC,CAAA;YACzC,IAAI,YAAY,EAAE,CAAC;gBACjB,QAAQ,GAAG,QAAQ,CAAA;YACrB,CAAC;iBAAM,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;gBACxC,QAAQ,GAAG,cAAc,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA;YACxE,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,MAAM,CAAA;YACnB,CAAC;YACD,MAAM,UAAU,GAAsB,YAAY;gBAChD,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,QAAQ,KAAK,MAAM;oBACnB,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,QAAQ,CAAA;YAEd,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,QAAQ;gBACR,OAAO,EAAE,4CAA4C,OAAO,CAAC,MAAM,EAAE;gBACrE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;gBACrB,sBAAsB,EAAE,YAAY;gBACpC,UAAU;aACX,CAAC,CAAA;YACF,MAAK;QACP,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,2BAA2B,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;gBAEjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,oBAAoB;oBAC1B,QAAQ;oBACR,OAAO,EAAE,yCAAyC,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC7D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,oBAAoB;oBAC9B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;gBAEnD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,gBAAgB;oBACtB,QAAQ;oBACR,OAAO,EAAE,qCAAqC,KAAK,CAAC,CAAC,CAAC,GAAG;oBACzD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,gBAAgB;oBAC1B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,0BAA0B,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;gBAEjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,mBAAmB;oBACzB,QAAQ;oBACR,OAAO,EAAE,yCAAyC,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC7D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,mBAAmB;oBAC7B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,6BAA6B,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,0EAA0E;gBAC1E,yEAAyE;gBACzE,sEAAsE;gBACtE,oEAAoE;gBACpE,uEAAuE;gBACvE,yEAAyE;gBACzE,wEAAwE;gBACxE,MAAM,wBAAwB,GAAG,gCAAgC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;gBACnF,MAAM,UAAU,GAAsB,wBAAwB;oBAC5D,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,YAAY;wBACZ,CAAC,CAAC,KAAK;wBACP,CAAC,CAAC,MAAM,CAAA;gBACZ,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;gBAEzF,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,sBAAsB;oBAC5B,QAAQ;oBACR,OAAO,EAAE,2CAA2C,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC/D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,sBAAsB;oBAChC,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,sEAAsE;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AACtE,iEAAiE;AACjE,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,CAAA"}
+{"version":3,"file":"SecurityScanner.scanners.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.scanners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,4BAA4B,EAC5B,kBAAkB,EAClB,+BAA+B,EAC/B,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEhE,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,eAAe,GAChB,MAAM,0BAA0B,CAAA;AACjC,2EAA2E;AAC3E,6EAA6E;AAC7E,gEAAgE;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAA;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AAExE;;;;;;GAMG;AACH,MAAM,iBAAiB,GACrB,8HAA8H,CAAA;AAEhI;;;;;;;;GAQG;AACH,MAAM,qBAAqB,GAAG,+DAA+D,CAAA;AAE7F,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC;gBAAE,SAAQ;YAC5C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC,CAAA;YACrF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;YAE9E,+EAA+E;YAC/E,kFAAkF;YAClF,6EAA6E;YAC7E,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9C,MAAM,MAAM,GAAG,aAAa,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAA;gBACzD,IAAI,CAAC,MAAM,IAAI,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAAE,SAAQ;YAChE,CAAC;YAED,gFAAgF;YAChF,8EAA8E;YAC9E,iFAAiF;YACjF,2BAA2B;YAC3B,kFAAkF;YAClF,iFAAiF;YACjF,qCAAqC;YACrC,qEAAqE;YACrE,IAAI,QAAqC,CAAA;YACzC,IAAI,YAAY,EAAE,CAAC;gBACjB,QAAQ,GAAG,QAAQ,CAAA,CAAC,YAAY;YAClC,CAAC;iBAAM,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;gBACxC,QAAQ,GAAG,cAAc,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA,CAAC,kBAAkB;YAC3F,CAAC;iBAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3C,QAAQ,GAAG,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA,CAAC,OAAO;YAC3E,CAAC;iBAAM,IAAI,+BAA+B,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxD,QAAQ,GAAG,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA,CAAC,OAAO;YAC7E,CAAC;iBAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrD,sEAAsE;gBACtE,sEAAsE;gBACtE,mEAAmE;gBACnE,sEAAsE;gBACtE,QAAQ,GAAG,QAAQ,CAAA;YACrB,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,MAAM,CAAA,CAAC,mEAAmE;YACvF,CAAC;YACD,MAAM,UAAU,GAAsB,YAAY;gBAChD,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,QAAQ,KAAK,MAAM;oBACnB,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,QAAQ,CAAA;YAEd,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,QAAQ;gBACR,2EAA2E;gBAC3E,qEAAqE;gBACrE,gEAAgE;gBAChE,wEAAwE;gBACxE,mEAAmE;gBACnE,2EAA2E;gBAC3E,oEAAoE;gBACpE,wEAAwE;gBACxE,uEAAuE;gBACvE,wEAAwE;gBACxE,yEAAyE;gBACzE,2EAA2E;gBAC3E,uEAAuE;gBACvE,OAAO,EAAE,6CAA6C,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG;gBAC3G,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;gBACrB,sBAAsB,EAAE,YAAY;gBACpC,UAAU;aACX,CAAC,CAAA;YACF,MAAK;QACP,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,2BAA2B,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;gBAEjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,oBAAoB;oBAC1B,QAAQ;oBACR,OAAO,EAAE,yCAAyC,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC7D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,oBAAoB;oBAC9B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;gBAEnD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,gBAAgB;oBACtB,QAAQ;oBACR,OAAO,EAAE,qCAAqC,KAAK,CAAC,CAAC,CAAC,GAAG;oBACzD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,gBAAgB;oBAC1B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,0BAA0B,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;gBAEjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,mBAAmB;oBACzB,QAAQ;oBACR,OAAO,EAAE,yCAAyC,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC7D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,mBAAmB;oBAC7B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,6BAA6B,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,0EAA0E;gBAC1E,yEAAyE;gBACzE,sEAAsE;gBACtE,oEAAoE;gBACpE,uEAAuE;gBACvE,yEAAyE;gBACzE,wEAAwE;gBACxE,MAAM,wBAAwB,GAAG,gCAAgC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;gBACnF,MAAM,UAAU,GAAsB,wBAAwB;oBAC5D,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,YAAY;wBACZ,CAAC,CAAC,KAAK;wBACP,CAAC,CAAC,MAAM,CAAA;gBACZ,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;gBAEzF,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,sBAAsB;oBAC5B,QAAQ;oBACR,OAAO,EAAE,2CAA2C,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC/D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,sBAAsB;oBAChC,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,sEAAsE;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AACtE,iEAAiE;AACjE,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,CAAA"}

package/dist/src/security/scanner/SecurityScanner.value-gate.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Security Scanner — MF-4 assignment-value gate (SMI-5207)
+ * @module @skillsmith/core/security/scanner/SecurityScanner.value-gate
+ *
+ * The `sensitive_path` MF-4 gate: given a line that matched one of the three
+ * VALUE_GATED_ASSIGNMENT_PATTERNS, decide whether it assigns a REAL credential
+ * (→ HIGH) or only prose (→ MEDIUM). HIGH is the default; a downgrade requires
+ * positive prose evidence, and since HIGH is the pre-SMI-5207 unconditional
+ * behaviour that default could not regress detection.
+ *
+ * SMI-6505 QUALIFIES THAT LAST CLAUSE — it is no longer unconditionally true of
+ * this module. It held while every rule here only recognized prose. The
+ * embedded-key boolean-flag rule below deliberately turns a previously-HIGH
+ * input MEDIUM (`allow_credentials=True`, a FastAPI CORS flag that was blocking
+ * installation of any skill documenting CORS setup). The MF-4b veto's own
+ * invariant is unaffected: that one is a claim about the `weakPasswordVeto`
+ * option, and it still holds — see its block below.
+ *
+ * Split out of SecurityScanner.scanners.ts for the 500-line pre-commit gate
+ * once round 8's segmentation logic landed (that file is at 4xx with the MF-3
+ * gate and six per-category scanners already in it). Cohesive unit — every
+ * symbol here serves the single question "is this assignment's value real?".
+ */
+/**
+ * MF-4 value classification, SEGMENTED PER ASSIGNMENT (SMI-5207 adversarial
+ * review, round 8). Each assignment key on the line owns exactly the text
+ * between its own `:`/`=` and the NEXT key (or EOL); the finding stays HIGH if
+ * ANY of those values is a real credential, and downgrades only when EVERY one
+ * of them positively reads as prose.
+ *
+ * The plan's single-whole-line-span shape (`SPAN.exec(line)[1]`) leaks across
+ * assignments in THREE directions on a line carrying two keys. All three are
+ * false-negative REGRESSIONS (unconditionally HIGH pre-SMI-5207) and none is
+ * residual R-3, which is a stopword inside the assignment's OWN value — here
+ * the prose bleeds in from a DIFFERENT assignment entirely:
+ *
+ *   1. LEFT — `SPAN` is unanchored, so it captures from the LEFTMOST key, not
+ *      necessarily the one that produced the finding (scanSensitivePaths emits
+ *      for the first entry matching in ARRAY order, and CREDENTIALS(2)/
+ *      SECRETS(3) precede PASSWORD(8)). `password: this credentials:
+ *      Tr0ub4dor&3` → captured `this credentials: Tr0ub4dor&3` → `this` →
+ *      MEDIUM. This is the reviewer's reported counter-example.
+ *   2. RIGHT — `(\S.*)$` runs to EOL and swallows the next assignment's prose:
+ *      `credentials: Tr0ub4dor&3 password: this` → trailing `this` → MEDIUM.
+ *   3. Anchoring at the finding's own match (the narrow fix) closes 1, not 2,
+ *      and opens a mirror of 1: only ONE finding is emitted per line (the
+ *      scanner loop `break`s), so on `password: Tr0ub4dor&3 credentials: this`
+ *      the emitted finding sits RIGHT of the real credential, which a
+ *      match-anchored scan never sees → MEDIUM.
+ *
+ * Segmenting closes all three. It is also the correct granularity: severity
+ * attaches to the LINE (the finding's `location` is the whole trimmed line), so
+ * a line holding any real credential is HIGH. Monotonicity holds — this returns
+ * true at least as often as the per-span reading, and true is the status quo.
+ *
+ * SMI-6441 note: "true is the status quo" is still literally correct, but no
+ * longer conveys the blast radius of a single keeplist miss. Under the MF-4b
+ * veto ONE lexicon hit in ANY segment escalates the WHOLE line — so a line
+ * whose first segment is the acceptance criterion's own must-stay-MEDIUM case
+ * goes HIGH anyway if a later segment trips the veto. The next-line path does
+ * the same across a line boundary, letting an indented continuation drive the
+ * severity of an unindented key line. Both follow from the design and neither
+ * loses detection; recorded so a future reader sizes one missing keeplist
+ * entry correctly.
+ */
+export declare function assignmentHasRealValue(lines: string[], index: number, options?: {
+    readonly weakPasswordVeto?: boolean;
+}): boolean;
+//# sourceMappingURL=SecurityScanner.value-gate.d.ts.map

package/dist/src/security/scanner/SecurityScanner.value-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.value-gate.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.value-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AA4KH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EAAE,EACf,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAE,GAChD,OAAO,CAgCT"}

package/dist/src/security/scanner/SecurityScanner.value-gate.js

@@ -0,0 +1,271 @@
+/**
+ * Security Scanner — MF-4 assignment-value gate (SMI-5207)
+ * @module @skillsmith/core/security/scanner/SecurityScanner.value-gate
+ *
+ * The `sensitive_path` MF-4 gate: given a line that matched one of the three
+ * VALUE_GATED_ASSIGNMENT_PATTERNS, decide whether it assigns a REAL credential
+ * (→ HIGH) or only prose (→ MEDIUM). HIGH is the default; a downgrade requires
+ * positive prose evidence, and since HIGH is the pre-SMI-5207 unconditional
+ * behaviour that default could not regress detection.
+ *
+ * SMI-6505 QUALIFIES THAT LAST CLAUSE — it is no longer unconditionally true of
+ * this module. It held while every rule here only recognized prose. The
+ * embedded-key boolean-flag rule below deliberately turns a previously-HIGH
+ * input MEDIUM (`allow_credentials=True`, a FastAPI CORS flag that was blocking
+ * installation of any skill documenting CORS setup). The MF-4b veto's own
+ * invariant is unaffected: that one is a claim about the `weakPasswordVeto`
+ * option, and it still holds — see its block below.
+ *
+ * Split out of SecurityScanner.scanners.ts for the 500-line pre-commit gate
+ * once round 8's segmentation logic landed (that file is at 4xx with the MF-3
+ * gate and six per-category scanners already in it). Cohesive unit — every
+ * symbol here serves the single question "is this assignment's value real?".
+ */
+import { PLACEHOLDER_SECRET_RE } from './SecurityScanner.pii.js';
+import { PROSE_STOPWORDS } from './SecurityScanner.prose-lexicon.js';
+import { COMMON_WEAK_PASSWORDS } from './SecurityScanner.weak-passwords.js';
+import { MAX_LINE_LENGTH_FOR_REGEX } from './regex-utils.js';
+/** A value that REFERENCES a secret rather than containing one. */
+const TEMPLATE_REFERENCE = /^\$|^\{\{|\$\{|^%[A-Za-z_]|^<%/;
+/**
+ * Max token count for an all-lowercase span to read as a doc LABEL rather
+ * than a passphrase. 2 dictionary words carry ~26 bits (2 x ~12.9 diceware),
+ * below any credible credential strength; 3 words (~39 bits) is defensibly a
+ * real passphrase. This is the narrowest value that closes `credentials:
+ * rotation policy` (2 words) without also swallowing a genuine 3-word
+ * passphrase — verified at both 2 and 3 against the full fixture set; 2 wins
+ * because it errs toward RETAINING detection on the ambiguous 3-token case.
+ */
+const MAX_LABEL_TOKENS = 2;
+/**
+ * The assignment KEY — the exact union of the three
+ * VALUE_GATED_ASSIGNMENT_PATTERNS it gates, `\b` included (only the secrets
+ * entry carries one), so every line reaching assignmentHasRealValue() through
+ * those patterns is covered. `g` is required by matchAll, which clones the
+ * regex, so there is no shared `lastIndex` state.
+ *
+ * DERIVATION NOTE — the plan's item-3 block sketches CREDENTIAL_ASSIGN_SPAN /
+ * BARE_ASSIGNMENT_EOL, a single-whole-line-span shape. Round 8 confirmed
+ * (two adversarial review rounds, six hand-traced counter-examples) that
+ * shape leaks across assignments in THREE directions on a line carrying two
+ * keys — see assignmentHasRealValue below — so this reconstruction segments
+ * the line by key instead of using one span regex.
+ */
+const ASSIGNMENT_HEAD = /(?:credentials|\bsecrets?|password)\s*[:=]\s*/gi;
+/**
+ * A whole-span boolean literal, plus trailing delimiters (SMI-6505).
+ *
+ * Anchored at BOTH ends, deliberately. DO NOT relax this. Two obvious
+ * relaxations were each implemented, measured, and rejected: the value span runs
+ * to the next assignment key or EOL, so whatever this regex accepts unexamined
+ * is exactly where a real credential can hide.
+ *
+ *   token-terminated — `^(?:true|false)\s*(?:[,;)\]}]|#|\/\/)`
+ *     would fix  a single-line multi-argument call
+ *     would open `<prefix>_credentials=true, Tr0ub4dor&3` -> MEDIUM
+ *
+ *   trailing-comment branch — `...[\s,;)\]}]*(?:(?:#|\/\/).*)?$`
+ *     would fix  `allow_credentials=True,  # allow cookies`
+ *     would open `<prefix>_credentials=true # Tr0ub4dor&3` -> MEDIUM
+ *
+ * Both bypass shapes are pinned as must-stay-HIGH tests. An embedded key is
+ * trivial to write, so either relaxation is a cheap deliberate bypass rather
+ * than an accidental edge case — which is why the two formatting variants they
+ * would have fixed are accepted residuals instead.
+ */
+const BOOLEAN_FLAG_VALUE = /^(?:true|false)[\s,;)\]}]*$/i;
+/**
+ * Is the matched assignment keyword a SUFFIX of a longer identifier?
+ *
+ * The SMI-6505 discriminator. `allow_credentials=True` reaches this gate at all
+ * only because CREDENTIALS_ASSIGN_PATTERN carries no left boundary; the keyword
+ * being embedded is what marks it as an ordinary identifier rather than a
+ * credential key. Never true of the secrets entry, which has its own `\b`.
+ *
+ * Deliberately NOT fixed by adding `\b` to the pattern instead — that would also
+ * stop matching `AWS_CREDENTIALS=hunter2`, a real credential, trading this false
+ * positive for a false negative. See SMI-6508.
+ */
+function isEmbeddedKey(line, matchStart) {
+    return matchStart > 0 && /[A-Za-z0-9_]/.test(line[matchStart - 1]);
+}
+/**
+ * Positive prose evidence. Absence of evidence leaves the finding at HIGH.
+ * PROSE_STOPWORDS lives in SecurityScanner.prose-lexicon.ts — English function
+ * words: a passphrase is nouns, an explanatory sentence is not.
+ */
+function isProseValue(span, weakPasswordVeto) {
+    const v = span.replace(/^['"]|['"]$/g, '').trim();
+    if (v.length === 0)
+        return true;
+    if (TEMPLATE_REFERENCE.test(v))
+        return true; // $VAR, ${{ secrets.X }}
+    if (PLACEHOLDER_SECRET_RE.test(v))
+        return true; // <YOUR_PASSWORD>, changeme
+    if (/^(.)\1+$/.test(v))
+        return true; // xxxxxxxx
+    const tokens = v.split(/\s+/);
+    if (tokens.some((t) => PROSE_STOPWORDS.has(t.toLowerCase().replace(/[^a-z']/g, ''))))
+        return true; // sentence
+    if (tokens.length > 12)
+        return true; // long sentence
+    /**
+     * SMI-6441 (MF-4b): a 2-token all-lowercase value normally reads as a
+     * documentation label ("rotation policy"). It does NOT when EVERY one of its
+     * tokens is a known common password ("monkey dragon", "qwerty ninja") — that
+     * is a weak credential wearing a label's shape, SMI-5207's residual R-2.
+     *
+     * WHY `every` AND NOT `some` — the load-bearing choice, decided on measured
+     * evidence after three adversarial review rounds. A `some` predicate reopens
+     * the very false-positive class SMI-5207 closed, and does so unboundedly:
+     * 55% of the emitted lexicon (2,229 of 4,012 entries) are ordinary English
+     * dictionary words, so almost any two-word documentation label pairs a
+     * benign noun with a lexicon member. Three independent review passes each
+     * found more leaks (`security policy`, `command reference`, `cloud
+     * provider`, `active profile`, `help center`, `java client`, `mobile app`,
+     * …), and the keeplist that was supposed to prevent this is a hand-curated
+     * denylist-of-a-denylist against a 2,229-word residual — it does not
+     * converge. `every` closes the class STRUCTURALLY instead: a documentation
+     * label essentially never has BOTH of its words in a common-password list.
+     *
+     * WHAT THIS COSTS, STATED PLAINLY: R-2 is now closed only for the
+     * two-common-password case. A value pairing ONE common password with an
+     * ordinary word — the plan's original headline example — stays MEDIUM,
+     * because it is not distinguishable from a documentation label without a
+     * false-positive rate this gate cannot afford. The install gate fails on
+     * `hasHigh` alone with no allowlist anywhere in `skill-installation.*`, so
+     * an FP here blocks a legitimate install and costs a package publish to
+     * undo; a FN leaves a weak credential at MEDIUM, which is exactly where it
+     * sat before this wave. The asymmetry is what decides it.
+     *
+     * SCOPE, DELIBERATELY NARROW: this veto applies ONLY to the exactly-2-token
+     * all-lowercase carve-out below, never to the stopword ("sentence") rule
+     * above it. A top-10k common-password list is saturated with ordinary nouns
+     * (love, money, summer, hello, welcome, computer, football, sunshine) and a
+     * ten-word documentation sentence has a high chance of containing one, so
+     * extending the veto to sentences would reopen exactly the false-positive
+     * class SMI-5207 closed. R-3 (a passphrase containing a function word) is
+     * therefore NOT closed by this wave, by design.
+     *
+     * SAFETY INVARIANT — stated precisely, because the obvious stronger claim is
+     * FALSE. This veto only ever REMOVES a downgrade path; it never adds one. So
+     * for every input, post-6441 severity >= pre-6441 severity, and the set of
+     * inputs reading MEDIUM after this change is a strict SUBSET of the set that
+     * read MEDIUM before it. That is the whole safety argument, and it is enough:
+     * no input that was HIGH becomes MEDIUM, so no detection is lost.
+     *
+     * It is NOT true that "no added token can lower severity". The stopword check
+     * above runs BEFORE this label check and returns early, so:
+     *     password: monkey dragon     -> vetoed  -> HIGH
+     *     password: a monkey dragon   -> stopword -> MEDIUM
+     * A third token that is a PROSE_STOPWORD ('a', 'the', 'an', 'no', 'so',
+     * 'now', 'just', 'only', 'is', ...) short-circuits ahead of this line and
+     * downgrades. This stopword-prepend path is the KNOWN, ACCEPTED BYPASS of
+     * this veto. It is not a new hole opened by SMI-6441 — it is exactly
+     * SMI-5207's residual R-3 (a value containing an English function word
+     * degrades to MEDIUM), which this wave deliberately leaves open (see
+     * Rejected alternative 1: extending the veto to the stopword rule would flip
+     * ordinary documentation sentences to HIGH, reopening the FP class with 10
+     * documented recurrences). Anyone closing R-3 later closes this bypass with
+     * it; until then, do not describe this veto as unpoisonable.
+     *
+     * ONE THING THE R-3 IDENTIFICATION DOES NOT CARRY OVER (SMI-6441
+     * adversarial review round 2). Calling this bypass "exactly R-3" is true
+     * of the MECHANISM, but must not be read as inheriting SMI-5207's whole
+     * acceptance rationale. That plan accepted R-3 partly because its quoted
+     * form is independently covered by PII_PATTERNS. Measured, that backstop
+     * covers only the quoted form: a quoted stopword-prefixed value still
+     * fires a HIGH pii finding, while the UNQUOTED form fires nothing at any
+     * severity — and the unquoted form is the one an author would type. The
+     * mechanism is inherited; its REACHABILITY AS AN EVASION is not. Before
+     * this wave there was nothing to evade here, because a 2-token label was
+     * already MEDIUM. Treat it as an accepted residual with NO backstop.
+     */
+    if (tokens.length > 1 &&
+        tokens.length <= MAX_LABEL_TOKENS &&
+        tokens.every((t) => /^[a-z]{1,19}$/.test(t)) &&
+        (!weakPasswordVeto || !tokens.every((t) => COMMON_WEAK_PASSWORDS.has(t))))
+        return true; // 2-word doc label
+    return false; // DEFAULT: stays HIGH
+}
+/**
+ * MF-4 value classification, SEGMENTED PER ASSIGNMENT (SMI-5207 adversarial
+ * review, round 8). Each assignment key on the line owns exactly the text
+ * between its own `:`/`=` and the NEXT key (or EOL); the finding stays HIGH if
+ * ANY of those values is a real credential, and downgrades only when EVERY one
+ * of them positively reads as prose.
+ *
+ * The plan's single-whole-line-span shape (`SPAN.exec(line)[1]`) leaks across
+ * assignments in THREE directions on a line carrying two keys. All three are
+ * false-negative REGRESSIONS (unconditionally HIGH pre-SMI-5207) and none is
+ * residual R-3, which is a stopword inside the assignment's OWN value — here
+ * the prose bleeds in from a DIFFERENT assignment entirely:
+ *
+ *   1. LEFT — `SPAN` is unanchored, so it captures from the LEFTMOST key, not
+ *      necessarily the one that produced the finding (scanSensitivePaths emits
+ *      for the first entry matching in ARRAY order, and CREDENTIALS(2)/
+ *      SECRETS(3) precede PASSWORD(8)). `password: this credentials:
+ *      Tr0ub4dor&3` → captured `this credentials: Tr0ub4dor&3` → `this` →
+ *      MEDIUM. This is the reviewer's reported counter-example.
+ *   2. RIGHT — `(\S.*)$` runs to EOL and swallows the next assignment's prose:
+ *      `credentials: Tr0ub4dor&3 password: this` → trailing `this` → MEDIUM.
+ *   3. Anchoring at the finding's own match (the narrow fix) closes 1, not 2,
+ *      and opens a mirror of 1: only ONE finding is emitted per line (the
+ *      scanner loop `break`s), so on `password: Tr0ub4dor&3 credentials: this`
+ *      the emitted finding sits RIGHT of the real credential, which a
+ *      match-anchored scan never sees → MEDIUM.
+ *
+ * Segmenting closes all three. It is also the correct granularity: severity
+ * attaches to the LINE (the finding's `location` is the whole trimmed line), so
+ * a line holding any real credential is HIGH. Monotonicity holds — this returns
+ * true at least as often as the per-span reading, and true is the status quo.
+ *
+ * SMI-6441 note: "true is the status quo" is still literally correct, but no
+ * longer conveys the blast radius of a single keeplist miss. Under the MF-4b
+ * veto ONE lexicon hit in ANY segment escalates the WHOLE line — so a line
+ * whose first segment is the acceptance criterion's own must-stay-MEDIUM case
+ * goes HIGH anyway if a later segment trips the veto. The next-line path does
+ * the same across a line boundary, letting an indented continuation drive the
+ * severity of an unindented key line. Both follow from the design and neither
+ * loses detection; recorded so a future reader sizes one missing keeplist
+ * entry correctly.
+ */
+export function assignmentHasRealValue(lines, index, options // default true
+) {
+    const weakPasswordVeto = options?.weakPasswordVeto !== false;
+    // Same ReDoS input cap the safeRegex* helpers apply; matchAll has no
+    // equivalent wrapper, so the truncation is explicit here.
+    const line = lines[index].slice(0, MAX_LINE_LENGTH_FOR_REGEX);
+    const heads = [...line.matchAll(ASSIGNMENT_HEAD)];
+    if (heads.length === 0)
+        return false;
+    let trailingKeyIsBare = false;
+    for (let i = 0; i < heads.length; i++) {
+        const from = (heads[i].index ?? 0) + heads[i][0].length;
+        const to = i + 1 < heads.length ? (heads[i + 1].index ?? line.length) : line.length;
+        const value = line.slice(from, to);
+        if (value.trim().length === 0) {
+            // A key with nothing after it. Only the LAST one can take its value from
+            // the next line (YAML block form).
+            trailingKeyIsBare = i === heads.length - 1;
+            continue;
+        }
+        trailingKeyIsBare = false;
+        // SMI-6505: an EMBEDDED key assigned a bare boolean is a configuration flag,
+        // not a credential. `continue` classifies the segment as prose without
+        // consulting isProseValue(), which sees only the value span and therefore
+        // could not tell this apart from a bare `credentials: True`.
+        if (isEmbeddedKey(line, heads[i].index ?? 0) && BOOLEAN_FLAG_VALUE.test(value.trim()))
+            continue;
+        if (!isProseValue(value, weakPasswordVeto))
+            return true;
+    }
+    if (!trailingKeyIsBare)
+        return false;
+    // `| undefined` annotated (not in the plan's block) so the plan's own
+    // `next !== undefined` guard type-checks — `lines[index + 1]` is `string`
+    // here (no noUncheckedIndexedAccess), making the compare a TS2367 error.
+    const next = lines[index + 1];
+    return next !== undefined && !isProseValue(next.trim(), weakPasswordVeto);
+}
+//# sourceMappingURL=SecurityScanner.value-gate.js.map

package/dist/src/security/scanner/SecurityScanner.value-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.value-gate.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.value-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAA;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAA;AAC3E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAA;AAE5D,mEAAmE;AACnE,MAAM,kBAAkB,GAAG,gCAAgC,CAAA;AAE3D;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GAAG,CAAC,CAAA;AAE1B;;;;;;;;;;;;;GAaG;AACH,MAAM,eAAe,GAAG,iDAAiD,CAAA;AAEzE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,kBAAkB,GAAG,8BAA8B,CAAA;AAEzD;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CAAC,IAAY,EAAE,UAAkB;IACrD,OAAO,UAAU,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAA;AACpE,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,IAAY,EAAE,gBAAyB;IAC3D,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACjD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC/B,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,yBAAyB;IACrE,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,4BAA4B;IAC3E,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,WAAW;IAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC7B,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,WAAW;IAC7G,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,IAAI,CAAA,CAAC,gBAAgB;IACpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuEG;IACH,IACE,MAAM,CAAC,MAAM,GAAG,CAAC;QACjB,MAAM,CAAC,MAAM,IAAI,gBAAgB;QACjC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC,CAAC,gBAAgB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEzE,OAAO,IAAI,CAAA,CAAC,mBAAmB;IACjC,OAAO,KAAK,CAAA,CAAC,sBAAsB;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAe,EACf,KAAa,EACb,OAAiD,CAAC,eAAe;;IAEjE,MAAM,gBAAgB,GAAG,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAA;IAC5D,qEAAqE;IACrE,0DAA0D;IAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAA;IAC7D,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAA;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,IAAI,iBAAiB,GAAG,KAAK,CAAA;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QACvD,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;QACnF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAClC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,yEAAyE;YACzE,mCAAmC;YACnC,iBAAiB,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;YAC1C,SAAQ;QACV,CAAC;QACD,iBAAiB,GAAG,KAAK,CAAA;QACzB,6EAA6E;QAC7E,uEAAuE;QACvE,0EAA0E;QAC1E,6DAA6D;QAC7D,IAAI,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAAE,SAAQ;QAC/F,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,gBAAgB,CAAC;YAAE,OAAO,IAAI,CAAA;IACzD,CAAC;IACD,IAAI,CAAC,iBAAiB;QAAE,OAAO,KAAK,CAAA;IACpC,sEAAsE;IACtE,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,IAAI,GAAuB,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IACjD,OAAO,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAA;AAC3E,CAAC"}

package/dist/src/security/scanner/SecurityScanner.weak-passwords.d.ts

@@ -0,0 +1,55 @@
+/**
+ * SMI-6441: generated common-password lexicon for the `sensitive_path`
+ * MF-4b veto (Wave 2). Vetoes MF-4's 2-token documentation-label
+ * carve-out when one of the tokens is a known common password.
+ * @module @skillsmith/core/security/scanner/SecurityScanner.weak-passwords
+ * @generated DO NOT EDIT — produced by scripts/gen-weak-password-lexicon.mjs
+ * from data/wordlists/{seclists-xato-top-10000.txt,doc-vocab-keeplist.txt}.
+ * Regenerate with `npm run lexicon:weak-passwords`; verify freshness with
+ * `npm run lexicon:weak-passwords:check`. A hand edit here is overwritten
+ * on the next --write and is caught by the L3 --check gate before merge.
+ *
+ * SECURITY-RELEVANT DUPLICATION (ADR-137 Decision point 4): this file is
+ * one of three byte-identical-modulo-@module copies of the same
+ * generated payload —
+ *   packages/core/src/security/scanner/SecurityScanner.weak-passwords.ts
+ *   scripts/indexer/_shared/security-scanner-edge.weak-passwords.ts
+ *   supabase/functions/_shared/security-scanner-edge.weak-passwords.ts
+ * A silent divergence between these three is a SECURITY GAP, not a
+ * cosmetic inconsistency: this data decides whether a `sensitive_path`
+ * finding is HIGH or MEDIUM (quarantine vs. pass on the weekly scan
+ * surface; blocked vs. permitted install). Enforced by three parity
+ * layers: L1 Deno<->Node byte identity
+ * (scripts/tests/indexer/security-scanner-edge.test.ts's
+ * PATHS_FAMILY_TWINS), L2 three-way literal payload identity
+ * (scripts/tests/indexer/parity-utils.ts's extractGeneratedPayload),
+ * and L3 freshness/anti-hand-edit (`npm run lexicon:weak-passwords:check`,
+ * wired into scripts/audit-standards.mjs).
+ *
+ * Source: SecLists (MIT license) — see data/wordlists/LICENSE-SecLists
+ * and WEAK_PASSWORD_LEXICON_SOURCE below for exact provenance.
+ *
+ * Full design: docs/internal/implementation/smi-6441-weak-password-veto.md
+ * See also: docs/internal/adr/149-generated-scanner-data-veto-severity-model.md
+ * and docs/internal/adr/137-cross-runtime-duplication-of-security-logic.md
+ */
+/** Provenance of the vendored upstream snapshot this file was generated from. */
+export declare const WEAK_PASSWORD_LEXICON_SOURCE: {
+    readonly upstream: "https://github.com/danielmiessler/SecLists";
+    readonly path: "Passwords/Common-Credentials/xato-net-10-million-passwords-10000.txt";
+    readonly license: "MIT";
+    readonly commit: "c205c36a445bff37f8e58a9ec829105cd4975c58";
+    readonly sha256: "c63d5e4ccc31344d662583cc39ca4bd5bd20517ff1d24501f0c4e0c22d9b722a";
+    readonly sourceRankLimit: 5000;
+    readonly entries: 4009;
+};
+/** Bumped whenever the emitted entry set changes. Deterministic, no timestamp. */
+export declare const WEAK_PASSWORD_LEXICON_VERSION: "2026-09-09.2";
+/**
+ * Lowercase-alphabetic common-password tokens, 3-19 chars, sorted, with the
+ * documentation vocabulary subtracted at generation time. Exact membership
+ * by design (see the ADR): the veto's failure direction is a false positive
+ * on ordinary documentation, so an approximate structure is not acceptable here.
+ */
+export declare const COMMON_WEAK_PASSWORDS: ReadonlySet<string>;
+//# sourceMappingURL=SecurityScanner.weak-passwords.d.ts.map

package/dist/src/security/scanner/SecurityScanner.weak-passwords.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.weak-passwords.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.weak-passwords.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,iFAAiF;AACjF,eAAO,MAAM,4BAA4B;;;;;;;;CAQ/B,CAAA;AAEV,kFAAkF;AAClF,eAAO,MAAM,6BAA6B,EAAG,cAAuB,CAAA;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,CA+PrD,CAAA"}