@skillsmith/core 0.12.3 → 0.12.4

package/dist/src/install/remove-if-same.js

@@ -0,0 +1,222 @@
+/**
+ * SMI-6529 round 15: remove a path only while it is still the entry the
+ * caller saw (same device and inode). Every delete that follows a check uses
+ * this: fan-out cleanup, staging and backup folders, install rollback and
+ * uninstall.
+ *
+ * Checking the path and then removing it left a window in which another
+ * program could swap in its own entry and have it deleted (Opus round 14).
+ * So the entry is first renamed to a random hidden sibling name, one atomic
+ * rename in the same folder, and checked under that name. Only then is it
+ * removed. To have its entry deleted, a program would have to guess the name.
+ *
+ * A crash, or a failed removal, can leave an entry under that parked name —
+ * and in a race it may be an entry another program put at the path, not ours,
+ * so the warnings say so. Every skill enumerator skips dot-prefixed names, so
+ * a parked entry is never mistaken for a skill; uninstall reports what is
+ * parked next to a skill, and fan-out's `listLeftoverBackups` reports one next
+ * to a fan-out destination.
+ *
+ * @module @skillsmith/core/install/remove-if-same
+ */
+import { randomBytes } from 'node:crypto';
+import * as fsp from 'node:fs/promises';
+import * as path from 'node:path';
+/** Tag in a parked entry's name: `.<name>.skillsmith-removing-<32 hex>`. */
+export const PARK_TAG = '.skillsmith-removing-';
+function errorCode(err) {
+    const code = err?.code;
+    return code ?? (err instanceof Error ? err.message : String(err));
+}
+/**
+ * A random hidden sibling name to park `target` under. 128 random bits, so
+ * the rename that parks an entry cannot realistically land on a name
+ * something else already holds — that rename replaces its destination, and it
+ * is the one step here that runs before any check (round 18, cross-model
+ * review).
+ */
+function parkedName(target) {
+    const name = '.' + path.basename(target) + PARK_TAG + randomBytes(16).toString('hex');
+    return path.join(path.dirname(target), name);
+}
+/** Matches exactly the names {@link removeIfSame} parks `target` under. */
+export function parkedPattern(target) {
+    const escaped = ('.' + path.basename(target) + PARK_TAG).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return new RegExp('^' + escaped + '[0-9a-f]{32}$');
+}
+/**
+ * Entries a crashed or failed removal left parked next to `target`, so a
+ * caller can report them. Round 16 (both reviewers): away from a fan-out
+ * destination nothing swept these, so a failed removal's leftover was named
+ * once, in one error, and never again.
+ */
+export async function listParkedLeftovers(target) {
+    const pattern = parkedPattern(target);
+    const parent = path.dirname(target);
+    let entries;
+    try {
+        entries = await fsp.readdir(parent);
+    }
+    catch (err) {
+        // Round 25 (cross-model review): an empty list here said "nothing is
+        // parked" when the truth was "this folder could not be listed", hiding
+        // the very thing this scan exists to surface.
+        return {
+            parked: [],
+            unreadable: `${parent} could not be listed (${errorCode(err)}), so anything an interrupted removal ` +
+                `left parked beside ${target} is not reported here.`,
+        };
+    }
+    return {
+        parked: entries.filter((name) => pattern.test(name)).map((name) => path.join(parent, name)),
+    };
+}
+/**
+ * User-facing warning for what {@link listParkedLeftovers} found. Round 18
+ * (cross-model review): who owns a parked entry is not known. It is whatever
+ * was at the path when a removal moved it aside, which in a race can belong
+ * to another program, so the wording says that instead of calling it ours.
+ */
+export function parkedLeftoverWarning(parked) {
+    return (`an interrupted removal moved something aside to the hidden path ${parked} and did not ` +
+        `finish. It may be part of the skill being removed, or something another program put ` +
+        `there. Check it, then restore or delete it yourself.`);
+}
+/**
+ * Remove `target` (a folder recursively, anything else with `unlink`) only if
+ * it is still the entry `expected` describes. An entry that is already gone
+ * counts as removed. Anything else is left alone, and whatever this call
+ * moved aside is reported with its exact path.
+ *
+ * Round 17 (cross-model review): nothing is ever renamed back. `rename`
+ * replaces what is at the destination — measured on macOS and Linux, a
+ * directory replaces an empty directory and a file or symlink replaces a file
+ * or symlink — so putting an entry back could destroy something created at
+ * that path in the meantime, and a check first only narrows that window
+ * rather than closing it. The two failure modes are not equal: a put-back can
+ * destroy an entry, while leaving one parked merely moves it, recoverably,
+ * and says where it went. The identity is also checked once BEFORE the entry
+ * is parked, so the ordinary mismatch moves nothing at all.
+ */
+export async function removeIfSame(target, expected) {
+    let before;
+    try {
+        before = await fsp.lstat(target);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return { removed: true };
+        return {
+            removed: false,
+            reason: `could not be checked (${errorCode(err)}), so it was left in place`,
+        };
+    }
+    if (before.dev !== expected.dev || before.ino !== expected.ino) {
+        return { removed: false, reason: 'was replaced by something else, so it was left in place' };
+    }
+    const parked = parkedName(target);
+    try {
+        await fsp.rename(target, parked);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return { removed: true };
+        return {
+            removed: false,
+            reason: `could not be moved aside to be removed (${errorCode(err)}), so it was left in place`,
+        };
+    }
+    let now;
+    let checkError;
+    try {
+        now = await fsp.lstat(parked);
+    }
+    catch (err) {
+        checkError = err;
+    }
+    if (now === undefined) {
+        // Round 21 (Opus): the pre-check above already established this is a
+        // regular file with the expected identity, so it can go back atomically
+        // even though the parked entry itself could not be checked.
+        const why = `could not be checked (${errorCode(checkError)})`;
+        const back = await linkFileBack(parked, target, before);
+        if (back !== 'not-restored') {
+            return {
+                removed: false,
+                reason: back === 'restored'
+                    ? `${why}, so it was left in place`
+                    : `${why}, so it was left in place; a link to it also remains at ${parked}`,
+            };
+        }
+        return { removed: false, reason: `${why} and is now at ${parked}` };
+    }
+    if (now.dev !== expected.dev || now.ino !== expected.ino) {
+        // Something took the path between the check above and this rename, so what
+        // is parked belongs to whoever put it there. A regular file goes back
+        // atomically; anything else is never renamed back over what is at the path
+        // now, so it stays parked and its exact location is reported.
+        const back = await linkFileBack(parked, target, now);
+        if (back !== 'not-restored') {
+            return {
+                removed: false,
+                reason: back === 'restored'
+                    ? 'was replaced by something else, so it was left in place'
+                    : `was replaced by something else, so it was left in place; a link to it also ` +
+                        `remains at ${parked}`,
+            };
+        }
+        return {
+            removed: false,
+            reason: `was replaced by something else, and that entry is now at ${parked}`,
+        };
+    }
+    try {
+        if (now.isDirectory())
+            await fsp.rm(parked, { recursive: true, force: true });
+        else
+            await fsp.unlink(parked);
+        return { removed: true };
+    }
+    catch (err) {
+        const why = `could not be removed (${errorCode(err)})`;
+        const back = await linkFileBack(parked, target, now);
+        if (back !== 'not-restored') {
+            return {
+                removed: false,
+                reason: back === 'restored'
+                    ? `${why}, so it was left in place`
+                    : `${why}, so it was left in place; a link to it also remains at ${parked}`,
+            };
+        }
+        return { removed: false, reason: `${why}; what is left of it is at ${parked}` };
+    }
+}
+/**
+ * Put a parked regular file back where it came from, atomically. Round 19
+ * (Opus): `link` fails with EEXIST rather than replacing, so unlike `rename`
+ * it cannot destroy whatever took the path — which is why files can go back
+ * while directories and symlinks stay parked. (Whether `link` follows a
+ * symlink differs across platforms, so symlinks are not attempted.) Round 20:
+ * says whether the link under the parked name was cleaned up, so a caller
+ * that leaves two links says so rather than reporting a plain restore.
+ */
+async function linkFileBack(parked, target, entry) {
+    if (!entry.isFile())
+        return 'not-restored';
+    try {
+        await fsp.link(parked, target);
+    }
+    catch {
+        return 'not-restored';
+    }
+    try {
+        await fsp.unlink(parked);
+        return 'restored';
+    }
+    catch {
+        // It is back at its path; the extra link under the parked name is named in
+        // the reason and reported like any other leftover.
+        return 'restored-with-link';
+    }
+}
+//# sourceMappingURL=remove-if-same.js.map

package/dist/src/install/remove-if-same.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remove-if-same.js","sourceRoot":"","sources":["../../../src/install/remove-if-same.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,OAAO,KAAK,GAAG,MAAM,kBAAkB,CAAA;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AAEjC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,QAAQ,GAAG,uBAAuB,CAAA;AAc/C,SAAS,SAAS,CAAC,GAAY;IAC7B,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAA;IACjD,OAAO,IAAI,IAAI,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;AACnE,CAAC;AAUD;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,MAAc;IAChC,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACrF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAA;AAC9C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;IAC/F,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,OAAO,GAAG,eAAe,CAAC,CAAA;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAc;IACtD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACnC,IAAI,OAAiB,CAAA;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,qEAAqE;QACrE,uEAAuE;QACvE,8CAA8C;QAC9C,OAAO;YACL,MAAM,EAAE,EAAE;YACV,UAAU,EACR,GAAG,MAAM,yBAAyB,SAAS,CAAC,GAAG,CAAC,wCAAwC;gBACxF,sBAAsB,MAAM,wBAAwB;SACvD,CAAA;IACH,CAAC;IACD,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;KAC5F,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,OAAO,CACL,mEAAmE,MAAM,eAAe;QACxF,sFAAsF;QACtF,sDAAsD,CACvD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,QAAuB;IAEvB,IAAI,MAAa,CAAA;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QAC9E,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,yBAAyB,SAAS,CAAC,GAAG,CAAC,4BAA4B;SAC5E,CAAA;IACH,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yDAAyD,EAAE,CAAA;IAC9F,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QAC9E,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,2CAA2C,SAAS,CAAC,GAAG,CAAC,4BAA4B;SAC9F,CAAA;IACH,CAAC;IACD,IAAI,GAAsB,CAAA;IAC1B,IAAI,UAAmB,CAAA;IACvB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,GAAG,GAAG,CAAA;IAClB,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,qEAAqE;QACrE,wEAAwE;QACxE,4DAA4D;QAC5D,MAAM,GAAG,GAAG,yBAAyB,SAAS,CAAC,UAAU,CAAC,GAAG,CAAA;QAC7D,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QACvD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YAC5B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EACJ,IAAI,KAAK,UAAU;oBACjB,CAAC,CAAC,GAAG,GAAG,2BAA2B;oBACnC,CAAC,CAAC,GAAG,GAAG,2DAA2D,MAAM,EAAE;aAChF,CAAA;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,kBAAkB,MAAM,EAAE,EAAE,CAAA;IACrE,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;QACzD,2EAA2E;QAC3E,sEAAsE;QACtE,2EAA2E;QAC3E,8DAA8D;QAC9D,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;QACpD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YAC5B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EACJ,IAAI,KAAK,UAAU;oBACjB,CAAC,CAAC,yDAAyD;oBAC3D,CAAC,CAAC,6EAA6E;wBAC7E,cAAc,MAAM,EAAE;aAC7B,CAAA;QACH,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4DAA4D,MAAM,EAAE;SAC7E,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,WAAW,EAAE;YAAE,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;;YACxE,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,yBAAyB,SAAS,CAAC,GAAG,CAAC,GAAG,CAAA;QACtD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;QACpD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YAC5B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EACJ,IAAI,KAAK,UAAU;oBACjB,CAAC,CAAC,GAAG,GAAG,2BAA2B;oBACnC,CAAC,CAAC,GAAG,GAAG,2DAA2D,MAAM,EAAE;aAChF,CAAA;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,8BAA8B,MAAM,EAAE,EAAE,CAAA;IACjF,CAAC;AACH,CAAC;AAKD;;;;;;;;GAQG;AACH,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,MAAc,EAAE,KAAY;IACtE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;QAAE,OAAO,cAAc,CAAA;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,cAAc,CAAA;IACvB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACxB,OAAO,UAAU,CAAA;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,mDAAmD;QACnD,OAAO,oBAAoB,CAAA;IAC7B,CAAC;AACH,CAAC"}

package/dist/src/provenance/backfill.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backfill.d.ts","sourceRoot":"","sources":["../../../src/provenance/backfill.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAA;AAEjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAuB,MAAM,YAAY,CAAA;AAEzF,0CAA0C;AAC1C,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,2DAA2D;IAC3D,aAAa,CAAC,EAAE,kBAAkB,CAAA;IAClC,2EAA2E;IAC3E,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,sEAAsE;IACtE,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAA;CAC1C;AAED,iCAAiC;AACjC,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,OAAO,EAAE,kBAAkB,EAAE,CAAA;IAC7B,iDAAiD;IACjD,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,qFAAqF;IACrF,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAkKD;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,cAAc,EACtB,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,eAAe,CAAC,CAmD1B"}
+{"version":3,"file":"backfill.d.ts","sourceRoot":"","sources":["../../../src/provenance/backfill.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAA;AAEjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAuB,MAAM,YAAY,CAAA;AAEzF,0CAA0C;AAC1C,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,2DAA2D;IAC3D,aAAa,CAAC,EAAE,kBAAkB,CAAA;IAClC,2EAA2E;IAC3E,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,sEAAsE;IACtE,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAA;CAC1C;AAED,iCAAiC;AACjC,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,OAAO,EAAE,kBAAkB,EAAE,CAAA;IAC7B,iDAAiD;IACjD,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,qFAAqF;IACrF,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AA8KD;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,cAAc,EACtB,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,eAAe,CAAC,CAmD1B"}

package/dist/src/provenance/backfill.js

@@ -32,9 +32,16 @@ function defaultManifestPath() {
 function nonEmpty(value) {
     return typeof value === 'string' && value.trim().length > 0;
 }
-/** A manifest entry is "healthy" once it carries both a non-empty source and id. */
+/**
+ * A manifest entry is "healthy" once it carries both a non-empty source and
+ * id — OR (SMI-6529) once it carries `provenance: 'local'`, a positive user
+ * assertion ("this is my own skill, not registry-tracked") that must never
+ * be backfilled regardless of how complete its source/id fields are. Routing
+ * it through the same "healthy" gate means the caller's existing
+ * clobber-protection branch skips it, so it never reaches `mergeEntry()`.
+ */
 function isHealthy(entry) {
-    return nonEmpty(entry.source) && nonEmpty(entry.id);
+    return entry.provenance === 'local' || (nonEmpty(entry.source) && nonEmpty(entry.id));
 }
 /**
  * Does a result qualify for backfill? The `minConfidence` floor IS the gate
@@ -114,6 +121,12 @@ async function planResult(result, overrides, minConfidence, now, hash) {
 }
 /** Fill missing fields from `planned` onto an unhealthy `existing` entry. */
 function mergeEntry(existing, planned) {
+    // SMI-6529: defense-in-depth — isHealthy() already routes a
+    // provenance:'local' row to the caller's skip branch before this is ever
+    // reached, but never silently fill/override a local row's fields even if
+    // that gate is somehow bypassed in the future.
+    if (existing.provenance === 'local')
+        return existing;
     return {
         ...existing,
         id: nonEmpty(existing.id) ? existing.id : planned.id,

package/dist/src/provenance/backfill.js.map

@@ -1 +1 @@
-{"version":3,"file":"backfill.js","sourceRoot":"","sources":["../../../src/provenance/backfill.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAA;AAC/B,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAC/D,OAAO,EAAE,WAAW,IAAI,kBAAkB,EAAE,MAAM,2CAA2C,CAAA;AAiC7F,MAAM,eAAe,GAAuC;IAC1D,OAAO,EAAE,CAAC;IACV,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;IACR,gBAAgB,EAAE,CAAC;CACpB,CAAA;AAED,SAAS,mBAAmB;IAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,eAAe,CAAC,CAAA;AAChE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;AAC7D,CAAC;AAED,oFAAoF;AACpF,SAAS,SAAS,CAAC,KAAyB;IAC1C,OAAO,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,SAAS,CAAC,UAA8B,EAAE,aAAiC;IAClF,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAC1C,OAAO,eAAe,CAAC,UAAU,CAAC,IAAI,eAAe,CAAC,aAAa,CAAC,CAAA;AACtE,CAAC;AAED,2CAA2C;AAC3C,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;AAC5C,CAAC;AAYD,gFAAgF;AAChF,KAAK,UAAU,UAAU,CAAC,MAAwB;IAChD,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;IAClF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;IAEtD,IAAI,WAAW,GAAG,GAAG,CAAA;IACrB,IAAI,mBAAuC,CAAA;IAC3C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACvC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAA;QACtC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QACvD,mBAAmB,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;IAED,MAAM,EAAE,GAAG,QAAQ,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC,CAAC,CAAE,UAAqB,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,SAAS,EAAE,CAAA;IAE/F,OAAO;QACL,EAAE;QACF,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,SAAS;QACjB,WAAW;QACX,WAAW;QACX,WAAW,EAAE,GAAG;QAChB,mBAAmB;KACpB,CAAA;AACH,CAAC;AAED,2EAA2E;AAC3E,KAAK,UAAU,UAAU,CACvB,MAA2B,EAC3B,SAAiC,EACjC,aAAiC,EACjC,GAAW,EACX,IAAiC;IAEjC,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAC5C,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;QAC1C,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAA;QAC3B,OAAO,UAAU,CAAC;YAChB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,SAAS,EAAE,sBAAsB,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,IAAI,EAAE;YACpE,UAAU,EAAE,IAAI;YAChB,GAAG;YACH,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe;QAAE,OAAO,IAAI,CAAA;IAExF,OAAO,UAAU,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,KAAK;QACnC,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,GAAG;QACrC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG;QACH,IAAI;KACL,CAAC,CAAA;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,QAA4B,EAAE,OAA2B;IAC3E,OAAO;QACL,GAAG,QAAQ;QACX,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;QACpD,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI;QAC5D,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO;QACxE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,+CAA+C;QACvE,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW;QACxF,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW;QACxF,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,IAAI,OAAO,CAAC,mBAAmB;KACjF,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qBAAqB,CAAC,GAAW,EAAE,SAAiB;IACjE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAE9D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IAC9C,IAAI,OAAe,CAAA;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IAC5C,IAAI,QAAQ,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAEjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IACxC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAEhD,MAAM,OAAO,GAAG,KAAK,GAAG,iBAAiB,SAAS,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC9E,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IACjD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAsB,EACtB,OAAwB,EAAE;IAE1B,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,mBAAmB,EAAE,CAAA;IAC/D,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,MAAM,CAAA;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAA;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAA;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAA;IAEzC,MAAM,OAAO,GAAyB,EAAE,CAAA;IACxC,MAAM,aAAa,GAAG,IAAI,GAAG,EAA8B,CAAA;IAC3D,MAAM,OAAO,GAAa,EAAE,CAAA;IAE5B,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAC9B,SAAQ;QACV,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACnB,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAC5C,CAAC;IAED,2DAA2D;IAC3D,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAA;IAC1C,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,YAAY,CAAC,CAAA;IACjD,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,EAAE;QACtC,MAAM,SAAS,GAAG,EAAE,GAAG,QAAQ,CAAC,eAAe,EAAE,CAAA;QACjD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,aAAa,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;YAChC,IAAI,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA,CAAC,gCAAgC;gBACnD,SAAQ;YACV,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;YAChE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACpB,CAAC;QACD,OAAO,EAAE,GAAG,QAAQ,EAAE,eAAe,EAAE,SAAS,EAAE,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACrC,IAAI,KAAK;gBAAE,MAAM,qBAAqB,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QACzE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;AACtC,CAAC"}
+{"version":3,"file":"backfill.js","sourceRoot":"","sources":["../../../src/provenance/backfill.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAA;AAC/B,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAC/D,OAAO,EAAE,WAAW,IAAI,kBAAkB,EAAE,MAAM,2CAA2C,CAAA;AAiC7F,MAAM,eAAe,GAAuC;IAC1D,OAAO,EAAE,CAAC;IACV,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;IACR,gBAAgB,EAAE,CAAC;CACpB,CAAA;AAED,SAAS,mBAAmB;IAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,eAAe,CAAC,CAAA;AAChE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,SAAS,CAAC,KAAyB;IAC1C,OAAO,KAAK,CAAC,UAAU,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;AACvF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,SAAS,CAAC,UAA8B,EAAE,aAAiC;IAClF,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAC1C,OAAO,eAAe,CAAC,UAAU,CAAC,IAAI,eAAe,CAAC,aAAa,CAAC,CAAA;AACtE,CAAC;AAED,2CAA2C;AAC3C,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;AAC5C,CAAC;AAYD,gFAAgF;AAChF,KAAK,UAAU,UAAU,CAAC,MAAwB;IAChD,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;IAClF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;IAEtD,IAAI,WAAW,GAAG,GAAG,CAAA;IACrB,IAAI,mBAAuC,CAAA;IAC3C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACvC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAA;QACtC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QACvD,mBAAmB,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;IAED,MAAM,EAAE,GAAG,QAAQ,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC,CAAC,CAAE,UAAqB,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,SAAS,EAAE,CAAA;IAE/F,OAAO;QACL,EAAE;QACF,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,SAAS;QACjB,WAAW;QACX,WAAW;QACX,WAAW,EAAE,GAAG;QAChB,mBAAmB;KACpB,CAAA;AACH,CAAC;AAED,2EAA2E;AAC3E,KAAK,UAAU,UAAU,CACvB,MAA2B,EAC3B,SAAiC,EACjC,aAAiC,EACjC,GAAW,EACX,IAAiC;IAEjC,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAC5C,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;QAC1C,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAA;QAC3B,OAAO,UAAU,CAAC;YAChB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,SAAS,EAAE,sBAAsB,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,IAAI,EAAE;YACpE,UAAU,EAAE,IAAI;YAChB,GAAG;YACH,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe;QAAE,OAAO,IAAI,CAAA;IAExF,OAAO,UAAU,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,KAAK;QACnC,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,GAAG;QACrC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG;QACH,IAAI;KACL,CAAC,CAAA;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,QAA4B,EAAE,OAA2B;IAC3E,4DAA4D;IAC5D,yEAAyE;IACzE,yEAAyE;IACzE,+CAA+C;IAC/C,IAAI,QAAQ,CAAC,UAAU,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAA;IACpD,OAAO;QACL,GAAG,QAAQ;QACX,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;QACpD,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI;QAC5D,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO;QACxE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,+CAA+C;QACvE,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW;QACxF,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW;QACxF,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,IAAI,OAAO,CAAC,mBAAmB;KACjF,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qBAAqB,CAAC,GAAW,EAAE,SAAiB;IACjE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAE9D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IAC9C,IAAI,OAAe,CAAA;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IAC5C,IAAI,QAAQ,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAEjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IACxC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAEhD,MAAM,OAAO,GAAG,KAAK,GAAG,iBAAiB,SAAS,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC9E,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IACjD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAsB,EACtB,OAAwB,EAAE;IAE1B,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,mBAAmB,EAAE,CAAA;IAC/D,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,MAAM,CAAA;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAA;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAA;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAA;IAEzC,MAAM,OAAO,GAAyB,EAAE,CAAA;IACxC,MAAM,aAAa,GAAG,IAAI,GAAG,EAA8B,CAAA;IAC3D,MAAM,OAAO,GAAa,EAAE,CAAA;IAE5B,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAC9B,SAAQ;QACV,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACnB,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAC5C,CAAC;IAED,2DAA2D;IAC3D,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAA;IAC1C,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,YAAY,CAAC,CAAA;IACjD,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,EAAE;QACtC,MAAM,SAAS,GAAG,EAAE,GAAG,QAAQ,CAAC,eAAe,EAAE,CAAA;QACjD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,aAAa,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;YAChC,IAAI,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA,CAAC,gCAAgC;gBACnD,SAAQ;YACV,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;YAChE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACpB,CAAC;QACD,OAAO,EAAE,GAAG,QAAQ,EAAE,eAAe,EAAE,SAAS,EAAE,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACrC,IAAI,KAAK;gBAAE,MAAM,qBAAqB,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QACzE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;AACtC,CAAC"}

package/dist/src/security/scanner/SecurityScanner.scanners.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.scanners.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.scanners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAqB,MAAM,YAAY,CAAA;AAcpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAM/D,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,eAAe,EAChB,MAAM,0BAA0B,CAAA;AA4BjC,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CA2EnB;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CA4CnB;AAED,sEAAsE;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AACtE,iEAAiE;AACjE,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,CAAA"}
+{"version":3,"file":"SecurityScanner.scanners.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.scanners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAqB,MAAM,YAAY,CAAA;AAepE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAM/D,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,eAAe,EAChB,MAAM,0BAA0B,CAAA;AA4BjC,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAiFnB;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CA4CnB;AAED,sEAAsE;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AACtE,iEAAiE;AACjE,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,CAAA"}

package/dist/src/security/scanner/SecurityScanner.scanners.js

@@ -10,7 +10,7 @@
  * them out is behaviour-preserving (guarded by the scoring + regression-guard
  * + ai-defence test suites).
  */
-import { SENSITIVE_PATH_PATTERNS, ENV_PATH_PATTERN, VALUE_GATED_KEYWORD_PATTERNS, PATH_FORM_PATTERNS, VALUE_GATED_ASSIGNMENT_PATTERNS, SOCIAL_ENGINEERING_PATTERNS, PROMPT_LEAKING_PATTERNS, DATA_EXFILTRATION_PATTERNS, PRIVILEGE_ESCALATION_PATTERNS, CREDENTIAL_SUBSTITUTION_PATTERNS, } from './patterns.js';
+import { SENSITIVE_PATH_PATTERNS, ENV_PATH_PATTERN, VALUE_GATED_KEYWORD_PATTERNS, PATH_FORM_PATTERNS, VALUE_GATED_ASSIGNMENT_PATTERNS, OBSERVE_ONLY_MEDIUM_PATTERNS, SOCIAL_ENGINEERING_PATTERNS, PROMPT_LEAKING_PATTERNS, DATA_EXFILTRATION_PATTERNS, PRIVILEGE_ESCALATION_PATTERNS, CREDENTIAL_SUBSTITUTION_PATTERNS, } from './patterns.js';
 import { safeRegexTest, safeRegexCheck } from './regex-utils.js';
 import { analyzeMarkdownContext, isDocumentationContext, isWithinInlineCode, } from './SecurityScanner.helpers.js';
 import { looksLikePlaceholderSecret, shannonEntropy, scanPiiPatterns, } from './SecurityScanner.pii.js';
@@ -78,6 +78,13 @@ export function scanSensitivePaths(content, lineContexts) {
             else if (VALUE_GATED_ASSIGNMENT_PATTERNS.has(pattern)) {
                 severity = assignmentHasRealValue(lines, index) ? 'high' : 'medium'; // MF-4
             }
+            else if (OBSERVE_ONLY_MEDIUM_PATTERNS.has(pattern)) {
+                // MF-5 (SMI-6508): always MEDIUM. Detection without an install block,
+                // pending real-world evidence on the FP rate. Deliberately NOT routed
+                // through assignmentHasRealValue — the measured HIGH rate for this
+                // shape was 191/418 lines, ~46% of which looked like false positives.
+                severity = 'medium';
+            }
             else {
                 severity = 'high'; // MF-1 survivors and any future unclassified pattern — fail CLOSED
             }

package/dist/src/security/scanner/SecurityScanner.scanners.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.scanners.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.scanners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,4BAA4B,EAC5B,kBAAkB,EAClB,+BAA+B,EAC/B,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEhE,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,eAAe,GAChB,MAAM,0BAA0B,CAAA;AACjC,2EAA2E;AAC3E,6EAA6E;AAC7E,gEAAgE;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAA;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AAExE;;;;;;GAMG;AACH,MAAM,iBAAiB,GACrB,8HAA8H,CAAA;AAEhI;;;;;;;;GAQG;AACH,MAAM,qBAAqB,GAAG,+DAA+D,CAAA;AAE7F,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC;gBAAE,SAAQ;YAC5C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC,CAAA;YACrF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;YAE9E,+EAA+E;YAC/E,kFAAkF;YAClF,6EAA6E;YAC7E,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9C,MAAM,MAAM,GAAG,aAAa,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAA;gBACzD,IAAI,CAAC,MAAM,IAAI,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAAE,SAAQ;YAChE,CAAC;YAED,gFAAgF;YAChF,8EAA8E;YAC9E,iFAAiF;YACjF,2BAA2B;YAC3B,kFAAkF;YAClF,iFAAiF;YACjF,qCAAqC;YACrC,qEAAqE;YACrE,IAAI,QAAqC,CAAA;YACzC,IAAI,YAAY,EAAE,CAAC;gBACjB,QAAQ,GAAG,QAAQ,CAAA,CAAC,YAAY;YAClC,CAAC;iBAAM,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;gBACxC,QAAQ,GAAG,cAAc,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA,CAAC,kBAAkB;YAC3F,CAAC;iBAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3C,QAAQ,GAAG,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA,CAAC,OAAO;YAC3E,CAAC;iBAAM,IAAI,+BAA+B,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxD,QAAQ,GAAG,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA,CAAC,OAAO;YAC7E,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,MAAM,CAAA,CAAC,mEAAmE;YACvF,CAAC;YACD,MAAM,UAAU,GAAsB,YAAY;gBAChD,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,QAAQ,KAAK,MAAM;oBACnB,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,QAAQ,CAAA;YAEd,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,QAAQ;gBACR,2EAA2E;gBAC3E,qEAAqE;gBACrE,gEAAgE;gBAChE,wEAAwE;gBACxE,mEAAmE;gBACnE,2EAA2E;gBAC3E,oEAAoE;gBACpE,wEAAwE;gBACxE,uEAAuE;gBACvE,wEAAwE;gBACxE,yEAAyE;gBACzE,2EAA2E;gBAC3E,uEAAuE;gBACvE,OAAO,EAAE,6CAA6C,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG;gBAC3G,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;gBACrB,sBAAsB,EAAE,YAAY;gBACpC,UAAU;aACX,CAAC,CAAA;YACF,MAAK;QACP,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,2BAA2B,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;gBAEjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,oBAAoB;oBAC1B,QAAQ;oBACR,OAAO,EAAE,yCAAyC,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC7D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,oBAAoB;oBAC9B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;gBAEnD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,gBAAgB;oBACtB,QAAQ;oBACR,OAAO,EAAE,qCAAqC,KAAK,CAAC,CAAC,CAAC,GAAG;oBACzD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,gBAAgB;oBAC1B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,0BAA0B,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;gBAEjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,mBAAmB;oBACzB,QAAQ;oBACR,OAAO,EAAE,yCAAyC,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC7D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,mBAAmB;oBAC7B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,6BAA6B,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,0EAA0E;gBAC1E,yEAAyE;gBACzE,sEAAsE;gBACtE,oEAAoE;gBACpE,uEAAuE;gBACvE,yEAAyE;gBACzE,wEAAwE;gBACxE,MAAM,wBAAwB,GAAG,gCAAgC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;gBACnF,MAAM,UAAU,GAAsB,wBAAwB;oBAC5D,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,YAAY;wBACZ,CAAC,CAAC,KAAK;wBACP,CAAC,CAAC,MAAM,CAAA;gBACZ,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;gBAEzF,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,sBAAsB;oBAC5B,QAAQ;oBACR,OAAO,EAAE,2CAA2C,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC/D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,sBAAsB;oBAChC,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,sEAAsE;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AACtE,iEAAiE;AACjE,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,CAAA"}
+{"version":3,"file":"SecurityScanner.scanners.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.scanners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,4BAA4B,EAC5B,kBAAkB,EAClB,+BAA+B,EAC/B,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEhE,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,eAAe,GAChB,MAAM,0BAA0B,CAAA;AACjC,2EAA2E;AAC3E,6EAA6E;AAC7E,gEAAgE;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAA;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AAExE;;;;;;GAMG;AACH,MAAM,iBAAiB,GACrB,8HAA8H,CAAA;AAEhI;;;;;;;;GAQG;AACH,MAAM,qBAAqB,GAAG,+DAA+D,CAAA;AAE7F,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC;gBAAE,SAAQ;YAC5C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC,CAAA;YACrF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;YAE9E,+EAA+E;YAC/E,kFAAkF;YAClF,6EAA6E;YAC7E,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9C,MAAM,MAAM,GAAG,aAAa,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAA;gBACzD,IAAI,CAAC,MAAM,IAAI,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAAE,SAAQ;YAChE,CAAC;YAED,gFAAgF;YAChF,8EAA8E;YAC9E,iFAAiF;YACjF,2BAA2B;YAC3B,kFAAkF;YAClF,iFAAiF;YACjF,qCAAqC;YACrC,qEAAqE;YACrE,IAAI,QAAqC,CAAA;YACzC,IAAI,YAAY,EAAE,CAAC;gBACjB,QAAQ,GAAG,QAAQ,CAAA,CAAC,YAAY;YAClC,CAAC;iBAAM,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;gBACxC,QAAQ,GAAG,cAAc,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA,CAAC,kBAAkB;YAC3F,CAAC;iBAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3C,QAAQ,GAAG,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA,CAAC,OAAO;YAC3E,CAAC;iBAAM,IAAI,+BAA+B,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxD,QAAQ,GAAG,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA,CAAC,OAAO;YAC7E,CAAC;iBAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrD,sEAAsE;gBACtE,sEAAsE;gBACtE,mEAAmE;gBACnE,sEAAsE;gBACtE,QAAQ,GAAG,QAAQ,CAAA;YACrB,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,MAAM,CAAA,CAAC,mEAAmE;YACvF,CAAC;YACD,MAAM,UAAU,GAAsB,YAAY;gBAChD,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,QAAQ,KAAK,MAAM;oBACnB,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,QAAQ,CAAA;YAEd,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,QAAQ;gBACR,2EAA2E;gBAC3E,qEAAqE;gBACrE,gEAAgE;gBAChE,wEAAwE;gBACxE,mEAAmE;gBACnE,2EAA2E;gBAC3E,oEAAoE;gBACpE,wEAAwE;gBACxE,uEAAuE;gBACvE,wEAAwE;gBACxE,yEAAyE;gBACzE,2EAA2E;gBAC3E,uEAAuE;gBACvE,OAAO,EAAE,6CAA6C,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG;gBAC3G,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;gBACrB,sBAAsB,EAAE,YAAY;gBACpC,UAAU;aACX,CAAC,CAAA;YACF,MAAK;QACP,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,2BAA2B,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;gBAEjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,oBAAoB;oBAC1B,QAAQ;oBACR,OAAO,EAAE,yCAAyC,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC7D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,oBAAoB;oBAC9B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;gBAEnD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,gBAAgB;oBACtB,QAAQ;oBACR,OAAO,EAAE,qCAAqC,KAAK,CAAC,CAAC,CAAC,GAAG;oBACzD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,gBAAgB;oBAC1B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,0BAA0B,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;gBAEjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,mBAAmB;oBACzB,QAAQ;oBACR,OAAO,EAAE,yCAAyC,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC7D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,mBAAmB;oBAC7B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,6BAA6B,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,0EAA0E;gBAC1E,yEAAyE;gBACzE,sEAAsE;gBACtE,oEAAoE;gBACpE,uEAAuE;gBACvE,yEAAyE;gBACzE,wEAAwE;gBACxE,MAAM,wBAAwB,GAAG,gCAAgC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;gBACnF,MAAM,UAAU,GAAsB,wBAAwB;oBAC5D,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,YAAY;wBACZ,CAAC,CAAC,KAAK;wBACP,CAAC,CAAC,MAAM,CAAA;gBACZ,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;gBAEzF,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,sBAAsB;oBAC5B,QAAQ;oBACR,OAAO,EAAE,2CAA2C,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC/D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,sBAAsB;oBAChC,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,sEAAsE;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AACtE,iEAAiE;AACjE,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,CAAA"}

package/dist/src/security/scanner/SecurityScanner.value-gate.d.ts

@@ -6,7 +6,15 @@
  * VALUE_GATED_ASSIGNMENT_PATTERNS, decide whether it assigns a REAL credential
  * (→ HIGH) or only prose (→ MEDIUM). HIGH is the default; a downgrade requires
  * positive prose evidence, and since HIGH is the pre-SMI-5207 unconditional
- * behaviour that default can never regress detection.
+ * behaviour that default could not regress detection.
+ *
+ * SMI-6505 QUALIFIES THAT LAST CLAUSE — it is no longer unconditionally true of
+ * this module. It held while every rule here only recognized prose. The
+ * embedded-key boolean-flag rule below deliberately turns a previously-HIGH
+ * input MEDIUM (`allow_credentials=True`, a FastAPI CORS flag that was blocking
+ * installation of any skill documenting CORS setup). The MF-4b veto's own
+ * invariant is unaffected: that one is a claim about the `weakPasswordVeto`
+ * option, and it still holds — see its block below.
  *
  * Split out of SecurityScanner.scanners.ts for the 500-line pre-commit gate
  * once round 8's segmentation logic landed (that file is at 4xx with the MF-3
@@ -44,6 +52,18 @@
  * attaches to the LINE (the finding's `location` is the whole trimmed line), so
  * a line holding any real credential is HIGH. Monotonicity holds — this returns
  * true at least as often as the per-span reading, and true is the status quo.
+ *
+ * SMI-6441 note: "true is the status quo" is still literally correct, but no
+ * longer conveys the blast radius of a single keeplist miss. Under the MF-4b
+ * veto ONE lexicon hit in ANY segment escalates the WHOLE line — so a line
+ * whose first segment is the acceptance criterion's own must-stay-MEDIUM case
+ * goes HIGH anyway if a later segment trips the veto. The next-line path does
+ * the same across a line boundary, letting an indented continuation drive the
+ * severity of an unindented key line. Both follow from the design and neither
+ * loses detection; recorded so a future reader sizes one missing keeplist
+ * entry correctly.
  */
-export declare function assignmentHasRealValue(lines: string[], index: number): boolean;
+export declare function assignmentHasRealValue(lines: string[], index: number, options?: {
+    readonly weakPasswordVeto?: boolean;
+}): boolean;
 //# sourceMappingURL=SecurityScanner.value-gate.d.ts.map

package/dist/src/security/scanner/SecurityScanner.value-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.value-gate.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.value-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA2DH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CA0B9E"}
+{"version":3,"file":"SecurityScanner.value-gate.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.value-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AA4KH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EAAE,EACf,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAE,GAChD,OAAO,CAgCT"}

package/dist/src/security/scanner/SecurityScanner.value-gate.js

@@ -6,7 +6,15 @@
  * VALUE_GATED_ASSIGNMENT_PATTERNS, decide whether it assigns a REAL credential
  * (→ HIGH) or only prose (→ MEDIUM). HIGH is the default; a downgrade requires
  * positive prose evidence, and since HIGH is the pre-SMI-5207 unconditional
- * behaviour that default can never regress detection.
+ * behaviour that default could not regress detection.
+ *
+ * SMI-6505 QUALIFIES THAT LAST CLAUSE — it is no longer unconditionally true of
+ * this module. It held while every rule here only recognized prose. The
+ * embedded-key boolean-flag rule below deliberately turns a previously-HIGH
+ * input MEDIUM (`allow_credentials=True`, a FastAPI CORS flag that was blocking
+ * installation of any skill documenting CORS setup). The MF-4b veto's own
+ * invariant is unaffected: that one is a claim about the `weakPasswordVeto`
+ * option, and it still holds — see its block below.
  *
  * Split out of SecurityScanner.scanners.ts for the 500-line pre-commit gate
  * once round 8's segmentation logic landed (that file is at 4xx with the MF-3
@@ -15,6 +23,7 @@
  */
 import { PLACEHOLDER_SECRET_RE } from './SecurityScanner.pii.js';
 import { PROSE_STOPWORDS } from './SecurityScanner.prose-lexicon.js';
+import { COMMON_WEAK_PASSWORDS } from './SecurityScanner.weak-passwords.js';
 import { MAX_LINE_LENGTH_FOR_REGEX } from './regex-utils.js';
 /** A value that REFERENCES a secret rather than containing one. */
 const TEMPLATE_REFERENCE = /^\$|^\{\{|\$\{|^%[A-Za-z_]|^<%/;
@@ -43,12 +52,49 @@ const MAX_LABEL_TOKENS = 2;
  * the line by key instead of using one span regex.
  */
 const ASSIGNMENT_HEAD = /(?:credentials|\bsecrets?|password)\s*[:=]\s*/gi;
+/**
+ * A whole-span boolean literal, plus trailing delimiters (SMI-6505).
+ *
+ * Anchored at BOTH ends, deliberately. DO NOT relax this. Two obvious
+ * relaxations were each implemented, measured, and rejected: the value span runs
+ * to the next assignment key or EOL, so whatever this regex accepts unexamined
+ * is exactly where a real credential can hide.
+ *
+ *   token-terminated — `^(?:true|false)\s*(?:[,;)\]}]|#|\/\/)`
+ *     would fix  a single-line multi-argument call
+ *     would open `<prefix>_credentials=true, Tr0ub4dor&3` -> MEDIUM
+ *
+ *   trailing-comment branch — `...[\s,;)\]}]*(?:(?:#|\/\/).*)?$`
+ *     would fix  `allow_credentials=True,  # allow cookies`
+ *     would open `<prefix>_credentials=true # Tr0ub4dor&3` -> MEDIUM
+ *
+ * Both bypass shapes are pinned as must-stay-HIGH tests. An embedded key is
+ * trivial to write, so either relaxation is a cheap deliberate bypass rather
+ * than an accidental edge case — which is why the two formatting variants they
+ * would have fixed are accepted residuals instead.
+ */
+const BOOLEAN_FLAG_VALUE = /^(?:true|false)[\s,;)\]}]*$/i;
+/**
+ * Is the matched assignment keyword a SUFFIX of a longer identifier?
+ *
+ * The SMI-6505 discriminator. `allow_credentials=True` reaches this gate at all
+ * only because CREDENTIALS_ASSIGN_PATTERN carries no left boundary; the keyword
+ * being embedded is what marks it as an ordinary identifier rather than a
+ * credential key. Never true of the secrets entry, which has its own `\b`.
+ *
+ * Deliberately NOT fixed by adding `\b` to the pattern instead — that would also
+ * stop matching `AWS_CREDENTIALS=hunter2`, a real credential, trading this false
+ * positive for a false negative. See SMI-6508.
+ */
+function isEmbeddedKey(line, matchStart) {
+    return matchStart > 0 && /[A-Za-z0-9_]/.test(line[matchStart - 1]);
+}
 /**
  * Positive prose evidence. Absence of evidence leaves the finding at HIGH.
  * PROSE_STOPWORDS lives in SecurityScanner.prose-lexicon.ts — English function
  * words: a passphrase is nouns, an explanatory sentence is not.
  */
-function isProseValue(span) {
+function isProseValue(span, weakPasswordVeto) {
     const v = span.replace(/^['"]|['"]$/g, '').trim();
     if (v.length === 0)
         return true;
@@ -63,9 +109,82 @@ function isProseValue(span) {
         return true; // sentence
     if (tokens.length > 12)
         return true; // long sentence
+    /**
+     * SMI-6441 (MF-4b): a 2-token all-lowercase value normally reads as a
+     * documentation label ("rotation policy"). It does NOT when EVERY one of its
+     * tokens is a known common password ("monkey dragon", "qwerty ninja") — that
+     * is a weak credential wearing a label's shape, SMI-5207's residual R-2.
+     *
+     * WHY `every` AND NOT `some` — the load-bearing choice, decided on measured
+     * evidence after three adversarial review rounds. A `some` predicate reopens
+     * the very false-positive class SMI-5207 closed, and does so unboundedly:
+     * 55% of the emitted lexicon (2,229 of 4,012 entries) are ordinary English
+     * dictionary words, so almost any two-word documentation label pairs a
+     * benign noun with a lexicon member. Three independent review passes each
+     * found more leaks (`security policy`, `command reference`, `cloud
+     * provider`, `active profile`, `help center`, `java client`, `mobile app`,
+     * …), and the keeplist that was supposed to prevent this is a hand-curated
+     * denylist-of-a-denylist against a 2,229-word residual — it does not
+     * converge. `every` closes the class STRUCTURALLY instead: a documentation
+     * label essentially never has BOTH of its words in a common-password list.
+     *
+     * WHAT THIS COSTS, STATED PLAINLY: R-2 is now closed only for the
+     * two-common-password case. A value pairing ONE common password with an
+     * ordinary word — the plan's original headline example — stays MEDIUM,
+     * because it is not distinguishable from a documentation label without a
+     * false-positive rate this gate cannot afford. The install gate fails on
+     * `hasHigh` alone with no allowlist anywhere in `skill-installation.*`, so
+     * an FP here blocks a legitimate install and costs a package publish to
+     * undo; a FN leaves a weak credential at MEDIUM, which is exactly where it
+     * sat before this wave. The asymmetry is what decides it.
+     *
+     * SCOPE, DELIBERATELY NARROW: this veto applies ONLY to the exactly-2-token
+     * all-lowercase carve-out below, never to the stopword ("sentence") rule
+     * above it. A top-10k common-password list is saturated with ordinary nouns
+     * (love, money, summer, hello, welcome, computer, football, sunshine) and a
+     * ten-word documentation sentence has a high chance of containing one, so
+     * extending the veto to sentences would reopen exactly the false-positive
+     * class SMI-5207 closed. R-3 (a passphrase containing a function word) is
+     * therefore NOT closed by this wave, by design.
+     *
+     * SAFETY INVARIANT — stated precisely, because the obvious stronger claim is
+     * FALSE. This veto only ever REMOVES a downgrade path; it never adds one. So
+     * for every input, post-6441 severity >= pre-6441 severity, and the set of
+     * inputs reading MEDIUM after this change is a strict SUBSET of the set that
+     * read MEDIUM before it. That is the whole safety argument, and it is enough:
+     * no input that was HIGH becomes MEDIUM, so no detection is lost.
+     *
+     * It is NOT true that "no added token can lower severity". The stopword check
+     * above runs BEFORE this label check and returns early, so:
+     *     password: monkey dragon     -> vetoed  -> HIGH
+     *     password: a monkey dragon   -> stopword -> MEDIUM
+     * A third token that is a PROSE_STOPWORD ('a', 'the', 'an', 'no', 'so',
+     * 'now', 'just', 'only', 'is', ...) short-circuits ahead of this line and
+     * downgrades. This stopword-prepend path is the KNOWN, ACCEPTED BYPASS of
+     * this veto. It is not a new hole opened by SMI-6441 — it is exactly
+     * SMI-5207's residual R-3 (a value containing an English function word
+     * degrades to MEDIUM), which this wave deliberately leaves open (see
+     * Rejected alternative 1: extending the veto to the stopword rule would flip
+     * ordinary documentation sentences to HIGH, reopening the FP class with 10
+     * documented recurrences). Anyone closing R-3 later closes this bypass with
+     * it; until then, do not describe this veto as unpoisonable.
+     *
+     * ONE THING THE R-3 IDENTIFICATION DOES NOT CARRY OVER (SMI-6441
+     * adversarial review round 2). Calling this bypass "exactly R-3" is true
+     * of the MECHANISM, but must not be read as inheriting SMI-5207's whole
+     * acceptance rationale. That plan accepted R-3 partly because its quoted
+     * form is independently covered by PII_PATTERNS. Measured, that backstop
+     * covers only the quoted form: a quoted stopword-prefixed value still
+     * fires a HIGH pii finding, while the UNQUOTED form fires nothing at any
+     * severity — and the unquoted form is the one an author would type. The
+     * mechanism is inherited; its REACHABILITY AS AN EVASION is not. Before
+     * this wave there was nothing to evade here, because a 2-token label was
+     * already MEDIUM. Treat it as an accepted residual with NO backstop.
+     */
     if (tokens.length > 1 &&
         tokens.length <= MAX_LABEL_TOKENS &&
-        tokens.every((t) => /^[a-z]{1,19}$/.test(t)))
+        tokens.every((t) => /^[a-z]{1,19}$/.test(t)) &&
+        (!weakPasswordVeto || !tokens.every((t) => COMMON_WEAK_PASSWORDS.has(t))))
         return true; // 2-word doc label
     return false; // DEFAULT: stays HIGH
 }
@@ -100,8 +219,20 @@ function isProseValue(span) {
  * attaches to the LINE (the finding's `location` is the whole trimmed line), so
  * a line holding any real credential is HIGH. Monotonicity holds — this returns
  * true at least as often as the per-span reading, and true is the status quo.
+ *
+ * SMI-6441 note: "true is the status quo" is still literally correct, but no
+ * longer conveys the blast radius of a single keeplist miss. Under the MF-4b
+ * veto ONE lexicon hit in ANY segment escalates the WHOLE line — so a line
+ * whose first segment is the acceptance criterion's own must-stay-MEDIUM case
+ * goes HIGH anyway if a later segment trips the veto. The next-line path does
+ * the same across a line boundary, letting an indented continuation drive the
+ * severity of an unindented key line. Both follow from the design and neither
+ * loses detection; recorded so a future reader sizes one missing keeplist
+ * entry correctly.
  */
-export function assignmentHasRealValue(lines, index) {
+export function assignmentHasRealValue(lines, index, options // default true
+) {
+    const weakPasswordVeto = options?.weakPasswordVeto !== false;
     // Same ReDoS input cap the safeRegex* helpers apply; matchAll has no
     // equivalent wrapper, so the truncation is explicit here.
     const line = lines[index].slice(0, MAX_LINE_LENGTH_FOR_REGEX);
@@ -120,7 +251,13 @@ export function assignmentHasRealValue(lines, index) {
             continue;
         }
         trailingKeyIsBare = false;
-        if (!isProseValue(value))
+        // SMI-6505: an EMBEDDED key assigned a bare boolean is a configuration flag,
+        // not a credential. `continue` classifies the segment as prose without
+        // consulting isProseValue(), which sees only the value span and therefore
+        // could not tell this apart from a bare `credentials: True`.
+        if (isEmbeddedKey(line, heads[i].index ?? 0) && BOOLEAN_FLAG_VALUE.test(value.trim()))
+            continue;
+        if (!isProseValue(value, weakPasswordVeto))
             return true;
     }
     if (!trailingKeyIsBare)
@@ -129,6 +266,6 @@ export function assignmentHasRealValue(lines, index) {
     // `next !== undefined` guard type-checks — `lines[index + 1]` is `string`
     // here (no noUncheckedIndexedAccess), making the compare a TS2367 error.
     const next = lines[index + 1];
-    return next !== undefined && !isProseValue(next.trim());
+    return next !== undefined && !isProseValue(next.trim(), weakPasswordVeto);
 }
 //# sourceMappingURL=SecurityScanner.value-gate.js.map