@skillsmith/core 0.9.0 → 0.11.0

package/dist/src/security/scanner/SecurityScanner.pii.js

@@ -0,0 +1,152 @@
+/**
+ * Security Scanner — PII pattern scanning + entropy / placeholder filtering
+ * @module @skillsmith/core/security/scanner/SecurityScanner.pii
+ *
+ * SMI-5434: Section 3 of SecurityScanner.scanners.ts extracted to keep the
+ * parent file under the 500-line audit:standards gate. Pure functions of
+ * (content, lineContexts) — no scanner instance state.
+ */
+import { analyzeMarkdownContext, isDocumentationContext, isWithinInlineCode, } from './SecurityScanner.helpers.js';
+import { safeRegexTest } from './regex-utils.js';
+import { PII_PATTERNS } from './patterns.js';
+/**
+ * SMI-5420: credential PII pattern indices (api/secret/access key, provider
+ * tokens, password) whose matched VALUE can be a documentation placeholder.
+ * Excludes email (7), SSN (8), and the private-key marker (9) — those have no
+ * placeholder-secret failure mode.
+ */
+const CREDENTIAL_PII_INDICES = new Set([0, 1, 2, 3, 4, 5, 6, 10]);
+/**
+ * SMI-5420: named-placeholder markers that indicate an example, not a real
+ * secret. Intentionally NO `X{4,}` rule — it would test the raw match string and
+ * short-circuit before the entropy check, downgrading a REAL high-entropy secret
+ * that coincidentally contains `xxxx` (governance FN). An all-repeated-char value
+ * (e.g. `xxxx…`) is caught by the `/^(.)\1+$/` check in looksLikePlaceholderSecret
+ * instead, and partial-repeat low-variety values by the entropy floor.
+ *
+ * SMI-5423: the SHORT markers (FAKE/DUMMY/SAMPLE/YOUR, ≤6 chars) are guarded with
+ * a negative lookbehind `(?<![A-Za-z0-9])` so they only match as a delimited token
+ * (`FAKE_KEY`, `<FAKE>`, value-start) — NOT mid-random-string (`k7FAKE1abc`), which
+ * is the same raw-match short-circuit FN class as the removed `X{4,}`. Longer
+ * markers (EXAMPLE/PLACEHOLDER/CHANGEME/REDACTED, 7+ chars) stay unbounded: their
+ * coincidence probability is negligible AND `AKIA…7EXAMPLE` needs EXAMPLE to match
+ * mid-token.
+ *
+ * Accepted tradeoff (SMI-5423 governance): a digit-immediately-prefixed token like
+ * `1FAKE_KEY` fails the lookbehind and scores critical rather than low. This is the
+ * FP-SAFE direction (over-flag a rare contrived placeholder) — strictly preferable
+ * in a security scanner to the FN it replaces (a real secret downgraded); and a
+ * longer such value falls under the entropy floor anyway.
+ */
+const PLACEHOLDER_SECRET_RE = /EXAMPLE|(?<![A-Za-z0-9])YOUR[_-]?|PLACEHOLDER|CHANGE[_-]?ME|(?<![A-Za-z0-9])DUMMY|(?<![A-Za-z0-9])FAKE|(?<![A-Za-z0-9])SAMPLE|REDACTED|INSERT[_-]|\.\.\.|<[^>]+>/i;
+/**
+ * SMI-5420: minimum Shannon entropy (bits/char) for a value to read as a real secret.
+ * SMI-5424 PR2 (accepted tradeoff): a hardcoded credential value shorter than ~8 chars
+ * cannot reach 3.0 bits/char (its max entropy is log2(len) < 3.0), so it falls below
+ * this floor and is treated as a placeholder by design — a sub-8-char literal is not a
+ * credible credential, and the 20+char PII_PATTERNS rule is the real-credential detector.
+ */
+const SECRET_ENTROPY_FLOOR = 3.0;
+/** SMI-5420: Shannon entropy (bits per character) of a string. */
+export function shannonEntropy(s) {
+    if (!s)
+        return 0;
+    const freq = new Map();
+    for (const ch of s)
+        freq.set(ch, (freq.get(ch) ?? 0) + 1);
+    let h = 0;
+    for (const c of freq.values()) {
+        const p = c / s.length;
+        h -= p * Math.log2(p);
+    }
+    return h;
+}
+/**
+ * SMI-5420: extract the secret token from a credential match by stripping a
+ * leading `<key>:`/`<key>=` assignment prefix and surrounding quotes.
+ */
+function extractSecretValue(match) {
+    return match
+        .replace(/^[^:=]*[:=]\s*/, '')
+        .replace(/^['"]|['"]$/g, '')
+        .trim();
+}
+/**
+ * SMI-5420: a credential match is a documentation placeholder (not a real leaked
+ * secret) when it carries a named placeholder marker, is a single repeated
+ * character, or its value has sub-secret Shannon entropy. Such matches must NOT
+ * emit critical/high severity — the batch trust-scorer (trust-scorer.ts) and the
+ * install gate quarantine on severity, so an example secret would falsely flag.
+ */
+export function looksLikePlaceholderSecret(match) {
+    if (PLACEHOLDER_SECRET_RE.test(match))
+        return true;
+    const value = extractSecretValue(match);
+    if (value.length === 0)
+        return false;
+    if (/^(.)\1+$/.test(value))
+        return true;
+    return shannonEntropy(value) < SECRET_ENTROPY_FLOOR;
+}
+/** SMI-3864: Detect PII patterns. Email in YAML frontmatter gets low severity. */
+export function scanPiiPatterns(content, lineContexts) {
+    const findings = [];
+    const lines = content.split('\n');
+    const contexts = lineContexts ?? analyzeMarkdownContext(content);
+    let frontmatterEnd = -1;
+    if (lines[0]?.trim() === '---') {
+        for (let i = 1; i < lines.length; i++) {
+            if (lines[i].trim() === '---') {
+                frontmatterEnd = i;
+                break;
+            }
+        }
+    }
+    const emailPatternIndex = 7;
+    lines.forEach((line, index) => {
+        const ctx = contexts[index];
+        const inFrontmatter = index > 0 && index < frontmatterEnd;
+        for (let pi = 0; pi < PII_PATTERNS.length; pi++) {
+            const pattern = PII_PATTERNS[pi];
+            const match = safeRegexTest(pattern, line);
+            if (match) {
+                const inInlineCode = ctx?.isInlineCode && isWithinInlineCode(line, match.index ?? 0);
+                const inDocContext = ctx ? isDocumentationContext(ctx) || inInlineCode : false;
+                const isEmailPattern = pi === emailPatternIndex;
+                const isAuthorLine = /^\s*(?:author|contact|support|email)\s*:/i.test(line);
+                const inEmailSafeContext = isEmailPattern && (inFrontmatter || isAuthorLine);
+                let severity;
+                if (inEmailSafeContext)
+                    severity = 'low';
+                else if (inDocContext)
+                    severity = 'medium';
+                else if (pi <= 2 || pi === 9)
+                    severity = 'critical';
+                else
+                    severity = 'high';
+                let confidence = inDocContext || inEmailSafeContext ? 'low' : 'high';
+                // SMI-5420: a credential match that reads as a documentation placeholder
+                // (named placeholder, repeated char, or low entropy) must not emit
+                // critical/high — the batch trust-scorer quarantines on severity, so an
+                // example secret like `api_key: "YOUR_API_KEY_HERE"` would falsely flag.
+                if (CREDENTIAL_PII_INDICES.has(pi) && looksLikePlaceholderSecret(match[0])) {
+                    severity = 'low';
+                    confidence = 'low';
+                }
+                findings.push({
+                    type: 'pii',
+                    severity,
+                    message: `PII detected: ${match[0].slice(0, 40)}${match[0].length > 40 ? '...' : ''}`,
+                    location: line.trim().slice(0, 100),
+                    lineNumber: index + 1,
+                    category: 'pii',
+                    inDocumentationContext: inDocContext || inEmailSafeContext,
+                    confidence,
+                });
+                break;
+            }
+        }
+    });
+    return findings;
+}
+//# sourceMappingURL=SecurityScanner.pii.js.map

package/dist/src/security/scanner/SecurityScanner.pii.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.pii.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.pii.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAE5C;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;AAEjE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,qBAAqB,GACzB,mKAAmK,CAAA;AAErK;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEhC,kEAAkE;AAClE,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAA;IAChB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAA;IACtC,KAAK,MAAM,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACzD,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;QACtB,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvB,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK;SACT,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;SAC7B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,IAAI,EAAE,CAAA;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAClD,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACvC,OAAO,cAAc,CAAC,KAAK,CAAC,GAAG,oBAAoB,CAAA;AACrD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,YAA4B;IAC3E,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAChE,IAAI,cAAc,GAAG,CAAC,CAAC,CAAA;IACvB,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;gBAC9B,cAAc,GAAG,CAAC,CAAA;gBAClB,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,iBAAiB,GAAG,CAAC,CAAA;IAC3B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC3B,MAAM,aAAa,GAAG,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,cAAc,CAAA;QACzD,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,CAAC,CAAA;YAChC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,cAAc,GAAG,EAAE,KAAK,iBAAiB,CAAA;gBAC/C,MAAM,YAAY,GAAG,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC3E,MAAM,kBAAkB,GAAG,cAAc,IAAI,CAAC,aAAa,IAAI,YAAY,CAAC,CAAA;gBAC5E,IAAI,QAAgD,CAAA;gBACpD,IAAI,kBAAkB;oBAAE,QAAQ,GAAG,KAAK,CAAA;qBACnC,IAAI,YAAY;oBAAE,QAAQ,GAAG,QAAQ,CAAA;qBACrC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;oBAAE,QAAQ,GAAG,UAAU,CAAA;;oBAC9C,QAAQ,GAAG,MAAM,CAAA;gBACtB,IAAI,UAAU,GAAsB,YAAY,IAAI,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACvF,yEAAyE;gBACzE,mEAAmE;gBACnE,wEAAwE;gBACxE,yEAAyE;gBACzE,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3E,QAAQ,GAAG,KAAK,CAAA;oBAChB,UAAU,GAAG,KAAK,CAAA;gBACpB,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,KAAK;oBACX,QAAQ;oBACR,OAAO,EAAE,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;oBACrF,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,KAAK;oBACf,sBAAsB,EAAE,YAAY,IAAI,kBAAkB;oBAC1D,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IACF,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/src/security/scanner/SecurityScanner.scanners.d.ts

@@ -12,21 +12,14 @@
  */
 import type { SecurityFinding } from './types.js';
 import type { LineContext } from './SecurityScanner.helpers.js';
+import { looksLikePlaceholderSecret, shannonEntropy, scanPiiPatterns } from './SecurityScanner.pii.js';
 export declare function scanSensitivePaths(content: string, lineContexts?: LineContext[]): SecurityFinding[];
 export declare function scanSocialEngineering(content: string, lineContexts?: LineContext[]): SecurityFinding[];
 export declare function scanPromptLeaking(content: string, lineContexts?: LineContext[]): SecurityFinding[];
 export declare function scanDataExfiltration(content: string, lineContexts?: LineContext[]): SecurityFinding[];
 export declare function scanPrivilegeEscalation(content: string, lineContexts?: LineContext[]): SecurityFinding[];
-/** SMI-5420: Shannon entropy (bits per character) of a string. */
-export declare function shannonEntropy(s: string): number;
-/**
- * SMI-5420: a credential match is a documentation placeholder (not a real leaked
- * secret) when it carries a named placeholder marker, is a single repeated
- * character, or its value has sub-secret Shannon entropy. Such matches must NOT
- * emit critical/high severity — the batch trust-scorer (trust-scorer.ts) and the
- * install gate quarantine on severity, so an example secret would falsely flag.
- */
-export declare function looksLikePlaceholderSecret(match: string): boolean;
-/** SMI-3864: Detect PII patterns. Email in YAML frontmatter gets low severity. */
-export declare function scanPiiPatterns(content: string, lineContexts?: LineContext[]): SecurityFinding[];
+/** Implementation in SecurityScanner.compound.ts (SMI-5434 split). */
+export { scanChmodFetchCompound } from './SecurityScanner.compound.js';
+/** Implementation in SecurityScanner.pii.ts (SMI-5434 split). */
+export { shannonEntropy, looksLikePlaceholderSecret, scanPiiPatterns };
 //# sourceMappingURL=SecurityScanner.scanners.d.ts.map

package/dist/src/security/scanner/SecurityScanner.scanners.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.scanners.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.scanners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAqB,MAAM,YAAY,CAAA;AAUpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAO/D,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CA+BnB;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAwBD,kEAAkE;AAClE,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAUhD;AAaD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMjE;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CAuDhG"}
+{"version":3,"file":"SecurityScanner.scanners.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.scanners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAqB,MAAM,YAAY,CAAA;AAWpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAM/D,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,eAAe,EAChB,MAAM,0BAA0B,CAAA;AAuBjC,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAoDnB;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,sEAAsE;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AACtE,iEAAiE;AACjE,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,CAAA"}

package/dist/src/security/scanner/SecurityScanner.scanners.js

@@ -10,9 +10,28 @@
  * them out is behaviour-preserving (guarded by the scoring + regression-guard
  * + ai-defence test suites).
  */
-import { SENSITIVE_PATH_PATTERNS, SOCIAL_ENGINEERING_PATTERNS, PROMPT_LEAKING_PATTERNS, DATA_EXFILTRATION_PATTERNS, PRIVILEGE_ESCALATION_PATTERNS, PII_PATTERNS, } from './patterns.js';
+import { SENSITIVE_PATH_PATTERNS, ENV_PATH_PATTERN, VALUE_GATED_KEYWORD_PATTERNS, SOCIAL_ENGINEERING_PATTERNS, PROMPT_LEAKING_PATTERNS, DATA_EXFILTRATION_PATTERNS, PRIVILEGE_ESCALATION_PATTERNS, } from './patterns.js';
 import { safeRegexTest, safeRegexCheck } from './regex-utils.js';
 import { analyzeMarkdownContext, isDocumentationContext, isWithinInlineCode, } from './SecurityScanner.helpers.js';
+import { looksLikePlaceholderSecret, shannonEntropy, scanPiiPatterns, } from './SecurityScanner.pii.js';
+/**
+ * SMI-5359 Wave 4 (MF-2): a `.env` reference is an active read/exfiltration only when
+ * it co-occurs with a read/copy/transfer verb or a shell pipe/redirect on the same line
+ * (`cat .env | curl …`, `cp .env /tmp`, `source .env`). A lone reference
+ * (`see the .env file`) stays MEDIUM so it can't single-handedly trip the Gate-A
+ * high/critical short-circuit. Bounded alternation + single-char class → ReDoS-safe.
+ */
+const ENV_EXFIL_CONTEXT = /\b(?:cat|cp|mv|scp|rsync|source|curl|wget|fetch|less|more|head|tail|tee|upload|tar|zip|gzip|base64|xxd|dd|nc|netcat)\b|[|>]/i;
+/**
+ * SMI-5359 Wave 4 (MF-1): a bare api_key/auth_token keyword is a credential leak only
+ * when the line ASSIGNS a value to it. The full match is handed to
+ * looksLikePlaceholderSecret, which strips the `<key>=`/`<key>:` prefix and rejects
+ * named placeholders, single-repeated-char, and sub-entropy values — so
+ * `export API_KEY=$1`, `apiKey: <YOUR_KEY>`, and `auth_token: YOUR_TOKEN_HERE` are
+ * suppressed while a real `apiKey = "sk_live_…"` still scores HIGH. Bounded, single
+ * `.+` quantifier → ReDoS-safe.
+ */
+const CREDENTIAL_ASSIGNMENT = /(?:api[_-]?key|apikey|auth[_-]?token|authtoken)\s*[:=]\s*.+$/i;
 export function scanSensitivePaths(content, lineContexts) {
     const findings = [];
     const lines = content.split('\n');
@@ -20,23 +39,46 @@ export function scanSensitivePaths(content, lineContexts) {
     lines.forEach((line, index) => {
         const ctx = contexts[index];
         for (const pattern of SENSITIVE_PATH_PATTERNS) {
-            if (safeRegexCheck(pattern, line)) {
-                const match = safeRegexTest(pattern, line);
-                const inInlineCode = ctx?.isInlineCode && isWithinInlineCode(line, match?.index ?? 0);
-                const inDocContext = ctx ? isDocumentationContext(ctx) || inInlineCode : false;
-                const confidence = inDocContext ? 'low' : 'high';
-                const severity = inDocContext ? 'medium' : 'high';
-                findings.push({
-                    type: 'sensitive_path',
-                    severity,
-                    message: `Reference to potentially sensitive path: ${pattern.source}`,
-                    location: line.trim().slice(0, 100),
-                    lineNumber: index + 1,
-                    inDocumentationContext: inDocContext,
-                    confidence,
-                });
-                break;
+            if (!safeRegexCheck(pattern, line))
+                continue;
+            const match = safeRegexTest(pattern, line);
+            const inInlineCode = ctx?.isInlineCode && isWithinInlineCode(line, match?.index ?? 0);
+            const inDocContext = ctx ? isDocumentationContext(ctx) || inInlineCode : false;
+            // MF-1: value-gate the bare credential keywords. A bare/placeholder mention is
+            // suppressed — keep scanning later patterns rather than emitting. The real-secret
+            // leak still surfaces at PII; the `$VAR`-in-curl exfil at DATA_EXFILTRATION.
+            if (VALUE_GATED_KEYWORD_PATTERNS.has(pattern)) {
+                const assign = safeRegexTest(CREDENTIAL_ASSIGNMENT, line);
+                if (!assign || looksLikePlaceholderSecret(assign[0]))
+                    continue;
+            }
+            // MF-2: lone `.env` → MEDIUM; `.env` + read/exfil verb or pipe/redirect → HIGH.
+            // Doc-context keeps the existing MEDIUM downgrade for every pattern.
+            let severity;
+            if (inDocContext) {
+                severity = 'medium';
+            }
+            else if (pattern === ENV_PATH_PATTERN) {
+                severity = safeRegexCheck(ENV_EXFIL_CONTEXT, line) ? 'high' : 'medium';
             }
+            else {
+                severity = 'high';
+            }
+            const confidence = inDocContext
+                ? 'low'
+                : severity === 'high'
+                    ? 'high'
+                    : 'medium';
+            findings.push({
+                type: 'sensitive_path',
+                severity,
+                message: `Reference to potentially sensitive path: ${pattern.source}`,
+                location: line.trim().slice(0, 100),
+                lineNumber: index + 1,
+                inDocumentationContext: inDocContext,
+                confidence,
+            });
+            break;
         }
     });
     return findings;
@@ -157,124 +199,8 @@ export function scanPrivilegeEscalation(content, lineContexts) {
     });
     return findings;
 }
-/**
- * SMI-5420: credential PII pattern indices (api/secret/access key, provider
- * tokens, password) whose matched VALUE can be a documentation placeholder.
- * Excludes email (7), SSN (8), and the private-key marker (9) — those have no
- * placeholder-secret failure mode.
- */
-const CREDENTIAL_PII_INDICES = new Set([0, 1, 2, 3, 4, 5, 6, 10]);
-/**
- * SMI-5420: named-placeholder markers that indicate an example, not a real
- * secret. Intentionally NO `X{4,}` rule — it would test the raw match string and
- * short-circuit before the entropy check, downgrading a REAL high-entropy secret
- * that coincidentally contains `xxxx` (governance FN). An all-repeated-char value
- * (e.g. `xxxx…`) is caught by the `/^(.)\1+$/` check in looksLikePlaceholderSecret
- * instead, and partial-repeat low-variety values by the entropy floor.
- */
-const PLACEHOLDER_SECRET_RE = /EXAMPLE|YOUR[_-]?|PLACEHOLDER|CHANGE[_-]?ME|DUMMY|FAKE|SAMPLE|REDACTED|INSERT[_-]|\.\.\.|<[^>]+>/i;
-/** SMI-5420: minimum Shannon entropy (bits/char) for a value to read as a real secret. */
-const SECRET_ENTROPY_FLOOR = 3.0;
-/** SMI-5420: Shannon entropy (bits per character) of a string. */
-export function shannonEntropy(s) {
-    if (!s)
-        return 0;
-    const freq = new Map();
-    for (const ch of s)
-        freq.set(ch, (freq.get(ch) ?? 0) + 1);
-    let h = 0;
-    for (const c of freq.values()) {
-        const p = c / s.length;
-        h -= p * Math.log2(p);
-    }
-    return h;
-}
-/**
- * SMI-5420: extract the secret token from a credential match by stripping a
- * leading `<key>:`/`<key>=` assignment prefix and surrounding quotes.
- */
-function extractSecretValue(match) {
-    return match
-        .replace(/^[^:=]*[:=]\s*/, '')
-        .replace(/^['"]|['"]$/g, '')
-        .trim();
-}
-/**
- * SMI-5420: a credential match is a documentation placeholder (not a real leaked
- * secret) when it carries a named placeholder marker, is a single repeated
- * character, or its value has sub-secret Shannon entropy. Such matches must NOT
- * emit critical/high severity — the batch trust-scorer (trust-scorer.ts) and the
- * install gate quarantine on severity, so an example secret would falsely flag.
- */
-export function looksLikePlaceholderSecret(match) {
-    if (PLACEHOLDER_SECRET_RE.test(match))
-        return true;
-    const value = extractSecretValue(match);
-    if (value.length === 0)
-        return false;
-    if (/^(.)\1+$/.test(value))
-        return true;
-    return shannonEntropy(value) < SECRET_ENTROPY_FLOOR;
-}
-/** SMI-3864: Detect PII patterns. Email in YAML frontmatter gets low severity. */
-export function scanPiiPatterns(content, lineContexts) {
-    const findings = [];
-    const lines = content.split('\n');
-    const contexts = lineContexts ?? analyzeMarkdownContext(content);
-    let frontmatterEnd = -1;
-    if (lines[0]?.trim() === '---') {
-        for (let i = 1; i < lines.length; i++) {
-            if (lines[i].trim() === '---') {
-                frontmatterEnd = i;
-                break;
-            }
-        }
-    }
-    const emailPatternIndex = 7;
-    lines.forEach((line, index) => {
-        const ctx = contexts[index];
-        const inFrontmatter = index > 0 && index < frontmatterEnd;
-        for (let pi = 0; pi < PII_PATTERNS.length; pi++) {
-            const pattern = PII_PATTERNS[pi];
-            const match = safeRegexTest(pattern, line);
-            if (match) {
-                const inInlineCode = ctx?.isInlineCode && isWithinInlineCode(line, match.index ?? 0);
-                const inDocContext = ctx ? isDocumentationContext(ctx) || inInlineCode : false;
-                const isEmailPattern = pi === emailPatternIndex;
-                const isAuthorLine = /^\s*(?:author|contact|support|email)\s*:/i.test(line);
-                const inEmailSafeContext = isEmailPattern && (inFrontmatter || isAuthorLine);
-                let severity;
-                if (inEmailSafeContext)
-                    severity = 'low';
-                else if (inDocContext)
-                    severity = 'medium';
-                else if (pi <= 2 || pi === 9)
-                    severity = 'critical';
-                else
-                    severity = 'high';
-                let confidence = inDocContext || inEmailSafeContext ? 'low' : 'high';
-                // SMI-5420: a credential match that reads as a documentation placeholder
-                // (named placeholder, repeated char, or low entropy) must not emit
-                // critical/high — the batch trust-scorer quarantines on severity, so an
-                // example secret like `api_key: "YOUR_API_KEY_HERE"` would falsely flag.
-                if (CREDENTIAL_PII_INDICES.has(pi) && looksLikePlaceholderSecret(match[0])) {
-                    severity = 'low';
-                    confidence = 'low';
-                }
-                findings.push({
-                    type: 'pii',
-                    severity,
-                    message: `PII detected: ${match[0].slice(0, 40)}${match[0].length > 40 ? '...' : ''}`,
-                    location: line.trim().slice(0, 100),
-                    lineNumber: index + 1,
-                    category: 'pii',
-                    inDocumentationContext: inDocContext || inEmailSafeContext,
-                    confidence,
-                });
-                break;
-            }
-        }
-    });
-    return findings;
-}
+/** Implementation in SecurityScanner.compound.ts (SMI-5434 split). */
+export { scanChmodFetchCompound } from './SecurityScanner.compound.js';
+/** Implementation in SecurityScanner.pii.ts (SMI-5434 split). */
+export { shannonEntropy, looksLikePlaceholderSecret, scanPiiPatterns };
 //# sourceMappingURL=SecurityScanner.scanners.js.map

package/dist/src/security/scanner/SecurityScanner.scanners.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.scanners.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.scanners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,YAAY,GACb,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEhE,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AAErC,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,IAAI,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAC1C,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC,CAAA;gBACrF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;gBAEjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,gBAAgB;oBACtB,QAAQ;oBACR,OAAO,EAAE,4CAA4C,OAAO,CAAC,MAAM,EAAE;oBACrE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,2BAA2B,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;gBAEjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,oBAAoB;oBAC1B,QAAQ;oBACR,OAAO,EAAE,yCAAyC,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC7D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,oBAAoB;oBAC9B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;gBAEnD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,gBAAgB;oBACtB,QAAQ;oBACR,OAAO,EAAE,qCAAqC,KAAK,CAAC,CAAC,CAAC,GAAG;oBACzD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,gBAAgB;oBAC1B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,0BAA0B,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;gBAEjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,mBAAmB;oBACzB,QAAQ;oBACR,OAAO,EAAE,yCAAyC,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC7D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,mBAAmB;oBAC7B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,6BAA6B,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;gBAEnD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,sBAAsB;oBAC5B,QAAQ;oBACR,OAAO,EAAE,2CAA2C,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC/D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,sBAAsB;oBAChC,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;AAEjE;;;;;;;GAOG;AACH,MAAM,qBAAqB,GACzB,mGAAmG,CAAA;AAErG,0FAA0F;AAC1F,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEhC,kEAAkE;AAClE,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAA;IAChB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAA;IACtC,KAAK,MAAM,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACzD,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;QACtB,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvB,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK;SACT,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;SAC7B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,IAAI,EAAE,CAAA;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAClD,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACvC,OAAO,cAAc,CAAC,KAAK,CAAC,GAAG,oBAAoB,CAAA;AACrD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,YAA4B;IAC3E,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAChE,IAAI,cAAc,GAAG,CAAC,CAAC,CAAA;IACvB,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;gBAC9B,cAAc,GAAG,CAAC,CAAA;gBAClB,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,iBAAiB,GAAG,CAAC,CAAA;IAC3B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC3B,MAAM,aAAa,GAAG,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,cAAc,CAAA;QACzD,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,CAAC,CAAA;YAChC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,cAAc,GAAG,EAAE,KAAK,iBAAiB,CAAA;gBAC/C,MAAM,YAAY,GAAG,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC3E,MAAM,kBAAkB,GAAG,cAAc,IAAI,CAAC,aAAa,IAAI,YAAY,CAAC,CAAA;gBAC5E,IAAI,QAAgD,CAAA;gBACpD,IAAI,kBAAkB;oBAAE,QAAQ,GAAG,KAAK,CAAA;qBACnC,IAAI,YAAY;oBAAE,QAAQ,GAAG,QAAQ,CAAA;qBACrC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;oBAAE,QAAQ,GAAG,UAAU,CAAA;;oBAC9C,QAAQ,GAAG,MAAM,CAAA;gBACtB,IAAI,UAAU,GAAsB,YAAY,IAAI,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACvF,yEAAyE;gBACzE,mEAAmE;gBACnE,wEAAwE;gBACxE,yEAAyE;gBACzE,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3E,QAAQ,GAAG,KAAK,CAAA;oBAChB,UAAU,GAAG,KAAK,CAAA;gBACpB,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,KAAK;oBACX,QAAQ;oBACR,OAAO,EAAE,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;oBACrF,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,KAAK;oBACf,sBAAsB,EAAE,YAAY,IAAI,kBAAkB;oBAC1D,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IACF,OAAO,QAAQ,CAAA;AACjB,CAAC"}
+{"version":3,"file":"SecurityScanner.scanners.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.scanners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEhE,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,eAAe,GAChB,MAAM,0BAA0B,CAAA;AAEjC;;;;;;GAMG;AACH,MAAM,iBAAiB,GACrB,8HAA8H,CAAA;AAEhI;;;;;;;;GAQG;AACH,MAAM,qBAAqB,GAAG,+DAA+D,CAAA;AAE7F,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC;gBAAE,SAAQ;YAC5C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC,CAAA;YACrF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;YAE9E,+EAA+E;YAC/E,kFAAkF;YAClF,6EAA6E;YAC7E,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9C,MAAM,MAAM,GAAG,aAAa,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAA;gBACzD,IAAI,CAAC,MAAM,IAAI,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAAE,SAAQ;YAChE,CAAC;YAED,gFAAgF;YAChF,qEAAqE;YACrE,IAAI,QAAqC,CAAA;YACzC,IAAI,YAAY,EAAE,CAAC;gBACjB,QAAQ,GAAG,QAAQ,CAAA;YACrB,CAAC;iBAAM,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;gBACxC,QAAQ,GAAG,cAAc,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA;YACxE,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,MAAM,CAAA;YACnB,CAAC;YACD,MAAM,UAAU,GAAsB,YAAY;gBAChD,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,QAAQ,KAAK,MAAM;oBACnB,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,QAAQ,CAAA;YAEd,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,QAAQ;gBACR,OAAO,EAAE,4CAA4C,OAAO,CAAC,MAAM,EAAE;gBACrE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;gBACrB,sBAAsB,EAAE,YAAY;gBACpC,UAAU;aACX,CAAC,CAAA;YACF,MAAK;QACP,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,2BAA2B,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;gBAEjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,oBAAoB;oBAC1B,QAAQ;oBACR,OAAO,EAAE,yCAAyC,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC7D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,oBAAoB;oBAC9B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;gBAEnD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,gBAAgB;oBACtB,QAAQ;oBACR,OAAO,EAAE,qCAAqC,KAAK,CAAC,CAAC,CAAC,GAAG;oBACzD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,gBAAgB;oBAC1B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,0BAA0B,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;gBAEjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,mBAAmB;oBACzB,QAAQ;oBACR,OAAO,EAAE,yCAAyC,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC7D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,mBAAmB;oBAC7B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,6BAA6B,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;gBAEnD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,sBAAsB;oBAC5B,QAAQ;oBACR,OAAO,EAAE,2CAA2C,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC/D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,sBAAsB;oBAChC,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,sEAAsE;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AACtE,iEAAiE;AACjE,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,CAAA"}

package/dist/src/security/scanner/index.d.ts

@@ -3,9 +3,10 @@
  *
  * Re-exports for security scanning functionality.
  */
-export type { SecurityFindingType, SecuritySeverity, SecurityFinding, RiskScoreBreakdown, ScanReport, ScannerOptions, } from './types.js';
+export type { SecurityFindingType, SecuritySeverity, SecurityFinding, RiskScoreBreakdown, ScanReport, ScannerOptions, HostileUpdateVerdict, } from './types.js';
 export { DEFAULT_ALLOWED_DOMAINS, SENSITIVE_PATH_PATTERNS, JAILBREAK_PATTERNS, SUSPICIOUS_PATTERNS, SOCIAL_ENGINEERING_PATTERNS, PROMPT_LEAKING_PATTERNS, DATA_EXFILTRATION_PATTERNS, PRIVILEGE_ESCALATION_PATTERNS, AI_DEFENCE_PATTERNS, SSRF_INSTRUCTION_PATTERNS, PII_PATTERNS, CODE_EXECUTION_PATTERNS, } from './patterns.js';
 export { SEVERITY_WEIGHTS, CATEGORY_WEIGHTS } from './weights.js';
 export { MAX_LINE_LENGTH_FOR_REGEX, safeRegexTest, safeRegexCheck } from './regex-utils.js';
 export { SecurityScanner, default } from './SecurityScanner.js';
+export { compareScanReports, DEFAULT_RISK_THRESHOLD } from './SecurityScanner.hostile-update.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/security/scanner/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,UAAU,EACV,cAAc,GACf,MAAM,YAAY,CAAA;AAGnB,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,mBAAmB,EACnB,yBAAyB,EACzB,YAAY,EACZ,uBAAuB,GACxB,MAAM,eAAe,CAAA;AAGtB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAGjE,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAG3F,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,UAAU,EACV,cAAc,EACd,oBAAoB,GACrB,MAAM,YAAY,CAAA;AAGnB,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,mBAAmB,EACnB,yBAAyB,EACzB,YAAY,EACZ,uBAAuB,GACxB,MAAM,eAAe,CAAA;AAGtB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAGjE,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAG3F,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAG/D,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAA"}

package/dist/src/security/scanner/index.js

@@ -11,4 +11,6 @@ export { SEVERITY_WEIGHTS, CATEGORY_WEIGHTS } from './weights.js';
 export { MAX_LINE_LENGTH_FOR_REGEX, safeRegexTest, safeRegexCheck } from './regex-utils.js';
 // Main class
 export { SecurityScanner, default } from './SecurityScanner.js';
+// Hostile-update comparator (SMI-5535, R0 Wave 2A)
+export { compareScanReports, DEFAULT_RISK_THRESHOLD } from './SecurityScanner.hostile-update.js';
 //# sourceMappingURL=index.js.map

package/dist/src/security/scanner/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/security/scanner/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAYH,mCAAmC;AACnC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,mBAAmB,EACnB,yBAAyB,EACzB,YAAY,EACZ,uBAAuB,GACxB,MAAM,eAAe,CAAA;AAEtB,kCAAkC;AAClC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAEjE,0CAA0C;AAC1C,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAE3F,aAAa;AACb,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/security/scanner/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAaH,mCAAmC;AACnC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,mBAAmB,EACnB,yBAAyB,EACzB,YAAY,EACZ,uBAAuB,GACxB,MAAM,eAAe,CAAA;AAEtB,kCAAkC;AAClC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAEjE,0CAA0C;AAC1C,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAE3F,aAAa;AACb,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAE/D,mDAAmD;AACnD,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAA"}

package/dist/src/security/scanner/patterns.d.ts

@@ -4,7 +4,9 @@
  * Pattern definitions for security scanning.
  */
 export declare const DEFAULT_ALLOWED_DOMAINS: string[];
+export declare const ENV_PATH_PATTERN: RegExp;
 export declare const SENSITIVE_PATH_PATTERNS: RegExp[];
+export declare const VALUE_GATED_KEYWORD_PATTERNS: ReadonlySet<RegExp>;
 export declare const JAILBREAK_PATTERNS: RegExp[];
 export declare const SUSPICIOUS_PATTERNS: RegExp[];
 /**

package/dist/src/security/scanner/patterns.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/patterns.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,eAAO,MAAM,uBAAuB,UAanC,CAAA;AAOD,eAAO,MAAM,uBAAuB,UAsBnC,CAAA;AAGD,eAAO,MAAM,kBAAkB,UAkB9B,CAAA;AAGD,eAAO,MAAM,mBAAmB,UAY/B,CAAA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,uBAAuB,UAanC,CAAA;AAGD,eAAO,MAAM,2BAA2B,UAavC,CAAA;AAGD,eAAO,MAAM,uBAAuB,UAenC,CAAA;AAGD,eAAO,MAAM,0BAA0B,UAuCtC,CAAA;AAGD,eAAO,MAAM,6BAA6B,UAkCzC,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,UAuBrC,CAAA;AAED;;;;;;;;;;;GAWG;AACH;;;;GAIG;AACH,eAAO,MAAM,YAAY,UAwBxB,CAAA;AAED,eAAO,MAAM,mBAAmB,UAwD/B,CAAA"}
+{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/patterns.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,eAAO,MAAM,uBAAuB,UAanC,CAAA;AA4BD,eAAO,MAAM,gBAAgB,QAAoE,CAAA;AAMjG,eAAO,MAAM,uBAAuB,UAsBnC,CAAA;AAID,eAAO,MAAM,4BAA4B,EAAE,WAAW,CAAC,MAAM,CAG3D,CAAA;AAGF,eAAO,MAAM,kBAAkB,UAkB9B,CAAA;AAGD,eAAO,MAAM,mBAAmB,UAY/B,CAAA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,uBAAuB,UAmBnC,CAAA;AAGD,eAAO,MAAM,2BAA2B,UAavC,CAAA;AAGD,eAAO,MAAM,uBAAuB,UAenC,CAAA;AAGD,eAAO,MAAM,0BAA0B,UA2DtC,CAAA;AAGD,eAAO,MAAM,6BAA6B,UA8CzC,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,UAuBrC,CAAA;AAED;;;;;;;;;;;GAWG;AACH;;;;GAIG;AACH,eAAO,MAAM,YAAY,UAwBxB,CAAA;AAED,eAAO,MAAM,mBAAmB,UAwD/B,CAAA"}