@spool-lab/redact 0.0.1 → 0.5.1

package/dist/detectors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"detectors.d.ts","sourceRoot":"","sources":["../src/detectors.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAiB,cAAc,EAAE,MAAM,YAAY,CAAA;AAoL/D;;;;6DAI6D;AAC7D,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,SAAU,GAAG,cAAc,EAAE,CAsCtF"}
+{"version":3,"file":"detectors.d.ts","sourceRoot":"","sources":["../src/detectors.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAiB,cAAc,EAAE,MAAM,YAAY,CAAA;AAgV/D;;;;6DAI6D;AAC7D,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,SAAU,GAAG,cAAc,EAAE,CAsCtF"}

package/dist/detectors.js

@@ -13,7 +13,7 @@
 // bare vendor api-keys so the whole assignment is masked, not just
 // the secret value. JWT runs before `Bearer` so a JWT-shaped bearer
 // surfaces as a JWT rather than a generic bearer wrapping a JWT.
-import { hasQuotedEntropy, luhnOk } from './validators.js';
+import { hasNonAsciiContent, hasPublicEnvPrefix, hasQuotedEntropy, isObviouslyNonSecretValue, isReservedDomain, isReservedIp, isVendorExampleKey, looksLikeImageAsset, looksLikePlaceholder, luhnOk, shannon, } from './validators.js';
 // ── Credential blocks (multi-line, highest specificity) ───────────
 // PEM-armoured key: header + base64 body + footer. Match runs to the
 // END footer (non-greedy across newlines) so the whole block — armor
@@ -101,7 +101,10 @@ const URL_CREDS_RX = /\b[a-z][a-z0-9+\-.]*:\/\/[^\s/@:"'`<>]+:[^\s/@:"'`<>]+@[A-
 const ENV_VAR_RX = /\b[A-Z][A-Z0-9_]{2,}(?:_KEY|_SECRET|_TOKEN|_PASSWORD|_PASSWD|_PWD|_API_?KEY|_DSN|_URL)\s*=\s*\S+/g;
 const GENERIC_SECRET_RX = /\b(?:api[_-]?key|secret|token|password|passwd|auth|access[_-]?key|client[_-]?secret|webhook)\b\s*[:=]\s*["']([A-Za-z0-9+/=_\-]{20,})["']/gi;
 // ── Identity ─────────────────────────────────────────────────────
-const CC_RX = /\b(?:4\d{3}|5[1-5]\d{2}|6(?:011|5\d{2})|3[47]\d{2}|3(?:0[0-5]|[68]\d)\d|(?:2131|1800|35\d{3}))[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{3,4}\b/g;
+// Lookbehind `(?<!\d\.)` rejects the fractional part of a decimal
+// number — e.g. `confidence: 0.5227687358856201` happens to be 16
+// digits starting with 5 and Luhn-valid, but it's a float, not a card.
+const CC_RX = /(?<!\d\.)\b(?:4\d{3}|5[1-5]\d{2}|6(?:011|5\d{2})|3[47]\d{2}|3(?:0[0-5]|[68]\d)\d|(?:2131|1800|35\d{3}))[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{3,4}\b/g;
 const SSN_RX = /\b(?!000|666|9\d{2})\d{3}-(?!00)\d{2}-(?!0000)\d{4}\b/g;
 const EMAIL_RX = /\b[A-Za-z0-9](?:[A-Za-z0-9._+-]*[A-Za-z0-9])?@[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?\.[A-Za-z]{2,}\b/g;
 const PHONE_RX = /(?:\+\d[\d .\-()]{7,16}\d|\(\d{2,4}\)[\d .\-]{6,14}\d)/g;
@@ -109,7 +112,12 @@ const IPV4_RX = /\b(?:(?:25[0-5]|2[0-4]\d|[01]?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|[
 // Permissive match; `validIPv6` below rejects look-alikes (timestamps,
 // short colon-separated number strings). Real IPv6 either uses the
 // compressed `::` marker or contains the full 8 groups.
-const IPV6_RX = /\b(?:[0-9a-fA-F]{1,4}:){2,7}[0-9a-fA-F]{1,4}\b|\b(?:[0-9a-fA-F]{1,4}:){1,7}:|\b(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}\b/g;
+//
+// Alternation order matters: try compressed forms (`hex:hex::hex`,
+// `hex:hex::`) FIRST so the greedy first alt doesn't gobble a 3-group
+// prefix of `2606:4700:4700::1111` and orphan the `::1111` tail. The
+// uncompressed full form goes last.
+const IPV6_RX = /\b(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}\b|\b(?:[0-9a-fA-F]{1,4}:){1,7}:|\b(?:[0-9a-fA-F]{1,4}:){2,7}[0-9a-fA-F]{1,4}\b/g;
 /** Distinguishes real IPv6 addresses from look-alikes the broad
  *  regex above also accepts. Timestamps like `12:22:57` and other
  *  short colon-separated decimal sequences must be rejected:
@@ -134,29 +142,175 @@ const ABSOLUTE_PATH_RX = /(?:\/Users\/|\/home\/|\/var\/|\/etc\/|\/opt\/|[A-Z]:\\
 // false-positive rate from a real-world scan with `.local` enabled.
 // The remaining TLDs (`.internal`, `.corp`, `.lan`, `.intra`,
 // `.home`, `.prod.*`, `.stg.*`) are unambiguous internal-DNS markers.
-const INTERNAL_HOST_RX = /\b[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)*\.(?:internal|corp|lan|intra|home|prod\.[a-z0-9]+|stg\.[a-z0-9]+)\b/gi;
+//
+// Case-sensitive (no `/i`): real DNS labels are conventionally
+// lowercase. Dropping the `i` flag means PascalCase property chains
+// like `SqlParser.internal` no longer match.
+const INTERNAL_HOST_RX = /\b[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)*\.(?:internal|corp|lan|intra|home|prod\.[a-z0-9]+|stg\.[a-z0-9]+)\b/g;
+// ── Per-rule validators (false-positive filters) ─────────────────
+//
+// Each validator runs after the regex matches. Returning false drops
+// the match before it becomes a finding. Composed from the shared
+// helpers in validators.ts; per-rule logic stays local to capture
+// the kind-specific shape (e.g. env-var has NAME=VALUE structure
+// that needs splitting before checking the value).
+/** env-var: NAME=VALUE assignment. Reject when name is a
+ *  public-by-convention prefix, value is a placeholder or already
+ *  redacted, value is a shell substitution (not a literal), or value
+ *  is a short JS string constant (`const FOO_KEY = 'app.storage.x'`,
+ *  not an env assignment). */
+function envVarLooksReal(value) {
+    const eqIdx = value.indexOf('=');
+    if (eqIdx < 0)
+        return false;
+    const name = value.slice(0, eqIdx).trim();
+    if (hasPublicEnvPrefix(name))
+        return false;
+    const raw = value.slice(eqIdx + 1).trim();
+    if (isObviouslyNonSecretValue(raw))
+        return false;
+    // Strip outer quotes / backticks so the value-only checks aren't
+    // fooled by `=""` or `='...'`.
+    const stripped = raw.replace(/^[`'"]+|[`'"]+$/g, '').trim();
+    if (stripped.length < 8)
+        return false;
+    // Shell substitution / variable reference — value is computed at
+    // runtime, the literal isn't actually leaked.
+    if (/^\$[({]|^\$\w/.test(stripped))
+        return false;
+    // Looks like a JS storage-key string constant: pure letters
+    // (any case, supports camelCase / SCREAMING_CASE keys) with
+    // dots/underscores/hyphens, NO digits, ≤ 28 chars. Real secrets
+    // have digits OR ≥ 32 chars, so the disjoint shape catches values
+    // like `'spool.shares.skeletonCount'` / `'theme_editor'` without
+    // rejecting a Stripe-style live key (has digits + ≥ 32 chars).
+    if (/^[a-zA-Z][a-zA-Z._\-]*$/.test(stripped) && stripped.length < 28)
+        return false;
+    // Natural-language placeholder text (CJK / Cyrillic / Hangul /
+    // Arabic / emoji) in the value. Real env-var secrets are always
+    // ASCII; non-ASCII content here is a description like
+    // `AGENT_INTERNAL_SECRET='你自己生成的一串随机密钥'`. Scoped to
+    // env-var only — see hasNonAsciiContent for why it's not in the
+    // shared isObviouslyNonSecretValue.
+    if (hasNonAsciiContent(stripped))
+        return false;
+    return true;
+}
+/** email: reject filenames (icon_16x16@2x.png), reserved/test
+ *  domains (example.com, RFC 2606). */
+function emailLooksReal(value) {
+    if (looksLikeImageAsset(value))
+        return false;
+    const atIdx = value.lastIndexOf('@');
+    if (atIdx < 0)
+        return false;
+    const domain = value.slice(atIdx + 1);
+    if (isReservedDomain(domain))
+        return false;
+    return true;
+}
+/** phone: country code can't start with 0 (ITU E.164). Digit count
+ *  in valid E.164 range. Also reject when the digit sequence is just
+ *  a year (4 digits at the end with year-like prefix). */
+function phoneLooksReal(value) {
+    if (/^\+0/.test(value))
+        return false;
+    const digits = value.replace(/\D/g, '');
+    if (digits.length < 7 || digits.length > 15)
+        return false;
+    return true;
+}
+/** ip: reject loopback, RFC 5737 docs ranges, RFC 3849 IPv6 doc
+ *  range, unspecified address, link-local. */
+function ipLooksReal(value) {
+    return !isReservedIp(value);
+}
+// Common web/build asset extensions that the `prod\.[a-z0-9]+` and
+// `stg\.[a-z0-9]+` alternatives of INTERNAL_HOST_RX collide with —
+// e.g. `runtime.prod.js`, `vendor.prod.css`. Bundler output, not a
+// hostname.
+const HOST_TAIL_FILE_EXTS = new Set([
+    'js', 'ts', 'tsx', 'jsx', 'mjs', 'cjs',
+    'css', 'scss', 'sass', 'less',
+    'json', 'jsonc', 'yaml', 'yml',
+    'html', 'htm', 'xml',
+    'map', 'wasm', 'md', 'txt', 'log',
+    'png', 'jpg', 'jpeg', 'gif', 'svg', 'webp', 'ico',
+]);
+/** internal-host: reject JS property chains the regex inadvertently
+ *  matches (`process.env.HOME`, `import.meta.home`) and bundler
+ *  output filenames matched by the loose `prod.*` / `stg.*` tail
+ *  (`runtime.prod.js`, `chunk.stg.css`). */
+function internalHostLooksReal(value) {
+    if (/^process\.env\./i.test(value))
+        return false;
+    if (/^import\.meta\./i.test(value))
+        return false;
+    if (/^window\.location\./i.test(value))
+        return false;
+    const lastDot = value.lastIndexOf('.');
+    if (lastDot >= 0 && HOST_TAIL_FILE_EXTS.has(value.slice(lastDot + 1).toLowerCase()))
+        return false;
+    return true;
+}
+/** Vendor api-key: AWS docs ship `AKIAIOSFODNN7EXAMPLE` literally —
+ *  block anything ending in EXAMPLE/SAMPLE/etc. */
+function apiKeyLooksReal(value) {
+    return !isVendorExampleKey(value);
+}
+/** Multi-line credential blobs (cloud-cred-ini, kubeconfig, netrc,
+ *  connection-string, url-creds, basic-auth, bearer) get the
+ *  generic "obviously non-secret" guard: rejects when the matched
+ *  block contains a redaction marker, ellipsis, or placeholder. */
+function credentialBlockLooksReal(value) {
+    if (isObviouslyNonSecretValue(value))
+        return false;
+    // AWS docs example key inside an ini block.
+    if (/AKIAIOSFODNN7EXAMPLE|wJalrXUtnFEMI/.test(value))
+        return false;
+    return true;
+}
+/** kubeconfig: token value should be high-entropy. The regex
+ *  captures `<field>: <value>` — the value is everything after the
+ *  colon. Reject if entropy is below ~3.5 (placeholder alphabets
+ *  like `abcdefghi…` clock in around 4.7 BUT have all-distinct chars
+ *  in a sequence — the entropy floor isn't enough alone). Also
+ *  block sequential alphabet / numeric placeholder values. */
+function kubeconfigTokenLooksReal(value) {
+    if (!credentialBlockLooksReal(value))
+        return false;
+    const colonIdx = value.indexOf(':');
+    if (colonIdx < 0)
+        return true;
+    const tokenValue = value.slice(colonIdx + 1).trim();
+    if (looksLikePlaceholder(tokenValue))
+        return false;
+    if (shannon(tokenValue) < 3.0)
+        return false;
+    return true;
+}
 const RULES = [
     { kind: 'private-key', rx: PEM_RX, confidence: 1.0 },
     { kind: 'ssh-key', rx: SSH_KEY_BODY_RX, confidence: 0.95 },
-    { kind: 'cloud-cred-ini', rx: AWS_INI_RX, confidence: 0.95 },
-    { kind: 'cloud-cred-ini', rx: GCLOUD_JSON_RX, confidence: 0.9 },
-    { kind: 'kubeconfig-token', rx: KUBECONFIG_RX, confidence: 0.85 },
-    { kind: 'netrc', rx: NETRC_RX, confidence: 0.95 },
-    { kind: 'connection-string', rx: CONN_STRING_RX, confidence: 0.9 },
-    { kind: 'url-creds', rx: URL_CREDS_RX, confidence: 0.95 },
-    { kind: 'basic-auth', rx: BASIC_AUTH_RX, confidence: 0.9 },
-    { kind: 'env-var', rx: ENV_VAR_RX, confidence: 0.9 },
+    { kind: 'cloud-cred-ini', rx: AWS_INI_RX, confidence: 0.95, validate: credentialBlockLooksReal },
+    { kind: 'cloud-cred-ini', rx: GCLOUD_JSON_RX, confidence: 0.9, validate: credentialBlockLooksReal },
+    { kind: 'kubeconfig-token', rx: KUBECONFIG_RX, confidence: 0.85, validate: kubeconfigTokenLooksReal },
+    { kind: 'netrc', rx: NETRC_RX, confidence: 0.95, validate: credentialBlockLooksReal },
+    { kind: 'connection-string', rx: CONN_STRING_RX, confidence: 0.9, validate: credentialBlockLooksReal },
+    { kind: 'url-creds', rx: URL_CREDS_RX, confidence: 0.95, validate: credentialBlockLooksReal },
+    { kind: 'basic-auth', rx: BASIC_AUTH_RX, confidence: 0.9, validate: credentialBlockLooksReal },
+    { kind: 'env-var', rx: ENV_VAR_RX, confidence: 0.9, validate: envVarLooksReal },
     { kind: 'generic-secret', rx: GENERIC_SECRET_RX, confidence: 0.6, validate: hasQuotedEntropy(4.0) },
     { kind: 'jwt', rx: JWT_RX, confidence: 0.95 },
-    { kind: 'api-key', rx: VENDOR_API_KEY_RX, confidence: 0.98 },
-    { kind: 'bearer', rx: BEARER_RX, confidence: 0.85 },
+    { kind: 'api-key', rx: VENDOR_API_KEY_RX, confidence: 0.98, validate: apiKeyLooksReal },
+    { kind: 'bearer', rx: BEARER_RX, confidence: 0.85, validate: credentialBlockLooksReal },
     { kind: 'credit-card', rx: CC_RX, confidence: 0.95, validate: luhnOk },
     { kind: 'ssn', rx: SSN_RX, confidence: 0.85 },
-    { kind: 'email', rx: EMAIL_RX, confidence: 0.85 },
-    { kind: 'phone', rx: PHONE_RX, confidence: 0.7 },
-    { kind: 'ip', rx: IPV4_RX, confidence: 0.55 },
-    { kind: 'ip', rx: IPV6_RX, confidence: 0.6, validate: validIPv6 },
-    { kind: 'internal-host', rx: INTERNAL_HOST_RX, confidence: 0.55 },
+    { kind: 'email', rx: EMAIL_RX, confidence: 0.85, validate: emailLooksReal },
+    { kind: 'phone', rx: PHONE_RX, confidence: 0.7, validate: phoneLooksReal },
+    { kind: 'ip', rx: IPV4_RX, confidence: 0.55, validate: ipLooksReal },
+    { kind: 'ip', rx: IPV6_RX, confidence: 0.6, validate: (v) => validIPv6(v) && ipLooksReal(v) },
+    { kind: 'internal-host', rx: INTERNAL_HOST_RX, confidence: 0.55, validate: internalHostLooksReal },
     { kind: 'absolute-path', rx: ABSOLUTE_PATH_RX, confidence: 0.75 },
 ];
 /** Synchronous regex-driven scan. Rules earlier in the priority list

package/dist/detectors.js.map

@@ -1 +1 @@
-{"version":3,"file":"detectors.js","sourceRoot":"","sources":["../src/detectors.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,mEAAmE;AACnE,oEAAoE;AACpE,kEAAkE;AAClE,sEAAsE;AACtE,EAAE;AACF,mEAAmE;AACnE,oEAAoE;AACpE,iEAAiE;AACjE,mEAAmE;AACnE,oEAAoE;AACpE,iEAAiE;AAGjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAW1D,qEAAqE;AAErE,qEAAqE;AACrE,qEAAqE;AACrE,gDAAgD;AAChD,MAAM,MAAM,GAAG,qJAAqJ,CAAA;AAEpK,gEAAgE;AAChE,qEAAqE;AACrE,mEAAmE;AACnE,yBAAyB;AACzB,MAAM,eAAe,GAAG,yCAAyC,CAAA;AAEjE,gEAAgE;AAChE,kEAAkE;AAClE,gEAAgE;AAChE,oEAAoE;AACpE,8CAA8C;AAC9C,MAAM,UAAU,GAAG,uGAAuG,CAAA;AAE1H,qEAAqE;AACrE,oEAAoE;AACpE,4EAA4E;AAC5E,gDAAgD;AAChD,MAAM,cAAc,GAAG,+EAA+E,CAAA;AAEtG,kEAAkE;AAClE,oEAAoE;AACpE,+DAA+D;AAC/D,+CAA+C;AAC/C,MAAM,aAAa,GAAG,wIAAwI,CAAA;AAE9J,sEAAsE;AACtE,2CAA2C;AAC3C,MAAM,QAAQ,GAAG,iDAAiD,CAAA;AAElE,oEAAoE;AACpE,+CAA+C;AAC/C,MAAM,cAAc,GAAG,gJAAgJ,CAAA;AAEvK,oEAAoE;AAEpE,MAAM,MAAM,GAAG,iEAAiE,CAAA;AAEhF,mEAAmE;AACnE,oEAAoE;AACpE,oEAAoE;AACpE,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAClC,QAAQ,GAAG;IACT,iBAAiB;IACjB,mCAAmC;IACnC,mCAAmC;IACnC,mCAAmC;IACnC,aAAa;IACb,2BAA2B;IAC3B,4BAA4B;IAC5B,mCAAmC;IACnC,qBAAqB;IACrB,gBAAgB;IAChB,2BAA2B;IAC3B,yBAAyB;IACzB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,uBAAuB;IACvB,2BAA2B;IAC3B,0BAA0B;IAC1B,wBAAwB;IACxB,qBAAqB;IACrB,yBAAyB;IACzB,aAAa;IACb,0BAA0B;IAC1B,6BAA6B;IAC7B,eAAe;IACf,8BAA8B;IAC9B,wBAAwB;IACxB,kDAAkD;IAClD,kBAAkB;IAClB,gBAAgB;IAChB,gBAAgB;IAChB,0BAA0B;IAC1B,mBAAmB;IACnB,qBAAqB;IACrB,8BAA8B;IAC9B,iBAAiB;IACjB,kBAAkB;IAClB,yBAAyB;IACzB,8BAA8B;CAC/B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,EAC3C,GAAG,CACJ,CAAA;AAED,MAAM,SAAS,GAAG,0CAA0C,CAAA;AAC5D,MAAM,aAAa,GAAG,2CAA2C,CAAA;AACjE,MAAM,YAAY,GAAG,oGAAoG,CAAA;AAEzH,kEAAkE;AAClE,8DAA8D;AAC9D,yCAAyC;AACzC,MAAM,UAAU,GAAG,mGAAmG,CAAA;AAEtH,MAAM,iBAAiB,GAAG,4IAA4I,CAAA;AAEtK,oEAAoE;AAEpE,MAAM,KAAK,GAAG,sIAAsI,CAAA;AACpJ,MAAM,MAAM,GAAG,wDAAwD,CAAA;AACvE,MAAM,QAAQ,GAAG,0GAA0G,CAAA;AAC3H,MAAM,QAAQ,GAAG,yDAAyD,CAAA;AAC1E,MAAM,OAAO,GAAG,8EAA8E,CAAA;AAC9F,uEAAuE;AACvE,mEAAmE;AACnE,wDAAwD;AACxD,MAAM,OAAO,GAAG,+HAA+H,CAAA;AAE/I;;;;;;;gEAOgE;AAChE,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACrC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAA;AACtC,CAAC;AAED,oEAAoE;AAEpE,MAAM,gBAAgB,GAAG,uFAAuF,CAAA;AAEhH,iEAAiE;AACjE,qCAAqC;AACrC,EAAE;AACF,mEAAmE;AACnE,wDAAwD;AACxD,8DAA8D;AAC9D,oEAAoE;AACpE,8DAA8D;AAC9D,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,8IAA8I,CAAA;AAEvK,MAAM,KAAK,GAAW;IACpB,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE;IACpD,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,IAAI,EAAE;IAC1D,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE;IAC5D,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,EAAE;IAC/D,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE;IACjE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE;IACjD,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,EAAE;IAClE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE;IACzD,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,EAAE;IAC1D,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE;IACpD,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE;IACnG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE;IAC7C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAE,IAAI,EAAE;IAC5D,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE;IACnD,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE;IACtE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE;IAC7C,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE;IACjD,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE;IAChD,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE;IAC7C,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE;IACjE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,gBAAgB,EAAE,UAAU,EAAE,IAAI,EAAE;IACjE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,gBAAgB,EAAE,UAAU,EAAE,IAAI,EAAE;CAClE,CAAA;AAED;;;;6DAI6D;AAC7D,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,YAAY,GAAG,OAAO;IAClE,MAAM,OAAO,GAAqB,EAAE,CAAA;IACpC,MAAM,OAAO,GAAqC,EAAE,CAAA;IACpD,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAA;IAE/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,EAAE,CAAC,SAAS,GAAG,CAAC,CAAA;QACrB,IAAI,CAAyB,CAAA;QAC7B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YAClB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAA;YACrB,MAAM,GAAG,GAAG,KAAK,GAAG,KAAK,CAAC,MAAM,CAAA;YAChC,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC,SAAS;oBAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAA;YAC7D,CAAC,CAAA;YACD,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,OAAO,EAAE,CAAA;gBACT,SAAQ;YACV,CAAC;YACD,IAAI,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;gBACzB,OAAO,EAAE,CAAA;gBACT,SAAQ;YACV,CAAC;YACD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,KAAK;gBACL,KAAK;gBACL,GAAG;gBACH,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,QAAQ,EAAE,YAAY;aACvB,CAAC,CAAA;YACF,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;YAC5B,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAA;IACzC,OAAO,OAAO,CAAA;AAChB,CAAC"}
+{"version":3,"file":"detectors.js","sourceRoot":"","sources":["../src/detectors.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,mEAAmE;AACnE,oEAAoE;AACpE,kEAAkE;AAClE,sEAAsE;AACtE,EAAE;AACF,mEAAmE;AACnE,oEAAoE;AACpE,iEAAiE;AACjE,mEAAmE;AACnE,oEAAoE;AACpE,iEAAiE;AAGjE,OAAO,EAGL,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,EACzB,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,MAAM,EACN,OAAO,GACR,MAAM,iBAAiB,CAAA;AAWxB,qEAAqE;AAErE,qEAAqE;AACrE,qEAAqE;AACrE,gDAAgD;AAChD,MAAM,MAAM,GAAG,qJAAqJ,CAAA;AAEpK,gEAAgE;AAChE,qEAAqE;AACrE,mEAAmE;AACnE,yBAAyB;AACzB,MAAM,eAAe,GAAG,yCAAyC,CAAA;AAEjE,gEAAgE;AAChE,kEAAkE;AAClE,gEAAgE;AAChE,oEAAoE;AACpE,8CAA8C;AAC9C,MAAM,UAAU,GAAG,uGAAuG,CAAA;AAE1H,qEAAqE;AACrE,oEAAoE;AACpE,4EAA4E;AAC5E,gDAAgD;AAChD,MAAM,cAAc,GAAG,+EAA+E,CAAA;AAEtG,kEAAkE;AAClE,oEAAoE;AACpE,+DAA+D;AAC/D,+CAA+C;AAC/C,MAAM,aAAa,GAAG,wIAAwI,CAAA;AAE9J,sEAAsE;AACtE,2CAA2C;AAC3C,MAAM,QAAQ,GAAG,iDAAiD,CAAA;AAElE,oEAAoE;AACpE,+CAA+C;AAC/C,MAAM,cAAc,GAAG,gJAAgJ,CAAA;AAEvK,oEAAoE;AAEpE,MAAM,MAAM,GAAG,iEAAiE,CAAA;AAEhF,mEAAmE;AACnE,oEAAoE;AACpE,oEAAoE;AACpE,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAClC,QAAQ,GAAG;IACT,iBAAiB;IACjB,mCAAmC;IACnC,mCAAmC;IACnC,mCAAmC;IACnC,aAAa;IACb,2BAA2B;IAC3B,4BAA4B;IAC5B,mCAAmC;IACnC,qBAAqB;IACrB,gBAAgB;IAChB,2BAA2B;IAC3B,yBAAyB;IACzB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,uBAAuB;IACvB,2BAA2B;IAC3B,0BAA0B;IAC1B,wBAAwB;IACxB,qBAAqB;IACrB,yBAAyB;IACzB,aAAa;IACb,0BAA0B;IAC1B,6BAA6B;IAC7B,eAAe;IACf,8BAA8B;IAC9B,wBAAwB;IACxB,kDAAkD;IAClD,kBAAkB;IAClB,gBAAgB;IAChB,gBAAgB;IAChB,0BAA0B;IAC1B,mBAAmB;IACnB,qBAAqB;IACrB,8BAA8B;IAC9B,iBAAiB;IACjB,kBAAkB;IAClB,yBAAyB;IACzB,8BAA8B;CAC/B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,EAC3C,GAAG,CACJ,CAAA;AAED,MAAM,SAAS,GAAG,0CAA0C,CAAA;AAC5D,MAAM,aAAa,GAAG,2CAA2C,CAAA;AACjE,MAAM,YAAY,GAAG,oGAAoG,CAAA;AAEzH,kEAAkE;AAClE,8DAA8D;AAC9D,yCAAyC;AACzC,MAAM,UAAU,GAAG,mGAAmG,CAAA;AAEtH,MAAM,iBAAiB,GAAG,4IAA4I,CAAA;AAEtK,oEAAoE;AAEpE,kEAAkE;AAClE,kEAAkE;AAClE,uEAAuE;AACvE,MAAM,KAAK,GAAG,+IAA+I,CAAA;AAC7J,MAAM,MAAM,GAAG,wDAAwD,CAAA;AACvE,MAAM,QAAQ,GAAG,0GAA0G,CAAA;AAC3H,MAAM,QAAQ,GAAG,yDAAyD,CAAA;AAC1E,MAAM,OAAO,GAAG,8EAA8E,CAAA;AAC9F,uEAAuE;AACvE,mEAAmE;AACnE,wDAAwD;AACxD,EAAE;AACF,mEAAmE;AACnE,sEAAsE;AACtE,qEAAqE;AACrE,oCAAoC;AACpC,MAAM,OAAO,GAAG,+HAA+H,CAAA;AAE/I;;;;;;;gEAOgE;AAChE,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACrC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAA;AACtC,CAAC;AAED,oEAAoE;AAEpE,MAAM,gBAAgB,GAAG,uFAAuF,CAAA;AAEhH,iEAAiE;AACjE,qCAAqC;AACrC,EAAE;AACF,mEAAmE;AACnE,wDAAwD;AACxD,8DAA8D;AAC9D,oEAAoE;AACpE,8DAA8D;AAC9D,sEAAsE;AACtE,EAAE;AACF,+DAA+D;AAC/D,oEAAoE;AACpE,6CAA6C;AAC7C,MAAM,gBAAgB,GAAG,6IAA6I,CAAA;AAEtK,oEAAoE;AACpE,EAAE;AACF,qEAAqE;AACrE,kEAAkE;AAClE,kEAAkE;AAClE,iEAAiE;AACjE,mDAAmD;AAEnD;;;;8BAI8B;AAC9B,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;IACzC,IAAI,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACzC,IAAI,yBAAyB,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IAChD,iEAAiE;IACjE,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAC3D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACrC,iEAAiE;IACjE,8CAA8C;IAC9C,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAA;IAChD,4DAA4D;IAC5D,4DAA4D;IAC5D,gEAAgE;IAChE,kEAAkE;IAClE,iEAAiE;IACjE,+DAA+D;IAC/D,IAAI,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAA;IAClF,+DAA+D;IAC/D,gEAAgE;IAChE,sDAAsD;IACtD,oDAAoD;IACpD,gEAAgE;IAChE,oCAAoC;IACpC,IAAI,kBAAkB,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAA;IAC9C,OAAO,IAAI,CAAA;AACb,CAAC;AAED;uCACuC;AACvC,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,mBAAmB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IACrC,IAAI,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IAC1C,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;0DAE0D;AAC1D,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACvC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAA;IACzD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;8CAC8C;AAC9C,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;AAC7B,CAAC;AAED,mEAAmE;AACnE,mEAAmE;AACnE,mEAAmE;AACnE,YAAY;AACZ,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;IACtC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC7B,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;IAC9B,MAAM,EAAE,KAAK,EAAE,KAAK;IACpB,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK;IACjC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK;CAClD,CAAC,CAAA;AAEF;;;4CAG4C;AAC5C,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAChD,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAChD,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACpD,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,OAAO,IAAI,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,KAAK,CAAA;IACjG,OAAO,IAAI,CAAA;AACb,CAAC;AAED;mDACmD;AACnD,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAA;AACnC,CAAC;AAED;;;mEAGmE;AACnE,SAAS,wBAAwB,CAAC,KAAa;IAC7C,IAAI,yBAAyB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAClD,4CAA4C;IAC5C,IAAI,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAClE,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;8DAK8D;AAC9D,SAAS,wBAAwB,CAAC,KAAa;IAC7C,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAClD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACnC,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7B,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACnD,IAAI,oBAAoB,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAA;IAClD,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG;QAAE,OAAO,KAAK,CAAA;IAC3C,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,KAAK,GAAW;IACpB,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE;IACpD,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,IAAI,EAAE;IAC1D,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,wBAAwB,EAAE;IAChG,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,wBAAwB,EAAE;IACnG,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,wBAAwB,EAAE;IACrG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,wBAAwB,EAAE;IACrF,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,wBAAwB,EAAE;IACtG,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,wBAAwB,EAAE;IAC7F,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,wBAAwB,EAAE;IAC9F,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,eAAe,EAAE;IAC/E,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE;IACnG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE;IAC7C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE;IACvF,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,wBAAwB,EAAE;IACvF,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE;IACtE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE;IAC7C,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE;IAC3E,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE;IAC1E,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE;IACpE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE;IAC7F,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,gBAAgB,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,qBAAqB,EAAE;IAClG,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,gBAAgB,EAAE,UAAU,EAAE,IAAI,EAAE;CAClE,CAAA;AAED;;;;6DAI6D;AAC7D,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,YAAY,GAAG,OAAO;IAClE,MAAM,OAAO,GAAqB,EAAE,CAAA;IACpC,MAAM,OAAO,GAAqC,EAAE,CAAA;IACpD,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAA;IAE/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,EAAE,CAAC,SAAS,GAAG,CAAC,CAAA;QACrB,IAAI,CAAyB,CAAA;QAC7B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YAClB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAA;YACrB,MAAM,GAAG,GAAG,KAAK,GAAG,KAAK,CAAC,MAAM,CAAA;YAChC,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC,SAAS;oBAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAA;YAC7D,CAAC,CAAA;YACD,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,OAAO,EAAE,CAAA;gBACT,SAAQ;YACV,CAAC;YACD,IAAI,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;gBACzB,OAAO,EAAE,CAAA;gBACT,SAAQ;YACV,CAAC;YACD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,KAAK;gBACL,KAAK;gBACL,GAAG;gBACH,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,QAAQ,EAAE,YAAY;aACvB,CAAC,CAAA;YACF,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;YAC5B,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAA;IACzC,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/index.d.ts

@@ -4,7 +4,8 @@ export { detectWithRegex } from './detectors.js';
 export { regexProvider, analyzeWith, } from './providers.js';
 export type { RedactProvider } from './providers.js';
 export { luhnOk, shannon, hashValueForRedactExclude } from './validators.js';
-export { maskValueByKind } from './mask.js';
+export { maskValueByKind, detectVendor } from './mask.js';
+export { rotationUrlForVendor, rotationUrlForToken } from './rotation.js';
 export { HIGH_SEVERITY_KINDS, INFO_SEVERITY_KINDS, severityOf } from './severity.js';
 export type { Severity } from './severity.js';
 import type { SensitiveGroup, SensitiveMatch } from './types.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,YAAY,EACV,aAAa,EACb,cAAc,EACd,cAAc,EACd,cAAc,GACf,MAAM,YAAY,CAAA;AAEnB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAEhD,OAAO,EACL,aAAa,EACb,WAAW,GACZ,MAAM,gBAAgB,CAAA;AAEvB,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEpD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAA;AAE5E,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAE3C,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AACpF,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAG7C,OAAO,KAAK,EAAE,cAAc,EAAiB,cAAc,EAAE,MAAM,YAAY,CAAA;AAG/E;;4CAE4C;AAC5C,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE,CAEnE;AAED;;;;;6CAK6C;AAC7C,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,cAAc,EAAE,CA6BhF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,YAAY,EACV,aAAa,EACb,cAAc,EACd,cAAc,EACd,cAAc,GACf,MAAM,YAAY,CAAA;AAEnB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAEhD,OAAO,EACL,aAAa,EACb,WAAW,GACZ,MAAM,gBAAgB,CAAA;AAEvB,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEpD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAA;AAE5E,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACzD,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAEzE,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AACpF,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAG7C,OAAO,KAAK,EAAE,cAAc,EAAiB,cAAc,EAAE,MAAM,YAAY,CAAA;AAG/E;;4CAE4C;AAC5C,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE,CAEnE;AAED;;;;;6CAK6C;AAC7C,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,cAAc,EAAE,CA6BhF"}

package/dist/index.js

@@ -12,7 +12,8 @@ export { SENSITIVE_KIND_LABEL, SENSITIVE_KIND_ORDER, } from './types.js';
 export { detectWithRegex } from './detectors.js';
 export { regexProvider, analyzeWith, } from './providers.js';
 export { luhnOk, shannon, hashValueForRedactExclude } from './validators.js';
-export { maskValueByKind } from './mask.js';
+export { maskValueByKind, detectVendor } from './mask.js';
+export { rotationUrlForVendor, rotationUrlForToken } from './rotation.js';
 export { HIGH_SEVERITY_KINDS, INFO_SEVERITY_KINDS, severityOf } from './severity.js';
 import { detectWithRegex } from './detectors.js';
 import { SENSITIVE_KIND_ORDER } from './types.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,EAAE;AACF,YAAY;AACZ,4DAA4D;AAC5D,gEAAgE;AAChE,oEAAoE;AACpE,6DAA6D;AAC7D,EAAE;AACF,oEAAoE;AACpE,iDAAiD;AASjD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAEhD,OAAO,EACL,aAAa,EACb,WAAW,GACZ,MAAM,gBAAgB,CAAA;AAIvB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAA;AAE5E,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAE3C,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAGpF,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAEhD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEjD;;4CAE4C;AAC5C,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,eAAe,CAAC,IAAI,CAAC,CAAA;AAC9B,CAAC;AAED;;;;;6CAK6C;AAC7C,MAAM,UAAU,oBAAoB,CAAC,OAAyB;IAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmC,CAAA;IACzD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;QACrC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACZ,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC1B,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;QACpB,uDAAuD;QACvD,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;QACxC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;YAC7B,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;YACxB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;YAC5B,CAAC;QACH,CAAC;QACD,OAAO;YACL,IAAI;YACJ,KAAK,EAAE,IAAI,CAAC,MAAM;YAClB,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC;YAC/D,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;SACvE,CAAA;IACH,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;AAChG,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,EAAE;AACF,YAAY;AACZ,4DAA4D;AAC5D,gEAAgE;AAChE,oEAAoE;AACpE,6DAA6D;AAC7D,EAAE;AACF,oEAAoE;AACpE,iDAAiD;AASjD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAEhD,OAAO,EACL,aAAa,EACb,WAAW,GACZ,MAAM,gBAAgB,CAAA;AAIvB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAA;AAE5E,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACzD,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAEzE,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAGpF,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAEhD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEjD;;4CAE4C;AAC5C,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,eAAe,CAAC,IAAI,CAAC,CAAA;AAC9B,CAAC;AAED;;;;;6CAK6C;AAC7C,MAAM,UAAU,oBAAoB,CAAC,OAAyB;IAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmC,CAAA;IACzD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;QACrC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACZ,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC1B,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;QACpB,uDAAuD;QACvD,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;QACxC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;YAC7B,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;YACxB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;YAC5B,CAAC;QACH,CAAC;QACD,OAAO;YACL,IAAI;YACJ,KAAK,EAAE,IAAI,CAAC,MAAM;YAClB,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC;YAC/D,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;SACvE,CAAA;IACH,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;AAChG,CAAC"}

package/dist/mask.d.ts

@@ -3,4 +3,8 @@ import type { SensitiveKind } from './types.js';
  *  `kind` is loosely typed so synthetic categories (author names,
  *  manual entries) also get a sensible default. */
 export declare function maskValueByKind(value: string, kind: SensitiveKind | string): string;
+/** Recognise the vendor behind a token by its prefix. Returns null
+ *  when the prefix isn't one we've codified — the caller falls
+ *  back to a generic `[redacted API key]` mask. */
+export declare function detectVendor(token: string): string | null;
 //# sourceMappingURL=mask.d.ts.map

package/dist/mask.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mask.d.ts","sourceRoot":"","sources":["../src/mask.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C;;mDAEmD;AACnD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,MAAM,GAAG,MAAM,CA0GnF"}
+{"version":3,"file":"mask.d.ts","sourceRoot":"","sources":["../src/mask.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C;;mDAEmD;AACnD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,MAAM,GAAG,MAAM,CA0GnF;AAED;;mDAEmD;AACnD,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA0BzD"}

package/dist/mask.js

@@ -123,7 +123,7 @@ export function maskValueByKind(value, kind) {
 /** Recognise the vendor behind a token by its prefix. Returns null
  *  when the prefix isn't one we've codified — the caller falls
  *  back to a generic `[redacted API key]` mask. */
-function detectVendor(token) {
+export function detectVendor(token) {
     if (/^sk_(live|test)_/.test(token))
         return 'Stripe';
     if (/^(rk|pk)_(live|test)_/.test(token))

package/dist/mask.js.map

@@ -1 +1 @@
-{"version":3,"file":"mask.js","sourceRoot":"","sources":["../src/mask.ts"],"names":[],"mappings":"AAAA,4BAA4B;AAC5B,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,gEAAgE;AAChE,mEAAmE;AACnE,kEAAkE;AAClE,EAAE;AACF,oEAAoE;AACpE,wDAAwD;AACxD,2DAA2D;AAC3D,6DAA6D;AAC7D,8DAA8D;AAC9D,EAAE;AACF,oEAAoE;AACpE,oEAAoE;AACpE,gEAAgE;AAChE,kEAAkE;AAClE,kEAAkE;AAClE,6BAA6B;AAI7B;;mDAEmD;AACnD,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,IAA4B;IACzE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,aAAa;YAChB,OAAO,2BAA2B,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAA;QAChE,KAAK,SAAS;YACZ,OAAO,uBAAuB,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAA;QAE5D,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;YAClC,OAAO,MAAM,CAAC,CAAC,CAAC,cAAc,MAAM,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAA;QACpE,CAAC;QACD,KAAK,KAAK;YACR,OAAO,gBAAgB,CAAA;QAEzB,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,IAAI,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,4BAA4B,CAAA;YACpF,IAAI,2CAA2C,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,+BAA+B,CAAA;YACnG,OAAO,8BAA8B,CAAA;QACvC,CAAC;QACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;YACxC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,6BAA6B,CAAA;QAClE,CAAC;QACD,KAAK,OAAO;YACV,OAAO,yDAAyD,CAAA;QAElE,KAAK,mBAAmB,CAAC,CAAC,CAAC;YACzB,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAA;YACpD,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,8BAA8B,CAAA;QACpE,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAA;YAC/E,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAA;QACpF,CAAC;QAED,KAAK,QAAQ;YACX,OAAO,mBAAmB,CAAA;QAC5B,KAAK,YAAY;YACf,OAAO,kBAAkB,CAAA;QAE3B,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,+DAA+D;YAC/D,6DAA6D;YAC7D,sCAAsC;YACtC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAA;YAC/C,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,oBAAoB,CAAA;QACxD,CAAC;QACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,+DAA+D;YAC/D,+DAA+D;YAC/D,YAAY;YACZ,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAA;YACpD,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB,CAAA;QACxD,CAAC;QAED,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;YACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAA;YACxC,OAAO,kBAAkB,KAAK,EAAE,CAAA;QAClC,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;YAC7B,OAAO,UAAU,KAAK,EAAE,CAAA;QAC1B,CAAC;QAED,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC7B,IAAI,EAAE,IAAI,CAAC;gBAAE,OAAO,kBAAkB,CAAA;YACtC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;YAClC,+DAA+D;YAC/D,+DAA+D;YAC/D,OAAO,GAAG,KAAK,OAAO,MAAM,EAAE,CAAA;QAChC,CAAC;QACD,KAAK,OAAO;YACV,OAAO,kBAAkB,CAAA;QAE3B,KAAK,aAAa;YAChB,OAAO,iBAAiB,CAAA;QAC1B,KAAK,gBAAgB;YACnB,OAAO,oBAAoB,CAAA;QAC7B,KAAK,eAAe;YAClB,OAAO,gBAAgB,CAAA;QAEzB,KAAK,IAAI;YACP,+DAA+D;YAC/D,mDAAmD;YACnD,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAA;QACpE,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAA;YAC1D,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,0BAA0B,CAAA;QAC9D,CAAC;QACD,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAA;YACtF,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAA;QACpD,CAAC;QAED,2DAA2D;QAC3D,KAAK,kBAAkB;YACrB,OAAO,iBAAiB,CAAA;QAC1B,KAAK,kBAAkB;YACrB,OAAO,YAAY,CAAA;QAErB;YACE,OAAO,YAAY,CAAA;IACvB,CAAC;AACH,CAAC;AAED;;mDAEmD;AACnD,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IACnD,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IACxD,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAA;IAC9C,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC5C,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IACvC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,cAAc,CAAA;IAC7C,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC9C,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC1C,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC5C,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IACxC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC1C,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAA;IACrD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAA;IAC1C,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACjD,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC9C,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC9C,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC3C,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACrC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAA;IACvC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,cAAc,CAAA;IACjD,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IAChD,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAA;IAC9C,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAA;IACjD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAA;IAC5C,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,CAAC,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,IAAI,CAAA;IAC7B,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAA;IACzD,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAA;AAC/C,CAAC"}
+{"version":3,"file":"mask.js","sourceRoot":"","sources":["../src/mask.ts"],"names":[],"mappings":"AAAA,4BAA4B;AAC5B,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,gEAAgE;AAChE,mEAAmE;AACnE,kEAAkE;AAClE,EAAE;AACF,oEAAoE;AACpE,wDAAwD;AACxD,2DAA2D;AAC3D,6DAA6D;AAC7D,8DAA8D;AAC9D,EAAE;AACF,oEAAoE;AACpE,oEAAoE;AACpE,gEAAgE;AAChE,kEAAkE;AAClE,kEAAkE;AAClE,6BAA6B;AAI7B;;mDAEmD;AACnD,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,IAA4B;IACzE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,aAAa;YAChB,OAAO,2BAA2B,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAA;QAChE,KAAK,SAAS;YACZ,OAAO,uBAAuB,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAA;QAE5D,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;YAClC,OAAO,MAAM,CAAC,CAAC,CAAC,cAAc,MAAM,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAA;QACpE,CAAC;QACD,KAAK,KAAK;YACR,OAAO,gBAAgB,CAAA;QAEzB,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,IAAI,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,4BAA4B,CAAA;YACpF,IAAI,2CAA2C,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,+BAA+B,CAAA;YACnG,OAAO,8BAA8B,CAAA;QACvC,CAAC;QACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;YACxC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,6BAA6B,CAAA;QAClE,CAAC;QACD,KAAK,OAAO;YACV,OAAO,yDAAyD,CAAA;QAElE,KAAK,mBAAmB,CAAC,CAAC,CAAC;YACzB,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAA;YACpD,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,8BAA8B,CAAA;QACpE,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAA;YAC/E,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAA;QACpF,CAAC;QAED,KAAK,QAAQ;YACX,OAAO,mBAAmB,CAAA;QAC5B,KAAK,YAAY;YACf,OAAO,kBAAkB,CAAA;QAE3B,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,+DAA+D;YAC/D,6DAA6D;YAC7D,sCAAsC;YACtC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAA;YAC/C,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,oBAAoB,CAAA;QACxD,CAAC;QACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,+DAA+D;YAC/D,+DAA+D;YAC/D,YAAY;YACZ,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAA;YACpD,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB,CAAA;QACxD,CAAC;QAED,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;YACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAA;YACxC,OAAO,kBAAkB,KAAK,EAAE,CAAA;QAClC,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;YAC7B,OAAO,UAAU,KAAK,EAAE,CAAA;QAC1B,CAAC;QAED,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC7B,IAAI,EAAE,IAAI,CAAC;gBAAE,OAAO,kBAAkB,CAAA;YACtC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;YAClC,+DAA+D;YAC/D,+DAA+D;YAC/D,OAAO,GAAG,KAAK,OAAO,MAAM,EAAE,CAAA;QAChC,CAAC;QACD,KAAK,OAAO;YACV,OAAO,kBAAkB,CAAA;QAE3B,KAAK,aAAa;YAChB,OAAO,iBAAiB,CAAA;QAC1B,KAAK,gBAAgB;YACnB,OAAO,oBAAoB,CAAA;QAC7B,KAAK,eAAe;YAClB,OAAO,gBAAgB,CAAA;QAEzB,KAAK,IAAI;YACP,+DAA+D;YAC/D,mDAAmD;YACnD,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAA;QACpE,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAA;YAC1D,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,0BAA0B,CAAA;QAC9D,CAAC;QACD,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAA;YACtF,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAA;QACpD,CAAC;QAED,2DAA2D;QAC3D,KAAK,kBAAkB;YACrB,OAAO,iBAAiB,CAAA;QAC1B,KAAK,kBAAkB;YACrB,OAAO,YAAY,CAAA;QAErB;YACE,OAAO,YAAY,CAAA;IACvB,CAAC;AACH,CAAC;AAED;;mDAEmD;AACnD,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IACnD,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IACxD,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAA;IAC9C,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC5C,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IACvC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,cAAc,CAAA;IAC7C,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC9C,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC1C,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC5C,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IACxC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC1C,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAA;IACrD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAA;IAC1C,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACjD,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC9C,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC9C,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC3C,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACrC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAA;IACvC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,cAAc,CAAA;IACjD,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IAChD,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAA;IAC9C,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAA;IACjD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAA;IAC5C,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,CAAC,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,IAAI,CAAA;IAC7B,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAA;IACzD,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAA;AAC/C,CAAC"}

package/dist/rotation.d.ts

@@ -0,0 +1,12 @@
+import { detectVendor } from './mask.js';
+export { detectVendor };
+/** Map a vendor name (as returned by {@link detectVendor}) to the
+ *  vendor's official key-management / rotation page. Returns null when
+ *  we don't have a verified URL for that vendor — the caller falls
+ *  back to the plain rotate reminder. */
+export declare function rotationUrlForVendor(vendor: string | null): string | null;
+/** Convenience: resolve the rotation URL directly from a raw token,
+ *  combining {@link detectVendor} + {@link rotationUrlForVendor}.
+ *  Returns null when the vendor is unknown or has no verified URL. */
+export declare function rotationUrlForToken(token: string): string | null;
+//# sourceMappingURL=rotation.d.ts.map

package/dist/rotation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation.d.ts","sourceRoot":"","sources":["../src/rotation.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAExC,OAAO,EAAE,YAAY,EAAE,CAAA;AAEvB;;;yCAGyC;AACzC,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAGzE;AAED;;sEAEsE;AACtE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEhE"}

package/dist/rotation.js

@@ -0,0 +1,75 @@
+// Vendor → rotation deep-link registry.
+//
+// When a detected credential resolves to a known vendor, the Security
+// surfaces offer a "Rotate this key ↗" affordance that opens the
+// vendor's own key-management page. Rotating at the SOURCE is the only
+// action that actually closes the leak — Spool's purge merely masks
+// its own copy.
+//
+// URLs drift, so every entry below was verified against the vendor's
+// current official docs (see the inline source on each line). Any
+// vendor `detectVendor` recognises but for which no stable, verified
+// self-service rotation URL exists is deliberately OMITTED — the
+// caller then falls back to the generic rotate-reminder text rather
+// than shipping a guessed (and likely wrong) link.
+import { detectVendor } from './mask.js';
+export { detectVendor };
+/** Map a vendor name (as returned by {@link detectVendor}) to the
+ *  vendor's official key-management / rotation page. Returns null when
+ *  we don't have a verified URL for that vendor — the caller falls
+ *  back to the plain rotate reminder. */
+export function rotationUrlForVendor(vendor) {
+    if (!vendor)
+        return null;
+    return ROTATION_URLS[vendor] ?? null;
+}
+/** Convenience: resolve the rotation URL directly from a raw token,
+ *  combining {@link detectVendor} + {@link rotationUrlForVendor}.
+ *  Returns null when the vendor is unknown or has no verified URL. */
+export function rotationUrlForToken(token) {
+    return rotationUrlForVendor(detectVendor(token));
+}
+// Verified 2026-05-26 against each vendor's official docs / console.
+const ROTATION_URLS = {
+    // docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html
+    // → IAM console, user "Security credentials" tab (self-managed keys).
+    AWS: 'https://console.aws.amazon.com/iam/home#/security_credentials',
+    // docs.github.com/.../managing-your-personal-access-tokens → github.com/settings/tokens
+    GitHub: 'https://github.com/settings/tokens',
+    // help.openai.com "Where do I find my OpenAI API Key" → platform.openai.com/api-keys
+    OpenAI: 'https://platform.openai.com/api-keys',
+    // Anthropic Console → Settings → API keys (console.anthropic.com/settings/keys)
+    Anthropic: 'https://console.anthropic.com/settings/keys',
+    // docs.stripe.com/keys → live-mode API keys tab (dashboard.stripe.com/apikeys)
+    Stripe: 'https://dashboard.stripe.com/apikeys',
+    // huggingface.co/docs/hub/security-tokens → huggingface.co/settings/tokens
+    'Hugging Face': 'https://huggingface.co/settings/tokens',
+    // cloud.google.com/docs/authentication/api-keys → APIs & Services → Credentials
+    Google: 'https://console.cloud.google.com/apis/credentials',
+    // api.slack.com/apps → Slack "Your Apps" (OAuth & Permissions per app)
+    Slack: 'https://api.slack.com/apps',
+    // docs.gitlab.com/user/profile/personal_access_tokens/ → User settings → Access tokens
+    GitLab: 'https://gitlab.com/-/user_settings/personal_access_tokens',
+    // docs.npmjs.com/creating-and-viewing-access-tokens. `~` is npm's
+    // username placeholder → resolves to the logged-in user's tokens page.
+    // Plain `/settings` lands on the unrelated "settings" PACKAGE.
+    npm: 'https://www.npmjs.com/settings/~/tokens',
+    // docs.digitalocean.com/reference/api/create-personal-access-token/
+    DigitalOcean: 'https://cloud.digitalocean.com/account/api/tokens',
+    // vercel.com/kb/guide/how-do-i-use-a-vercel-api-access-token → vercel.com/account/tokens
+    Vercel: 'https://vercel.com/account/tokens',
+    // developers.cloudflare.com/fundamentals/api/get-started/create-token/ → My Profile → API Tokens
+    Cloudflare: 'https://dash.cloudflare.com/profile/api-tokens',
+    // twilio.com/docs/iam/api-keys/keys-in-console → Console API keys page
+    Twilio: 'https://console.twilio.com/us1/account/keys-credentials/api-keys',
+    // twilio.com/docs/sendgrid/ui/account-and-settings/api-keys → app.sendgrid.com/settings/api_keys
+    SendGrid: 'https://app.sendgrid.com/settings/api_keys',
+    // docs.docker.com/security/access-tokens/ → Account settings → Personal access tokens
+    'Docker Hub': 'https://app.docker.com/settings/personal-access-tokens',
+    // pypi.org/help/#apitoken → Account settings → API tokens
+    PyPI: 'https://pypi.org/manage/account/token/',
+    // OMITTED (no stable verified self-service URL): Mailgun, Square,
+    // Databricks (per-workspace host). detectVendor still recognises
+    // them for masking; rotation falls back to the reminder text.
+};
+//# sourceMappingURL=rotation.js.map

package/dist/rotation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation.js","sourceRoot":"","sources":["../src/rotation.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,sEAAsE;AACtE,iEAAiE;AACjE,uEAAuE;AACvE,oEAAoE;AACpE,gBAAgB;AAChB,EAAE;AACF,qEAAqE;AACrE,kEAAkE;AAClE,qEAAqE;AACrE,iEAAiE;AACjE,oEAAoE;AACpE,mDAAmD;AAEnD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAExC,OAAO,EAAE,YAAY,EAAE,CAAA;AAEvB;;;yCAGyC;AACzC,MAAM,UAAU,oBAAoB,CAAC,MAAqB;IACxD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,IAAI,CAAA;AACtC,CAAC;AAED;;sEAEsE;AACtE,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAO,oBAAoB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAA;AAClD,CAAC;AAED,qEAAqE;AACrE,MAAM,aAAa,GAA2B;IAC5C,2EAA2E;IAC3E,sEAAsE;IACtE,GAAG,EAAE,+DAA+D;IACpE,wFAAwF;IACxF,MAAM,EAAE,oCAAoC;IAC5C,qFAAqF;IACrF,MAAM,EAAE,sCAAsC;IAC9C,gFAAgF;IAChF,SAAS,EAAE,6CAA6C;IACxD,+EAA+E;IAC/E,MAAM,EAAE,sCAAsC;IAC9C,2EAA2E;IAC3E,cAAc,EAAE,wCAAwC;IACxD,gFAAgF;IAChF,MAAM,EAAE,mDAAmD;IAC3D,uEAAuE;IACvE,KAAK,EAAE,4BAA4B;IACnC,uFAAuF;IACvF,MAAM,EAAE,2DAA2D;IACnE,kEAAkE;IAClE,uEAAuE;IACvE,+DAA+D;IAC/D,GAAG,EAAE,yCAAyC;IAC9C,oEAAoE;IACpE,YAAY,EAAE,mDAAmD;IACjE,yFAAyF;IACzF,MAAM,EAAE,mCAAmC;IAC3C,iGAAiG;IACjG,UAAU,EAAE,gDAAgD;IAC5D,uEAAuE;IACvE,MAAM,EAAE,kEAAkE;IAC1E,iGAAiG;IACjG,QAAQ,EAAE,4CAA4C;IACtD,sFAAsF;IACtF,YAAY,EAAE,wDAAwD;IACtE,0DAA0D;IAC1D,IAAI,EAAE,wCAAwC;IAC9C,kEAAkE;IAClE,iEAAiE;IACjE,8DAA8D;CAC/D,CAAA"}

package/dist/validators.d.ts

@@ -22,4 +22,29 @@ export declare function shannon(s: string): number;
  *  string is expected to be a "keyword = value" capture; we pull the
  *  quoted body so we don't include the key name in the entropy. */
 export declare function hasQuotedEntropy(min: number): (value: string) => boolean;
+export declare function containsRedactionMarker(value: string): boolean;
+/** Visual ellipsis (`…` or `...`) — the original value was truncated
+ *  in the middle, so the substring we're holding isn't actually the
+ *  secret even if the surrounding shape looks credential-like. */
+export declare function containsEllipsis(value: string): boolean;
+export declare function looksLikePlaceholder(value: string): boolean;
+export declare function isReservedDomain(domain: string): boolean;
+/** macOS icon assets (`icon_16x16@2x.png`), Sketch / Figma exports,
+ *  Slack emoji files — all contain `@N x` style suffixes that the
+ *  email regex matches. Reject when the trailing token is a known
+ *  image extension. */
+export declare function looksLikeImageAsset(value: string): boolean;
+export declare function hasPublicEnvPrefix(name: string): boolean;
+/** AWS / vendor "this is the documentation key" patterns. AWS' own
+ *  IAM docs use `AKIAIOSFODNN7EXAMPLE` + `wJalrXUtnFEMI/K7MDENG/…EXAMPLEKEY`
+ *  literally in every tutorial. Treat any vendor key ending in
+ *  EXAMPLE / SAMPLE / DEMO / YOUR_KEY as a non-secret. */
+export declare function isVendorExampleKey(value: string): boolean;
+/** Composite filter used by every text-credential rule. */
+export declare function isObviouslyNonSecretValue(value: string): boolean;
+export declare function hasNonAsciiContent(value: string): boolean;
+/** Non-routable / documentation IP ranges that aren't real network
+ *  endpoints — loopback, RFC 5737 doc ranges, RFC 3849 IPv6 doc
+ *  range, unspecified address, link-local. */
+export declare function isReservedIp(value: string): boolean;
 //# sourceMappingURL=validators.d.ts.map

package/dist/validators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../src/validators.ts"],"names":[],"mappings":"AASA;;iDAEiD;AACjD,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAe7C;AAED;;;;;;;;;;iDAUiD;AACjD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAU/D;AAED;;4DAE4D;AAC5D,wBAAgB,OAAO,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAWzC;AAED;;mEAEmE;AACnE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAKxE"}
+{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../src/validators.ts"],"names":[],"mappings":"AASA;;iDAEiD;AACjD,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAe7C;AAED;;;;;;;;;;iDAUiD;AACjD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAU/D;AAED;;4DAE4D;AAC5D,wBAAgB,OAAO,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAWzC;AAED;;mEAEmE;AACnE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAKxE;AAkBD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;kEAEkE;AAClE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEvD;AAeD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE3D;AAYD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;uBAGuB;AACvB,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE1D;AAQD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;0DAG0D;AAC1D,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,2DAA2D;AAC3D,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAIhE;AAWD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;8CAE8C;AAC9C,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAgBnD"}

package/dist/validators.js

@@ -75,4 +75,122 @@ export function hasQuotedEntropy(min) {
         return shannon(inner) >= min;
     };
 }
+// ── Shared false-positive filters ─────────────────────────────────
+//
+// Every regex below is a "this string says I am NOT a real secret"
+// signal — extracted into one place so per-rule validators read as a
+// composition of intent ("env-var that isn't placeholder, redacted,
+// or a public-prefix") instead of bespoke patchwork. Empirical: most
+// scan-induced noise on real chat content is one of these four:
+//   1. user manually redacted before paste (`[redacted]`, `…`)
+//   2. vendor docs example (AWS `AKIAIOSFODNN7EXAMPLE`)
+//   3. JS code matching the env shape (`const FOO_KEY = 'string'`)
+//   4. value is a placeholder (`xxxx`, `your_token`, `password`)
+/** "[redacted]" / "<redacted>" / "[SECRET:…]" / "【已隐藏】" — set by a
+ *  user or an upstream tool to flag the literal was scrubbed. */
+const REDACTION_MARKER_RX = /\[(?:redacted|hidden|secret|removed|masked)(?::[^\]]*)?\]|<(?:redacted|hidden)>|【已?隐藏】/i;
+export function containsRedactionMarker(value) {
+    return REDACTION_MARKER_RX.test(value);
+}
+/** Visual ellipsis (`…` or `...`) — the original value was truncated
+ *  in the middle, so the substring we're holding isn't actually the
+ *  secret even if the surrounding shape looks credential-like. */
+export function containsEllipsis(value) {
+    return /…|\.\.\./.test(value);
+}
+/** Self-evidently-fake placeholder values: `xxxx-xxxx-xxxx`, repeated
+ *  chars, `<your-key>`, `letmein`, `hunter2`, alphabet-sequence dumps. */
+const PLACEHOLDER_PATTERNS = [
+    /^[xX]+(?:[-_ ][xX]+)*$/, // xxxx, xxxx-xxxx
+    /^(.)\1{4,}$/, // 5+ repeats: aaaaa, 00000
+    /^<[a-zA-Z0-9_\-\s]+>$/, // <YOUR_TOKEN>
+    /\byour[_-]?(?:secret|key|token|password|api[_-]?key)\b/i,
+    /\b(?:placeholder|todo|fixme|example|sample|dummy|fake|test[_-]?value)\b/i,
+    /^(?:letmein|changeme|password|passwd|hunter2|123456|qwerty|abc123|admin)$/i,
+    /^abcdefghijklmnopqrstuvwxyz/, // alphabet dumps
+    /^0?123456789/, // sequential digits
+];
+export function looksLikePlaceholder(value) {
+    return PLACEHOLDER_PATTERNS.some((rx) => rx.test(value));
+}
+/** Strict union of (a) IETF/IANA reserved example/test labels and
+ *  (b) generic "fake company" domains that show up constantly in
+ *  documentation. Source: RFC 2606 + RFC 6761. */
+const RESERVED_DOMAINS = new Set([
+    'example.com', 'example.net', 'example.org', 'example.edu',
+    'test.com', 'test.net', 'test.org', 'invalid', 'localhost', 'example', 'test',
+    'company.com', 'mycompany.com', 'yourcompany.com', 'yourdomain.com', 'mydomain.com',
+    'domain.com', 'domain.net', 'foo.com', 'bar.com', 'foobar.com',
+]);
+export function isReservedDomain(domain) {
+    return RESERVED_DOMAINS.has(domain.toLowerCase());
+}
+/** macOS icon assets (`icon_16x16@2x.png`), Sketch / Figma exports,
+ *  Slack emoji files — all contain `@N x` style suffixes that the
+ *  email regex matches. Reject when the trailing token is a known
+ *  image extension. */
+export function looksLikeImageAsset(value) {
+    return /\.(?:png|jpe?g|gif|webp|svg|bmp|ico|tiff?|heic|avif)$/i.test(value);
+}
+/** Public-by-convention env-var prefixes. Frameworks intentionally
+ *  bundle these to the client / commit them to repos:
+ *    NEXT_PUBLIC_*, VITE_*, REACT_APP_*, NUXT_PUBLIC_*, EXPO_PUBLIC_*,
+ *    GATSBY_*, VUE_APP_*, STORYBOOK_* */
+const PUBLIC_ENV_PREFIX_RX = /^(?:NEXT_PUBLIC|REACT_APP|VITE|PUBLIC|VUE_APP|GATSBY|EXPO_PUBLIC|NUXT_PUBLIC|STORYBOOK)_/;
+export function hasPublicEnvPrefix(name) {
+    return PUBLIC_ENV_PREFIX_RX.test(name);
+}
+/** AWS / vendor "this is the documentation key" patterns. AWS' own
+ *  IAM docs use `AKIAIOSFODNN7EXAMPLE` + `wJalrXUtnFEMI/K7MDENG/…EXAMPLEKEY`
+ *  literally in every tutorial. Treat any vendor key ending in
+ *  EXAMPLE / SAMPLE / DEMO / YOUR_KEY as a non-secret. */
+export function isVendorExampleKey(value) {
+    return /(?:EXAMPLE|SAMPLE|DEMO|YOUR_?(?:KEY|TOKEN|SECRET)?)(?:KEY)?$/i.test(value);
+}
+/** Composite filter used by every text-credential rule. */
+export function isObviouslyNonSecretValue(value) {
+    return containsRedactionMarker(value)
+        || containsEllipsis(value)
+        || looksLikePlaceholder(value);
+}
+/** Any non-ASCII character. Used by detectors whose regex would
+ *  otherwise accept natural-language placeholder text (CJK, Cyrillic,
+ *  Hangul, Arabic, emoji, …) — real secrets in those detectors are
+ *  always ASCII so non-ASCII content is a placeholder description.
+ *  Do NOT compose this into the shared isObviouslyNonSecretValue:
+ *  connection-string / url-creds / netrc legitimately allow unicode
+ *  passwords and would regress to false negatives. */
+const NON_ASCII_RX = /[^\x00-\x7F]/;
+export function hasNonAsciiContent(value) {
+    return NON_ASCII_RX.test(value);
+}
+/** Non-routable / documentation IP ranges that aren't real network
+ *  endpoints — loopback, RFC 5737 doc ranges, RFC 3849 IPv6 doc
+ *  range, unspecified address, link-local. */
+export function isReservedIp(value) {
+    // Loopback
+    if (value === '127.0.0.1' || value === '::1')
+        return true;
+    if (value.startsWith('127.'))
+        return true;
+    // RFC 5737 IPv4 documentation
+    if (value.startsWith('192.0.2.'))
+        return true;
+    if (value.startsWith('198.51.100.'))
+        return true;
+    if (value.startsWith('203.0.113.'))
+        return true;
+    // RFC 3849 IPv6 documentation
+    if (/^2001:0?db8/i.test(value))
+        return true;
+    // Unspecified / wildcard
+    if (value === '0.0.0.0' || value === '::')
+        return true;
+    // Link-local (RFC 3927 / RFC 4291)
+    if (value.startsWith('169.254.'))
+        return true;
+    if (/^fe80:/i.test(value))
+        return true;
+    return false;
+}
 //# sourceMappingURL=validators.js.map

package/dist/validators.js.map

@@ -1 +1 @@
-{"version":3,"file":"validators.js","sourceRoot":"","sources":["../src/validators.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,gEAAgE;AAChE,4DAA4D;AAC5D,EAAE;AACF,gEAAgE;AAChE,+DAA+D;AAC/D,iEAAiE;AACjE,yDAAyD;AAEzD;;iDAEiD;AACjD,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACvC,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAA;IAC1D,IAAI,GAAG,GAAG,CAAC,CAAA;IACX,IAAI,GAAG,GAAG,KAAK,CAAA;IACf,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAA;QACjC,IAAI,GAAG,EAAE,CAAC;YACR,CAAC,IAAI,CAAC,CAAA;YACN,IAAI,CAAC,GAAG,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAA;QACnB,CAAC;QACD,GAAG,IAAI,CAAC,CAAA;QACR,GAAG,GAAG,CAAC,GAAG,CAAA;IACZ,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAA;AACvB,CAAC;AAED;;;;;;;;;;iDAUiD;AACjD,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,4DAA4D;IAC5D,IAAI,CAAC,GAAG,UAAU,CAAA;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACxB,4DAA4D;QAC5D,4DAA4D;QAC5D,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACxC,CAAC;AAED;;4DAE4D;AAC5D,MAAM,UAAU,OAAO,CAAC,CAAS;IAC/B,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAA;IAChB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAC1D,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAA;IACpB,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAA;QACjB,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvB,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;mEAEmE;AACnE,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,CAAC,KAAa,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAA;QAC9D,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAA;IAC9B,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"validators.js","sourceRoot":"","sources":["../src/validators.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,gEAAgE;AAChE,4DAA4D;AAC5D,EAAE;AACF,gEAAgE;AAChE,+DAA+D;AAC/D,iEAAiE;AACjE,yDAAyD;AAEzD;;iDAEiD;AACjD,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACvC,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAA;IAC1D,IAAI,GAAG,GAAG,CAAC,CAAA;IACX,IAAI,GAAG,GAAG,KAAK,CAAA;IACf,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAA;QACjC,IAAI,GAAG,EAAE,CAAC;YACR,CAAC,IAAI,CAAC,CAAA;YACN,IAAI,CAAC,GAAG,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAA;QACnB,CAAC;QACD,GAAG,IAAI,CAAC,CAAA;QACR,GAAG,GAAG,CAAC,GAAG,CAAA;IACZ,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAA;AACvB,CAAC;AAED;;;;;;;;;;iDAUiD;AACjD,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,4DAA4D;IAC5D,IAAI,CAAC,GAAG,UAAU,CAAA;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACxB,4DAA4D;QAC5D,4DAA4D;QAC5D,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACxC,CAAC;AAED;;4DAE4D;AAC5D,MAAM,UAAU,OAAO,CAAC,CAAS;IAC/B,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAA;IAChB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAC1D,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAA;IACpB,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAA;QACjB,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvB,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;mEAEmE;AACnE,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,CAAC,KAAa,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAA;QAC9D,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAA;IAC9B,CAAC,CAAA;AACH,CAAC;AAED,qEAAqE;AACrE,EAAE;AACF,mEAAmE;AACnE,qEAAqE;AACrE,oEAAoE;AACpE,qEAAqE;AACrE,gEAAgE;AAChE,+DAA+D;AAC/D,wDAAwD;AACxD,mEAAmE;AACnE,iEAAiE;AAEjE;iEACiE;AACjE,MAAM,mBAAmB,GAAG,yFAAyF,CAAA;AAErH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACxC,CAAC;AAED;;kEAEkE;AAClE,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC/B,CAAC;AAED;0EAC0E;AAC1E,MAAM,oBAAoB,GAA0B;IAClD,wBAAwB,EAAoC,kBAAkB;IAC9E,aAAa,EAA+C,2BAA2B;IACvF,uBAAuB,EAAqC,eAAe;IAC3E,yDAAyD;IACzD,0EAA0E;IAC1E,4EAA4E;IAC5E,6BAA6B,EAA+B,iBAAiB;IAC7E,cAAc,EAA8C,oBAAoB;CACjF,CAAA;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;AAC1D,CAAC;AAED;;kDAEkD;AAClD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa;IAC1D,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM;IAC7E,aAAa,EAAE,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,cAAc;IACnF,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY;CAC/D,CAAC,CAAA;AAEF,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,OAAO,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;AACnD,CAAC;AAED;;;uBAGuB;AACvB,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAO,wDAAwD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED;;;yCAGyC;AACzC,MAAM,oBAAoB,GAAG,0FAA0F,CAAA;AAEvH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACxC,CAAC;AAED;;;0DAG0D;AAC1D,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,+DAA+D,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACpF,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,OAAO,uBAAuB,CAAC,KAAK,CAAC;WAC9B,gBAAgB,CAAC,KAAK,CAAC;WACvB,oBAAoB,CAAC,KAAK,CAAC,CAAA;AACpC,CAAC;AAED;;;;;;sDAMsD;AACtD,MAAM,YAAY,GAAG,cAAc,CAAA;AAEnC,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACjC,CAAC;AAED;;8CAE8C;AAC9C,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,WAAW;IACX,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IACzD,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IACzC,8BAA8B;IAC9B,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7C,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAA;IAChD,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAA;IAC/C,8BAA8B;IAC9B,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3C,yBAAyB;IACzB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACtD,mCAAmC;IACnC,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7C,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACtC,OAAO,KAAK,CAAA;AACd,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spool-lab/redact",
-  "version": "0.0.1",
+  "version": "0.5.1",
   "description": "Local, pure-TS sensitive-data detection for Spool sessions. Pattern + checksum + entropy pipeline today; pluggable provider boundary for future on-device ML (e.g. OpenAI Privacy Filter via transformers.js).",
   "type": "module",
   "main": "./dist/index.js",