opencode-rehydra-core 0.14.0

package/dist/recognizers/postal-code.d.ts

@@ -0,0 +1,16 @@
+/**
+ * UK Postal Code Recognizer
+ * Detects syntactically valid UK unit postcodes.
+ */
+export declare const UK_POSTAL_CODE_PATTERN: RegExp;
+/**
+ * Checks UK postcode syntax. This does not verify that Royal Mail currently
+ * assigns the postcode.
+ */
+export declare function isValidUKPostalCode(postalCode: string): boolean;
+/**
+ * Converts a UK postcode to uppercase with one space before the inward code.
+ */
+export declare function normalizeUKPostalCode(postalCode: string): string;
+export declare const ukPostalCodeRecognizer: import("./base.js").Recognizer;
+//# sourceMappingURL=postal-code.d.ts.map

package/dist/recognizers/postal-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postal-code.d.ts","sourceRoot":"","sources":["../../src/recognizers/postal-code.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAgBH,eAAO,MAAM,sBAAsB,QAGlC,CAAC;AAOF;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAIhE;AAED,eAAO,MAAM,sBAAsB,gCAOjC,CAAC"}

package/dist/recognizers/postal-code.js

@@ -0,0 +1,42 @@
+/**
+ * UK Postal Code Recognizer
+ * Detects syntactically valid UK unit postcodes.
+ */
+import { PIIType } from '../types/index.js';
+import { createRegexRecognizer } from './base.js';
+/**
+ * UK postcode syntax, including the exceptional GIR 0AA postcode.
+ *
+ * The outward code uses the letter restrictions from UK government postcode
+ * validation guidance. The inward code excludes C, I, K, M, O, and V.
+ * Horizontal whitespace is optional so normalized forms such as N164HY are
+ * detected without allowing a match to cross a line boundary.
+ */
+const UK_POSTAL_CODE_BODY = '(?:GIR[\\t ]*0AA|(?:[A-PR-UWYZ][0-9]{1,2}|[A-PR-UWYZ][A-HK-Y][0-9]{1,2}|[A-PR-UWYZ][0-9][A-HJKPSTUW]|[A-PR-UWYZ][A-HK-Y][0-9][ABEHMNPRVWXY])[\\t ]*[0-9][ABD-HJLNP-UW-Z]{2})';
+export const UK_POSTAL_CODE_PATTERN = new RegExp(`(?<![A-Z0-9])${UK_POSTAL_CODE_BODY}(?![A-Z0-9])`, 'gi');
+const UK_POSTAL_CODE_VALIDATION_PATTERN = new RegExp(`^${UK_POSTAL_CODE_BODY}$`, 'i');
+/**
+ * Checks UK postcode syntax. This does not verify that Royal Mail currently
+ * assigns the postcode.
+ */
+export function isValidUKPostalCode(postalCode) {
+    return UK_POSTAL_CODE_VALIDATION_PATTERN.test(postalCode.trim());
+}
+/**
+ * Converts a UK postcode to uppercase with one space before the inward code.
+ */
+export function normalizeUKPostalCode(postalCode) {
+    const compact = postalCode.trim().replace(/[\t ]+/g, '').toUpperCase();
+    if (compact.length <= 3)
+        return compact;
+    return `${compact.slice(0, -3)} ${compact.slice(-3)}`;
+}
+export const ukPostalCodeRecognizer = createRegexRecognizer({
+    type: PIIType.POSTAL_CODE,
+    name: 'UK Postal Code',
+    patterns: [UK_POSTAL_CODE_PATTERN],
+    defaultConfidence: 0.95,
+    validate: isValidUKPostalCode,
+    normalize: normalizeUKPostalCode,
+});
+//# sourceMappingURL=postal-code.js.map

package/dist/recognizers/postal-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postal-code.js","sourceRoot":"","sources":["../../src/recognizers/postal-code.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAElD;;;;;;;GAOG;AACH,MAAM,mBAAmB,GACvB,8KAA8K,CAAC;AAEjL,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,MAAM,CAC9C,gBAAgB,mBAAmB,cAAc,EACjD,IAAI,CACL,CAAC;AAEF,MAAM,iCAAiC,GAAG,IAAI,MAAM,CAClD,IAAI,mBAAmB,GAAG,EAC1B,GAAG,CACJ,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkB;IACpD,OAAO,iCAAiC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;AACnE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkB;IACtD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvE,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;IAC1D,IAAI,EAAE,OAAO,CAAC,WAAW;IACzB,IAAI,EAAE,gBAAgB;IACtB,QAAQ,EAAE,CAAC,sBAAsB,CAAC;IAClC,iBAAiB,EAAE,IAAI;IACvB,QAAQ,EAAE,mBAAmB;IAC7B,SAAS,EAAE,qBAAqB;CACjC,CAAC,CAAC"}

package/dist/recognizers/registry.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Recognizer Registry
+ * Central registry for all PII recognizers
+ */
+import { PIIType, SpanMatch, AnonymizationPolicy } from '../types/index.js';
+import type { Recognizer } from './base.js';
+/**
+ * Registry for managing PII recognizers
+ */
+export declare class RecognizerRegistry {
+    private recognizers;
+    /**
+     * Registers a recognizer for a PII type
+     */
+    register(recognizer: Recognizer): void;
+    /**
+     * Registers multiple recognizers
+     */
+    registerAll(recognizers: Recognizer[]): void;
+    /**
+     * Gets all recognizers for a specific type
+     */
+    getRecognizers(type: PIIType): Recognizer[];
+    /**
+     * Gets all registered recognizers
+     */
+    getAllRecognizers(): Recognizer[];
+    /**
+     * Gets all registered PII types
+     */
+    getRegisteredTypes(): PIIType[];
+    /**
+     * Checks if a recognizer is registered for a type
+     */
+    hasRecognizer(type: PIIType): boolean;
+    /**
+     * Removes all recognizers for a type
+     */
+    unregister(type: PIIType): void;
+    /**
+     * Clears all recognizers
+     */
+    clear(): void;
+    /**
+     * Runs all enabled recognizers on text and returns matches
+     * @param text - Text to analyze
+     * @param policy - Anonymization policy to determine which types to detect
+     */
+    findAll(text: string, policy: AnonymizationPolicy): SpanMatch[];
+}
+/**
+ * Gets the global recognizer registry (singleton)
+ */
+export declare function getGlobalRegistry(): RecognizerRegistry;
+/**
+ * Creates a new isolated registry (useful for testing)
+ */
+export declare function createRegistry(): RecognizerRegistry;
+//# sourceMappingURL=registry.d.ts.map

package/dist/recognizers/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/recognizers/registry.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C;;GAEG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,WAAW,CAAyC;IAE5D;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI;IAMtC;;OAEG;IACH,WAAW,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,IAAI;IAM5C;;OAEG;IACH,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,EAAE;IAI3C;;OAEG;IACH,iBAAiB,IAAI,UAAU,EAAE;IAQjC;;OAEG;IACH,kBAAkB,IAAI,OAAO,EAAE;IAI/B;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO;IAKrC;;OAEG;IACH,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAI/B;;OAEG;IACH,KAAK,IAAI,IAAI;IAIb;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,SAAS,EAAE;CA0BhE;AAOD;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,kBAAkB,CAKtD;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,kBAAkB,CAEnD"}

package/dist/recognizers/registry.js

@@ -0,0 +1,113 @@
+/**
+ * Recognizer Registry
+ * Central registry for all PII recognizers
+ */
+/**
+ * Registry for managing PII recognizers
+ */
+export class RecognizerRegistry {
+    recognizers = new Map();
+    /**
+     * Registers a recognizer for a PII type
+     */
+    register(recognizer) {
+        const existing = this.recognizers.get(recognizer.type) ?? [];
+        existing.push(recognizer);
+        this.recognizers.set(recognizer.type, existing);
+    }
+    /**
+     * Registers multiple recognizers
+     */
+    registerAll(recognizers) {
+        for (const recognizer of recognizers) {
+            this.register(recognizer);
+        }
+    }
+    /**
+     * Gets all recognizers for a specific type
+     */
+    getRecognizers(type) {
+        return this.recognizers.get(type) ?? [];
+    }
+    /**
+     * Gets all registered recognizers
+     */
+    getAllRecognizers() {
+        const all = [];
+        for (const recognizers of this.recognizers.values()) {
+            all.push(...recognizers);
+        }
+        return all;
+    }
+    /**
+     * Gets all registered PII types
+     */
+    getRegisteredTypes() {
+        return Array.from(this.recognizers.keys());
+    }
+    /**
+     * Checks if a recognizer is registered for a type
+     */
+    hasRecognizer(type) {
+        const recognizers = this.recognizers.get(type);
+        return recognizers !== undefined && recognizers.length > 0;
+    }
+    /**
+     * Removes all recognizers for a type
+     */
+    unregister(type) {
+        this.recognizers.delete(type);
+    }
+    /**
+     * Clears all recognizers
+     */
+    clear() {
+        this.recognizers.clear();
+    }
+    /**
+     * Runs all enabled recognizers on text and returns matches
+     * @param text - Text to analyze
+     * @param policy - Anonymization policy to determine which types to detect
+     */
+    findAll(text, policy) {
+        const matches = [];
+        for (const [type, recognizers] of this.recognizers) {
+            // Skip types not enabled in policy
+            if (!policy.enabledTypes.has(type) || !policy.regexEnabledTypes.has(type)) {
+                continue;
+            }
+            // Get confidence threshold for this type
+            const threshold = policy.confidenceThresholds.get(type) ?? 0.5;
+            for (const recognizer of recognizers) {
+                const typeMatches = recognizer.find(text);
+                // Filter by confidence threshold
+                for (const match of typeMatches) {
+                    if (match.confidence >= threshold) {
+                        matches.push(match);
+                    }
+                }
+            }
+        }
+        return matches;
+    }
+}
+/**
+ * Global singleton registry instance
+ */
+let globalRegistry = null;
+/**
+ * Gets the global recognizer registry (singleton)
+ */
+export function getGlobalRegistry() {
+    if (globalRegistry === null) {
+        globalRegistry = new RecognizerRegistry();
+    }
+    return globalRegistry;
+}
+/**
+ * Creates a new isolated registry (useful for testing)
+ */
+export function createRegistry() {
+    return new RecognizerRegistry();
+}
+//# sourceMappingURL=registry.js.map

package/dist/recognizers/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/recognizers/registry.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH;;GAEG;AACH,MAAM,OAAO,kBAAkB;IACrB,WAAW,GAA+B,IAAI,GAAG,EAAE,CAAC;IAE5D;;OAEG;IACH,QAAQ,CAAC,UAAsB;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7D,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,WAAyB;QACnC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,IAAa;QAC1B,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,MAAM,GAAG,GAAiB,EAAE,CAAC;QAC7B,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;YACpD,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,IAAa;QACzB,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,IAAa;QACtB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,IAAY,EAAE,MAA2B;QAC/C,MAAM,OAAO,GAAgB,EAAE,CAAC;QAEhC,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACnD,mCAAmC;YACnC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1E,SAAS;YACX,CAAC;YAED,yCAAyC;YACzC,MAAM,SAAS,GAAG,MAAM,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;YAE/D,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;gBACrC,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAE1C,iCAAiC;gBACjC,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;oBAChC,IAAI,KAAK,CAAC,UAAU,IAAI,SAAS,EAAE,CAAC;wBAClC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACtB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED;;GAEG;AACH,IAAI,cAAc,GAA8B,IAAI,CAAC;AAErD;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,cAAc,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,kBAAkB,EAAE,CAAC;AAClC,CAAC"}

package/dist/recognizers/secrets/api-key.d.ts

@@ -0,0 +1,6 @@
+/**
+ * API Key Recognizer
+ * Detects provider-specific API key patterns
+ */
+export declare const apiKeyRecognizer: import("../base.js").Recognizer;
+//# sourceMappingURL=api-key.d.ts.map

package/dist/recognizers/secrets/api-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.d.ts","sourceRoot":"","sources":["../../../src/recognizers/secrets/api-key.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,eAAO,MAAM,gBAAgB,iCA+B3B,CAAC"}

package/dist/recognizers/secrets/api-key.js

@@ -0,0 +1,40 @@
+/**
+ * API Key Recognizer
+ * Detects provider-specific API key patterns
+ */
+import { createRegexRecognizer } from "../base.js";
+import { PIIType } from "../../types/index.js";
+export const apiKeyRecognizer = createRegexRecognizer({
+    type: PIIType.API_KEY,
+    name: "API Key",
+    defaultConfidence: 0.97,
+    patterns: [
+        // OpenAI
+        /\bsk-proj-[A-Za-z0-9_-]{20,}\b/g,
+        /\bsk-[A-Za-z0-9]{20,}\b/g,
+        // Anthropic
+        /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g,
+        // GitHub (PAT, OAuth, App, Installation, Refresh)
+        /\bgh[pousr]_[A-Za-z0-9]{36,}\b/g,
+        // Stripe
+        /\b[sr]k_(?:live|test)_[A-Za-z0-9]{24,}\b/g,
+        // Slack bot/user tokens
+        /\bxox[bpas]-[0-9]{10,}-[A-Za-z0-9-]+/g,
+        // SendGrid
+        /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/g,
+        // Twilio
+        /\bSK[a-f0-9]{32}\b/g,
+        // Mailgun
+        /\bkey-[a-f0-9]{32}\b/g,
+        // Heroku
+        /\b[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\b/g,
+    ],
+    validate(match) {
+        // Heroku-style UUIDs are too generic without context — skip them
+        if (/^[a-f0-9]{8}-[a-f0-9]{4}-/.test(match))
+            return false;
+        // Must be at least 20 chars for non-prefixed patterns
+        return match.length >= 20;
+    },
+});
+//# sourceMappingURL=api-key.js.map

package/dist/recognizers/secrets/api-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.js","sourceRoot":"","sources":["../../../src/recognizers/secrets/api-key.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAE/C,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;IACpD,IAAI,EAAE,OAAO,CAAC,OAAO;IACrB,IAAI,EAAE,SAAS;IACf,iBAAiB,EAAE,IAAI;IACvB,QAAQ,EAAE;QACR,SAAS;QACT,iCAAiC;QACjC,0BAA0B;QAC1B,YAAY;QACZ,gCAAgC;QAChC,kDAAkD;QAClD,iCAAiC;QACjC,SAAS;QACT,2CAA2C;QAC3C,wBAAwB;QACxB,uCAAuC;QACvC,WAAW;QACX,+CAA+C;QAC/C,SAAS;QACT,qBAAqB;QACrB,UAAU;QACV,uBAAuB;QACvB,SAAS;QACT,mEAAmE;KACpE;IACD,QAAQ,CAAC,KAAa;QACpB,iEAAiE;QACjE,IAAI,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1D,sDAAsD;QACtD,OAAO,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;IAC5B,CAAC;CACF,CAAC,CAAC"}

package/dist/recognizers/secrets/aws-credentials.d.ts

@@ -0,0 +1,7 @@
+/**
+ * AWS Credentials Recognizer
+ * Detects AWS access key IDs (AKIA prefix) and context-dependent secret keys
+ */
+import type { Recognizer } from "../base.js";
+export declare const awsCredentialsRecognizer: Recognizer;
+//# sourceMappingURL=aws-credentials.d.ts.map

package/dist/recognizers/secrets/aws-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-credentials.d.ts","sourceRoot":"","sources":["../../../src/recognizers/secrets/aws-credentials.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAQ7C,eAAO,MAAM,wBAAwB,EAAE,UA2DtC,CAAC"}

package/dist/recognizers/secrets/aws-credentials.js

@@ -0,0 +1,68 @@
+/**
+ * AWS Credentials Recognizer
+ * Detects AWS access key IDs (AKIA prefix) and context-dependent secret keys
+ */
+import { PIIType, DetectionSource } from "../../types/index.js";
+const AWS_ACCESS_KEY_PATTERN = /\bAKIA[A-Z0-9]{16}\b/g;
+const AWS_SECRET_CONTEXT_KEYWORDS = /(?:aws_secret_access_key|secret_access_key|aws_secret|secretaccesskey)/i;
+const AWS_SECRET_KEY_PATTERN = /\b[A-Za-z0-9/+=]{40}\b/g;
+export const awsCredentialsRecognizer = {
+    type: PIIType.AWS_CREDENTIALS,
+    name: "AWS Credentials",
+    defaultConfidence: 0.98,
+    find(text) {
+        const matches = [];
+        const seen = new Set();
+        // Always detect AKIA access key IDs (high confidence, distinctive prefix)
+        for (const match of text.matchAll(AWS_ACCESS_KEY_PATTERN)) {
+            if (match.index === undefined)
+                continue;
+            const key = `${match.index}:${match.index + match[0].length}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            matches.push({
+                type: PIIType.AWS_CREDENTIALS,
+                start: match.index,
+                end: match.index + match[0].length,
+                confidence: 0.98,
+                source: DetectionSource.REGEX,
+                text: match[0],
+            });
+        }
+        // Only scan for 40-char secret keys if there's context suggesting AWS secrets
+        if (AWS_SECRET_CONTEXT_KEYWORDS.test(text)) {
+            for (const match of text.matchAll(AWS_SECRET_KEY_PATTERN)) {
+                if (match.index === undefined)
+                    continue;
+                const matchText = match[0];
+                const key = `${match.index}:${match.index + matchText.length}`;
+                if (seen.has(key))
+                    continue;
+                // Must contain mixed case + digits/special to look like a secret
+                if (!/[a-z]/.test(matchText) || !/[A-Z]/.test(matchText))
+                    continue;
+                if (!/[0-9/+=]/.test(matchText))
+                    continue;
+                seen.add(key);
+                matches.push({
+                    type: PIIType.AWS_CREDENTIALS,
+                    start: match.index,
+                    end: match.index + matchText.length,
+                    confidence: 0.85,
+                    source: DetectionSource.REGEX,
+                    text: matchText,
+                });
+            }
+        }
+        return matches;
+    },
+    validate(match) {
+        // AKIA keys are always valid
+        if (match.startsWith("AKIA") && match.length === 20)
+            return true;
+        // Secret keys must be exactly 40 chars
+        return match.length === 40;
+    },
+};
+//# sourceMappingURL=aws-credentials.js.map

package/dist/recognizers/secrets/aws-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-credentials.js","sourceRoot":"","sources":["../../../src/recognizers/secrets/aws-credentials.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAkB,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAGhF,MAAM,sBAAsB,GAAG,uBAAuB,CAAC;AAEvD,MAAM,2BAA2B,GAAG,yEAAyE,CAAC;AAE9G,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAEzD,MAAM,CAAC,MAAM,wBAAwB,GAAe;IAClD,IAAI,EAAE,OAAO,CAAC,eAAe;IAC7B,IAAI,EAAE,iBAAiB;IACvB,iBAAiB,EAAE,IAAI;IAEvB,IAAI,CAAC,IAAY;QACf,MAAM,OAAO,GAAgB,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAE/B,0EAA0E;QAC1E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;YAC1D,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;gBAAE,SAAS;YACxC,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YAC9D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAEd,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,OAAO,CAAC,eAAe;gBAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM;gBAClC,UAAU,EAAE,IAAI;gBAChB,MAAM,EAAE,eAAe,CAAC,KAAK;gBAC7B,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;aACf,CAAC,CAAC;QACL,CAAC;QAED,8EAA8E;QAC9E,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;gBAC1D,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;oBAAE,SAAS;gBACxC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC3B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;gBAC/D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAE5B,iEAAiE;gBACjE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;oBAAE,SAAS;gBACnE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;oBAAE,SAAS;gBAE1C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,OAAO,CAAC,eAAe;oBAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,GAAG,EAAE,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,MAAM;oBACnC,UAAU,EAAE,IAAI;oBAChB,MAAM,EAAE,eAAe,CAAC,KAAK;oBAC7B,IAAI,EAAE,SAAS;iBAChB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,QAAQ,CAAC,KAAa;QACpB,6BAA6B;QAC7B,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QACjE,uCAAuC;QACvC,OAAO,KAAK,CAAC,MAAM,KAAK,EAAE,CAAC;IAC7B,CAAC;CACF,CAAC"}

package/dist/recognizers/secrets/config-secret.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Config Secret Recognizer
+ * Detects key-value secrets in JSON, YAML, and TOML
+ */
+import type { Recognizer } from "../base.js";
+export declare function createConfigSecretRecognizer(minValueLength?: number, extraKeyPatterns?: RegExp[]): Recognizer;
+export declare const configSecretRecognizer: Recognizer;
+//# sourceMappingURL=config-secret.d.ts.map

package/dist/recognizers/secrets/config-secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-secret.d.ts","sourceRoot":"","sources":["../../../src/recognizers/secrets/config-secret.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAc7C,wBAAgB,4BAA4B,CAC1C,cAAc,GAAE,MAA2B,EAC3C,gBAAgB,GAAE,MAAM,EAAO,GAC9B,UAAU,CA8CZ;AAED,eAAO,MAAM,sBAAsB,YAAiC,CAAC"}

package/dist/recognizers/secrets/config-secret.js

@@ -0,0 +1,59 @@
+/**
+ * Config Secret Recognizer
+ * Detects key-value secrets in JSON, YAML, and TOML
+ */
+import { PIIType, DetectionSource } from "../../types/index.js";
+import { isSecretKeyName } from "./key-patterns.js";
+// JSON: "key": "value" or 'key': 'value'
+const JSON_SECRET = /["']([a-zA-Z_][a-zA-Z0-9_.-]*)["']\s*:\s*["']([^"'\n]{4,})["']/g;
+// YAML: key: value (unquoted or quoted)
+const YAML_SECRET = /^[ \t]*([a-zA-Z_][a-zA-Z0-9_.-]*)\s*:\s*["']?([^\n"'#]{4,})["']?$/gm;
+// TOML: key = "value"
+const TOML_SECRET = /^[ \t]*([a-zA-Z_][a-zA-Z0-9_.-]*)\s*=\s*["']([^"'\n]{4,})["']$/gm;
+const DEFAULT_MIN_LENGTH = 4;
+export function createConfigSecretRecognizer(minValueLength = DEFAULT_MIN_LENGTH, extraKeyPatterns = []) {
+    return {
+        type: PIIType.CONFIG_SECRET,
+        name: "Config Secret",
+        defaultConfidence: 0.85,
+        find(text) {
+            const matches = [];
+            const seen = new Set();
+            const patterns = [JSON_SECRET, YAML_SECRET, TOML_SECRET];
+            for (const pattern of patterns) {
+                const p = new RegExp(pattern.source, pattern.flags);
+                for (const match of text.matchAll(p)) {
+                    if (match.index === undefined)
+                        continue;
+                    const key = match[1];
+                    const value = match[2].trim();
+                    const keyIsSecret = isSecretKeyName(key)
+                        || extraKeyPatterns.some((pat) => pat.test(key));
+                    if (!keyIsSecret)
+                        continue;
+                    if (value.length < minValueLength)
+                        continue;
+                    // Find exact position of value in the matched text
+                    const fullMatch = match[0];
+                    const valueStartInMatch = fullMatch.lastIndexOf(value);
+                    const valueStart = match.index + valueStartInMatch;
+                    const spanKey = `${valueStart}:${valueStart + value.length}`;
+                    if (seen.has(spanKey))
+                        continue;
+                    seen.add(spanKey);
+                    matches.push({
+                        type: PIIType.CONFIG_SECRET,
+                        start: valueStart,
+                        end: valueStart + value.length,
+                        confidence: 0.85,
+                        source: DetectionSource.REGEX,
+                        text: value,
+                    });
+                }
+            }
+            return matches;
+        },
+    };
+}
+export const configSecretRecognizer = createConfigSecretRecognizer();
+//# sourceMappingURL=config-secret.js.map

package/dist/recognizers/secrets/config-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-secret.js","sourceRoot":"","sources":["../../../src/recognizers/secrets/config-secret.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAkB,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEhF,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,yCAAyC;AACzC,MAAM,WAAW,GAAG,iEAAiE,CAAC;AAEtF,wCAAwC;AACxC,MAAM,WAAW,GAAG,qEAAqE,CAAC;AAE1F,sBAAsB;AACtB,MAAM,WAAW,GAAG,kEAAkE,CAAC;AAEvF,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B,MAAM,UAAU,4BAA4B,CAC1C,iBAAyB,kBAAkB,EAC3C,mBAA6B,EAAE;IAE/B,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,aAAa;QAC3B,IAAI,EAAE,eAAe;QACrB,iBAAiB,EAAE,IAAI;QAEvB,IAAI,CAAC,IAAY;YACf,MAAM,OAAO,GAAgB,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAE/B,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;YAEzD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;gBACpD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrC,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;wBAAE,SAAS;oBACxC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;oBACtB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;oBAE/B,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC;2BACnC,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;oBACnD,IAAI,CAAC,WAAW;wBAAE,SAAS;oBAC3B,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc;wBAAE,SAAS;oBAE5C,mDAAmD;oBACnD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC3B,MAAM,iBAAiB,GAAG,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;oBACvD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,GAAG,iBAAiB,CAAC;oBACnD,MAAM,OAAO,GAAG,GAAG,UAAU,IAAI,UAAU,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC7D,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;wBAAE,SAAS;oBAChC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAElB,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,OAAO,CAAC,aAAa;wBAC3B,KAAK,EAAE,UAAU;wBACjB,GAAG,EAAE,UAAU,GAAG,KAAK,CAAC,MAAM;wBAC9B,UAAU,EAAE,IAAI;wBAChB,MAAM,EAAE,eAAe,CAAC,KAAK;wBAC7B,IAAI,EAAE,KAAK;qBACZ,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,4BAA4B,EAAE,CAAC"}

package/dist/recognizers/secrets/connection-string.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Connection String Recognizer
+ * Detects database/service URIs with embedded credentials
+ */
+export declare const connectionStringRecognizer: import("../base.js").Recognizer;
+//# sourceMappingURL=connection-string.d.ts.map

package/dist/recognizers/secrets/connection-string.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-string.d.ts","sourceRoot":"","sources":["../../../src/recognizers/secrets/connection-string.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAUH,eAAO,MAAM,0BAA0B,iCA2BrC,CAAC"}

package/dist/recognizers/secrets/connection-string.js

@@ -0,0 +1,40 @@
+/**
+ * Connection String Recognizer
+ * Detects database/service URIs with embedded credentials
+ */
+import { createRegexRecognizer } from "../base.js";
+import { PIIType } from "../../types/index.js";
+const PLACEHOLDER_PASSWORDS = new Set([
+    "password", "pass", "changeme", "secret", "xxx", "yyy",
+    "your-password", "your_password", "example", "<password>",
+]);
+export const connectionStringRecognizer = createRegexRecognizer({
+    type: PIIType.CONNECTION_STRING,
+    name: "Connection String",
+    defaultConfidence: 0.93,
+    patterns: [
+        // postgres://user:password@host/db
+        /\b(?:postgres(?:ql)?|mysql|mariadb):\/\/[^\s:]+:[^\s@]+@[^\s]+/g,
+        // mongodb+srv://user:password@host/db
+        /\bmongodb(?:\+srv)?:\/\/[^\s:]+:[^\s@]+@[^\s]+/g,
+        // redis://user:password@host:port or redis://:password@host:port
+        /\brediss?:\/\/(?:[^\s:]*:)?[^\s@]+@[^\s]+/g,
+        // amqp://user:password@host:port
+        /\bamqps?:\/\/[^\s:]+:[^\s@]+@[^\s]+/g,
+    ],
+    validate(match) {
+        // Extract password portion (between first : after // and @)
+        const credMatch = match.match(/:\/\/[^:]*:([^@]+)@/);
+        if (credMatch === null)
+            return false;
+        const password = credMatch[1];
+        // Reject placeholder passwords
+        if (PLACEHOLDER_PASSWORDS.has(password.toLowerCase()))
+            return false;
+        // Reject very short passwords (likely placeholders)
+        if (password.length < 4)
+            return false;
+        return true;
+    },
+});
+//# sourceMappingURL=connection-string.js.map

package/dist/recognizers/secrets/connection-string.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-string.js","sourceRoot":"","sources":["../../../src/recognizers/secrets/connection-string.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAE/C,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK;IACtD,eAAe,EAAE,eAAe,EAAE,SAAS,EAAE,YAAY;CAC1D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,qBAAqB,CAAC;IAC9D,IAAI,EAAE,OAAO,CAAC,iBAAiB;IAC/B,IAAI,EAAE,mBAAmB;IACzB,iBAAiB,EAAE,IAAI;IACvB,QAAQ,EAAE;QACR,mCAAmC;QACnC,iEAAiE;QACjE,sCAAsC;QACtC,iDAAiD;QACjD,iEAAiE;QACjE,4CAA4C;QAC5C,iCAAiC;QACjC,sCAAsC;KACvC;IACD,QAAQ,CAAC,KAAa;QACpB,4DAA4D;QAC5D,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACrD,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAErC,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC;QAC/B,+BAA+B;QAC/B,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QACpE,oDAAoD;QACpD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAEtC,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC,CAAC"}

package/dist/recognizers/secrets/env-var.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Environment Variable Secret Recognizer
+ * Detects secrets in .env-style KEY=VALUE lines
+ */
+import type { Recognizer } from "../base.js";
+export declare function createEnvVarSecretRecognizer(minValueLength?: number, extraKeyPatterns?: RegExp[]): Recognizer;
+export declare const envVarSecretRecognizer: Recognizer;
+//# sourceMappingURL=env-var.d.ts.map

package/dist/recognizers/secrets/env-var.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-var.d.ts","sourceRoot":"","sources":["../../../src/recognizers/secrets/env-var.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAa7C,wBAAgB,4BAA4B,CAC1C,cAAc,GAAE,MAA2B,EAC3C,gBAAgB,GAAE,MAAM,EAAO,GAC9B,UAAU,CAyCZ;AAED,eAAO,MAAM,sBAAsB,YAAiC,CAAC"}

package/dist/recognizers/secrets/env-var.js

@@ -0,0 +1,54 @@
+/**
+ * Environment Variable Secret Recognizer
+ * Detects secrets in .env-style KEY=VALUE lines
+ */
+import { PIIType, DetectionSource } from "../../types/index.js";
+import { isSecretKeyName } from "./key-patterns.js";
+const ENV_VAR_LINE = /^[ \t]*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*=[ \t]*["']?(.+?)["']?$/gm;
+const PLACEHOLDER_VALUES = new Set([
+    "changeme", "your-api-key-here", "your_api_key_here",
+    "xxx", "yyy", "zzz", "todo", "fixme", "replace_me",
+    "example", "test", "dummy", "placeholder",
+]);
+const DEFAULT_MIN_LENGTH = 4;
+export function createEnvVarSecretRecognizer(minValueLength = DEFAULT_MIN_LENGTH, extraKeyPatterns = []) {
+    return {
+        type: PIIType.ENV_VAR_SECRET,
+        name: "Environment Variable Secret",
+        defaultConfidence: 0.88,
+        find(text) {
+            const matches = [];
+            for (const match of text.matchAll(ENV_VAR_LINE)) {
+                if (match.index === undefined)
+                    continue;
+                const key = match[1];
+                const value = match[2];
+                // Check if key name suggests a secret
+                const keyIsSecret = isSecretKeyName(key)
+                    || extraKeyPatterns.some((p) => p.test(key));
+                if (!keyIsSecret)
+                    continue;
+                // Filter out short or placeholder values
+                if (value.length < minValueLength)
+                    continue;
+                if (PLACEHOLDER_VALUES.has(value.toLowerCase()))
+                    continue;
+                // Span covers the VALUE portion only
+                const fullLine = match[0];
+                const valueStartInLine = fullLine.lastIndexOf(value);
+                const valueStart = match.index + valueStartInLine;
+                matches.push({
+                    type: PIIType.ENV_VAR_SECRET,
+                    start: valueStart,
+                    end: valueStart + value.length,
+                    confidence: 0.88,
+                    source: DetectionSource.REGEX,
+                    text: value,
+                });
+            }
+            return matches;
+        },
+    };
+}
+export const envVarSecretRecognizer = createEnvVarSecretRecognizer();
+//# sourceMappingURL=env-var.js.map

package/dist/recognizers/secrets/env-var.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-var.js","sourceRoot":"","sources":["../../../src/recognizers/secrets/env-var.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAkB,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEhF,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,YAAY,GAAG,8EAA8E,CAAC;AAEpG,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,UAAU,EAAE,mBAAmB,EAAE,mBAAmB;IACpD,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY;IAClD,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa;CAC1C,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B,MAAM,UAAU,4BAA4B,CAC1C,iBAAyB,kBAAkB,EAC3C,mBAA6B,EAAE;IAE/B,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,cAAc;QAC5B,IAAI,EAAE,6BAA6B;QACnC,iBAAiB,EAAE,IAAI;QAEvB,IAAI,CAAC,IAAY;YACf,MAAM,OAAO,GAAgB,EAAE,CAAC;YAEhC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;oBAAE,SAAS;gBACxC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;gBACtB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;gBAExB,sCAAsC;gBACtC,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC;uBACnC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC/C,IAAI,CAAC,WAAW;oBAAE,SAAS;gBAE3B,yCAAyC;gBACzC,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc;oBAAE,SAAS;gBAC5C,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;oBAAE,SAAS;gBAE1D,qCAAqC;gBACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC1B,MAAM,gBAAgB,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBACrD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,GAAG,gBAAgB,CAAC;gBAElD,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,OAAO,CAAC,cAAc;oBAC5B,KAAK,EAAE,UAAU;oBACjB,GAAG,EAAE,UAAU,GAAG,KAAK,CAAC,MAAM;oBAC9B,UAAU,EAAE,IAAI;oBAChB,MAAM,EAAE,eAAe,CAAC,KAAK;oBAC7B,IAAI,EAAE,KAAK;iBACZ,CAAC,CAAC;YACL,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,4BAA4B,EAAE,CAAC"}

package/dist/recognizers/secrets/index.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Secret Recognizers Module
+ * Exports all secret/credential recognizers
+ */
+import type { Recognizer } from "../base.js";
+export { apiKeyRecognizer } from "./api-key.js";
+export { privateKeyRecognizer } from "./private-key.js";
+export { jwtRecognizer } from "./jwt.js";
+export { connectionStringRecognizer } from "./connection-string.js";
+export { awsCredentialsRecognizer } from "./aws-credentials.js";
+export { envVarSecretRecognizer, createEnvVarSecretRecognizer } from "./env-var.js";
+export { configSecretRecognizer, createConfigSecretRecognizer } from "./config-secret.js";
+export { createLiteralValueRecognizer } from "./literal-value.js";
+export { isSecretKeyName } from "./key-patterns.js";
+/**
+ * Creates all secret recognizers
+ */
+export declare function createSecretRecognizers(options?: {
+    secretKeyPatterns?: RegExp[];
+    minValueLength?: number;
+}): Recognizer[];
+//# sourceMappingURL=index.d.ts.map

package/dist/recognizers/secrets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/recognizers/secrets/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAS7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,CAAC,EAAE;IAChD,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,UAAU,EAAE,CAkBf"}