verification-layer 0.27.6 → 0.27.8

package/dist/rule-catalog.json

@@ -1,6 +1,6 @@
 {
   "package": "verification-layer",
-  "version": "0.27.6",
+  "version": "0.27.8",
   "total": 143,
   "counts": {
     "phi-exposure": 29,
@@ -663,7 +663,7 @@
       "severity": "critical",
       "title": "Authentication Configuration Without MFA Enabled",
       "description": "Auth provider configuration (NextAuth, Clerk, Auth0, Supabase) does not have MFA/2FA/TOTP enabled",
-      "recommendation": "Enable MFA in your auth provider configuration. For NextAuth: add adapter with MFA support. For Clerk: enable MFA in dashboard. For Auth0: enable MFA in tenant settings. For Supabase: enable MFA in auth settings.",
+      "recommendation": "Enable MFA in your auth provider configuration. For NextAuth: add adapter with MFA support. For Clerk: enable MFA in dashboard. For Auth0: enable MFA in tenant settings. For Supabase, verify MFA policy at the project/provider configuration level rather than inferring it from runtime auth calls.",
       "hipaaReference": "NPRM §164.312(d) - Person or Entity Authentication",
       "source": "pattern",
       "scanner": "authentication"

package/dist/scanners/authentication/index.js

@@ -67,13 +67,21 @@ export const authenticationScanner = {
  * Scan auth configuration files for missing MFA
  */
 async function scanAuthConfig(file, content, lines, pattern, findings) {
+    // A Supabase auth call (signUp/signIn/etc.) is a runtime call site, not proof
+    // that this file owns provider MFA configuration. Treat Supabase client usage
+    // as configuration evidence only when the file imports the SDK directly and
+    // constructs the client itself. Shared-client consumers therefore do not fire.
+    const hasDirectSupabaseSdkImport = /(?:from\s+['"]@supabase\/supabase-js['"]|require\(\s*['"]@supabase\/supabase-js['"]\s*\))/i.test(content);
+    const hasDirectClientConstruction = lines.some((line) => !isImportLine(line) && /createClient\s*\(/i.test(line));
+    const supabaseClientConfig = hasDirectSupabaseSdkImport && hasDirectClientConstruction;
     // Check if this is an auth-related file
     const isAuthFile = /(?:auth|clerk|supabase|next-auth)/i.test(file) ||
-        pattern.patterns.some((p) => p.test(content));
+        pattern.patterns.some((p) => p.test(content)) ||
+        supabaseClientConfig;
     if (!isAuthFile)
         return;
     // Check if file has any auth provider configuration
-    const hasAuthConfig = pattern.patterns.some((p) => p.test(content));
+    const hasAuthConfig = pattern.patterns.some((p) => p.test(content)) || supabaseClientConfig;
     if (!hasAuthConfig)
         return;
     // Check if MFA is configured
@@ -81,9 +89,7 @@ async function scanAuthConfig(file, content, lines, pattern, findings) {
     if (hasMfaConfig)
         return;
     // Find the line with auth configuration. Skip import/require lines — anchoring
-    // an "auth config without MFA" finding to an `import { createClient } from
-    // '@supabase/...'` line is a false-positive-looking trigger. If the only
-    // evidence is an import, don't fire at all.
+    // an "auth config without MFA" finding to an import line is misleading.
     let configLine = 0;
     for (let i = 0; i < lines.length; i++) {
         if (isImportLine(lines[i]))
@@ -93,6 +99,15 @@ async function scanAuthConfig(file, content, lines, pattern, findings) {
             break;
         }
     }
+    // For direct Supabase config, anchor the finding to the client constructor.
+    if (configLine === 0 && supabaseClientConfig) {
+        for (let i = 0; i < lines.length; i++) {
+            if (/createClient\s*\(/i.test(lines[i]) && !isImportLine(lines[i])) {
+                configLine = i + 1;
+                break;
+            }
+        }
+    }
     if (configLine === 0)
         return;
     // Create finding for auth config without MFA

package/dist/scanners/authentication/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/scanners/authentication/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,gBAAgB,EAAmB,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAEnE,MAAM,CAAC,MAAM,qBAAqB,GAAY;IAC5C,IAAI,EAAE,qCAAqC;IAC3C,QAAQ,EAAE,gBAAgB,EAAE,mCAAmC;IAE/D,KAAK,CAAC,IAAI,CAAC,KAAe,EAAE,QAAqB;QAC/C,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,kCAAkC;QAClC,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACvC,uCAAuC,CAAC,IAAI,CAAC,CAAC,CAAC,CAChD,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACjD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAElC,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;oBACvC,mDAAmD;oBACnD,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;wBAC7B,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;wBAC9D,SAAS;oBACX,CAAC;oBAED,sEAAsE;oBACtE,oDAAoD;oBACpD,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBACxE,SAAS;oBACX,CAAC;oBAED,oEAAoE;oBACpE,oEAAoE;oBACpE,uEAAuE;oBACvE,oEAAoE;oBACpE,qEAAqE;oBACrE,MAAM,iBAAiB,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,MAAM,CAC/D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAClC,CAAC;oBACF,MAAM,UAAU,GAAG,sBAAsB,CACvC,KAAK,EACL,OAAO,CAAC,QAAQ,EAChB,iBAAiB,EACjB,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAClD,CAAC;oBAEF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;wBAC3B,mEAAmE;wBACnE,oCAAoC;wBACpC,IACE,OAAO,CAAC,EAAE,KAAK,SAAS;4BACxB,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EACvD,CAAC;4BACD,SAAS;wBACX,CAAC;wBACD,QAAQ,CAAC,IAAI,CAAC;4BACZ,EAAE,EAAE,OAAO,CAAC,EAAE;4BACd,QAAQ,EAAE,gBAAgB;4BAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;4BAC1B,KAAK,EAAE,OAAO,CAAC,IAAI;4BACnB,WAAW,EAAE,GAAG,OAAO,CAAC,WAAW,aAAa,CAAC,CAAC,IAAI,EAAE;4BACxD,IAAI,EAAE,IAAI;4BACV,IAAI,EAAE,CAAC,CAAC,SAAS,GAAG,CAAC;4BACrB,cAAc,EAAE,OAAO,CAAC,cAAc;4BACtC,cAAc,EAAE,OAAO,CAAC,cAAc;4BACtC,UAAU,EAAE,MAAM;yBACnB,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF;;GAEG;AACH,KAAK,UAAU,cAAc,CAC3B,IAAY,EACZ,OAAe,EACf,KAAe,EACf,OAAmB,EACnB,QAAmB;IAEnB,wCAAwC;IACxC,MAAM,UAAU,GACd,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC/C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAEhD,IAAI,CAAC,UAAU;QAAE,OAAO;IAExB,oDAAoD;IACpD,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,aAAa;QAAE,OAAO;IAE3B,6BAA6B;IAC7B,MAAM,YAAY,GAAG,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,IAAI,YAAY;QAAE,OAAO;IAEzB,+EAA+E;IAC/E,2EAA2E;IAC3E,yEAAyE;IACzE,4CAA4C;IAC5C,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QACrC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC;YACnB,MAAM;QACR,CAAC;IACH,CAAC;IAED,IAAI,UAAU,KAAK,CAAC;QAAE,OAAO;IAE7B,6CAA6C;IAC7C,QAAQ,CAAC,IAAI,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,IAAI;QACnB,WAAW,EAAE,GAAG,OAAO,CAAC,WAAW,iEAAiE;QACpG,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,UAAU;QAChB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,UAAU,EAAE,MAAM;KACnB,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/scanners/authentication/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,gBAAgB,EAAmB,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAEnE,MAAM,CAAC,MAAM,qBAAqB,GAAY;IAC5C,IAAI,EAAE,qCAAqC;IAC3C,QAAQ,EAAE,gBAAgB,EAAE,mCAAmC;IAE/D,KAAK,CAAC,IAAI,CAAC,KAAe,EAAE,QAAqB;QAC/C,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,kCAAkC;QAClC,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACvC,uCAAuC,CAAC,IAAI,CAAC,CAAC,CAAC,CAChD,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACjD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAElC,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;oBACvC,mDAAmD;oBACnD,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;wBAC7B,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;wBAC9D,SAAS;oBACX,CAAC;oBAED,sEAAsE;oBACtE,oDAAoD;oBACpD,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBACxE,SAAS;oBACX,CAAC;oBAED,oEAAoE;oBACpE,oEAAoE;oBACpE,uEAAuE;oBACvE,oEAAoE;oBACpE,qEAAqE;oBACrE,MAAM,iBAAiB,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,MAAM,CAC/D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAClC,CAAC;oBACF,MAAM,UAAU,GAAG,sBAAsB,CACvC,KAAK,EACL,OAAO,CAAC,QAAQ,EAChB,iBAAiB,EACjB,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAClD,CAAC;oBAEF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;wBAC3B,mEAAmE;wBACnE,oCAAoC;wBACpC,IACE,OAAO,CAAC,EAAE,KAAK,SAAS;4BACxB,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EACvD,CAAC;4BACD,SAAS;wBACX,CAAC;wBACD,QAAQ,CAAC,IAAI,CAAC;4BACZ,EAAE,EAAE,OAAO,CAAC,EAAE;4BACd,QAAQ,EAAE,gBAAgB;4BAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;4BAC1B,KAAK,EAAE,OAAO,CAAC,IAAI;4BACnB,WAAW,EAAE,GAAG,OAAO,CAAC,WAAW,aAAa,CAAC,CAAC,IAAI,EAAE;4BACxD,IAAI,EAAE,IAAI;4BACV,IAAI,EAAE,CAAC,CAAC,SAAS,GAAG,CAAC;4BACrB,cAAc,EAAE,OAAO,CAAC,cAAc;4BACtC,cAAc,EAAE,OAAO,CAAC,cAAc;4BACtC,UAAU,EAAE,MAAM;yBACnB,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF;;GAEG;AACH,KAAK,UAAU,cAAc,CAC3B,IAAY,EACZ,OAAe,EACf,KAAe,EACf,OAAmB,EACnB,QAAmB;IAEnB,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,+EAA+E;IAC/E,MAAM,0BAA0B,GAC9B,4FAA4F,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7G,MAAM,2BAA2B,GAAG,KAAK,CAAC,IAAI,CAC5C,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CACjE,CAAC;IACF,MAAM,oBAAoB,GACxB,0BAA0B,IAAI,2BAA2B,CAAC;IAE5D,wCAAwC;IACxC,MAAM,UAAU,GACd,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC/C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,oBAAoB,CAAC;IAEvB,IAAI,CAAC,UAAU;QAAE,OAAO;IAExB,oDAAoD;IACpD,MAAM,aAAa,GACjB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,oBAAoB,CAAC;IACxE,IAAI,CAAC,aAAa;QAAE,OAAO;IAE3B,6BAA6B;IAC7B,MAAM,YAAY,GAAG,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,IAAI,YAAY;QAAE,OAAO;IAEzB,+EAA+E;IAC/E,wEAAwE;IACxE,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QACrC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC;YACnB,MAAM;QACR,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,IAAI,UAAU,KAAK,CAAC,IAAI,oBAAoB,EAAE,CAAC;QAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC;gBACnB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,UAAU,KAAK,CAAC;QAAE,OAAO;IAE7B,6CAA6C;IAC7C,QAAQ,CAAC,IAAI,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,IAAI;QACnB,WAAW,EAAE,GAAG,OAAO,CAAC,WAAW,iEAAiE;QACpG,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,UAAU;QAChB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,UAAU,EAAE,MAAM;KACnB,CAAC,CAAC;AACL,CAAC"}

package/dist/scanners/authentication/patterns.d.ts

@@ -15,7 +15,11 @@ export interface MFAPattern {
 }
 /**
  * MFA-001: Auth Provider Configuration Without MFA
- * Detects NextAuth, Clerk, Auth0, Supabase Auth configs without MFA enabled
+ * Detects code-local auth provider configuration without MFA enabled.
+ *
+ * Supabase runtime calls such as `supabase.auth.signUp()` are intentionally
+ * excluded. Supabase configuration is handled in the scanner with stronger
+ * evidence: a direct client construction that contains a Supabase project URL.
  */
 export declare const AUTH_CONFIG_NO_MFA: MFAPattern;
 /**

package/dist/scanners/authentication/patterns.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../../src/scanners/authentication/patterns.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,UA6ChC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,UAmCpC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,UAAU,EAAE,UA2CxB,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,UAAU,EAIxC,CAAC"}
+{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../../src/scanners/authentication/patterns.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,EAAE,UAyChC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,UAmCpC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,UAAU,EAAE,UA2CxB,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,UAAU,EAIxC,CAAC"}

package/dist/scanners/authentication/patterns.js

@@ -4,7 +4,11 @@
  */
 /**
  * MFA-001: Auth Provider Configuration Without MFA
- * Detects NextAuth, Clerk, Auth0, Supabase Auth configs without MFA enabled
+ * Detects code-local auth provider configuration without MFA enabled.
+ *
+ * Supabase runtime calls such as `supabase.auth.signUp()` are intentionally
+ * excluded. Supabase configuration is handled in the scanner with stronger
+ * evidence: a direct client construction that contains a Supabase project URL.
  */
 export const AUTH_CONFIG_NO_MFA = {
     id: 'MFA-001',
@@ -24,9 +28,6 @@ export const AUTH_CONFIG_NO_MFA = {
         /Auth0Provider/i,
         /auth0\.WebAuth/i,
         /new\s+Auth0Client/i,
-        // Supabase Auth configuration
-        /supabase\.auth\.signUp/i,
-        /createClient.*?supabase/i,
         // Generic auth configs
         /authConfig\s*[:=]/i,
         /authentication\s*:\s*\{/i,
@@ -43,7 +44,7 @@ export const AUTH_CONFIG_NO_MFA = {
         /two[-_]factor/i,
         /authenticator/i,
     ],
-    recommendation: 'Enable MFA in your auth provider configuration. For NextAuth: add adapter with MFA support. For Clerk: enable MFA in dashboard. For Auth0: enable MFA in tenant settings. For Supabase: enable MFA in auth settings.',
+    recommendation: 'Enable MFA in your auth provider configuration. For NextAuth: add adapter with MFA support. For Clerk: enable MFA in dashboard. For Auth0: enable MFA in tenant settings. For Supabase, verify MFA policy at the project/provider configuration level rather than inferring it from runtime auth calls.',
     category: 'authentication',
 };
 /**

package/dist/scanners/authentication/patterns.js.map

@@ -1 +1 @@
-{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../../src/scanners/authentication/patterns.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAcH;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAe;IAC5C,EAAE,EAAE,SAAS;IACb,IAAI,EAAE,kDAAkD;IACxD,WAAW,EACT,mGAAmG;IACrG,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,oDAAoD;IACpE,QAAQ,EAAE;QACR,yBAAyB;QACzB,gBAAgB;QAChB,mCAAmC;QACnC,qBAAqB;QAErB,sBAAsB;QACtB,gBAAgB;QAChB,6BAA6B;QAE7B,sBAAsB;QACtB,gBAAgB;QAChB,iBAAiB;QACjB,oBAAoB;QAEpB,8BAA8B;QAC9B,yBAAyB;QACzB,0BAA0B;QAE1B,uBAAuB;QACvB,oBAAoB;QACpB,0BAA0B;KAC3B;IACD,gBAAgB,EAAE;QAChB,iCAAiC;QACjC,MAAM;QACN,MAAM;QACN,OAAO;QACP,MAAM;QACN,cAAc;QACd,kBAAkB;QAClB,YAAY;QACZ,gBAAgB;QAChB,gBAAgB;KACjB;IACD,cAAc,EACZ,sNAAsN;IACxN,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAe;IAChD,EAAE,EAAE,SAAS;IACb,IAAI,EAAE,iDAAiD;IACvD,WAAW,EACT,4GAA4G;IAC9G,QAAQ,EAAE,MAAM;IAChB,cAAc,EAAE,oDAAoD;IACpE,QAAQ,EAAE;QACR,6BAA6B;QAC7B,yEAAyE;QACzE,qFAAqF;QAErF,qCAAqC;QACrC,kEAAkE;QAElE,iCAAiC;QACjC,yCAAyC;QACzC,yCAAyC;KAC1C;IACD,gBAAgB,EAAE;QAChB,iCAAiC;QACjC,WAAW;QACX,WAAW;QACX,mBAAmB;QACnB,gBAAgB;QAChB,oBAAoB;QACpB,MAAM;QACN,cAAc;QACd,aAAa;QACb,WAAW;QACX,YAAY;KACb;IACD,cAAc,EACZ,yNAAyN;IAC3N,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,EAAE,EAAE,SAAS;IACb,IAAI,EAAE,6BAA6B;IACnC,WAAW,EACT,+DAA+D;IACjE,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,oDAAoD;IACpE,QAAQ,EAAE;QACR,4BAA4B;QAC5B,UAAU;QACV,YAAY;QACZ,aAAa;QACb,YAAY;QAEZ,yBAAyB;QACzB,4BAA4B;QAC5B,4BAA4B;QAC5B,wCAAwC;QACxC,qCAAqC;QACrC,wBAAwB;QAExB,qBAAqB;QACrB,wBAAwB;QACxB,kCAAkC;QAElC,iDAAiD;QACjD,6CAA6C;KAC9C;IACD,gBAAgB,EAAE;QAChB,4CAA4C;QAC5C,aAAa;QACb,aAAa;QACb,aAAa;QACb,OAAO;QACP,SAAS;QACT,WAAW;QACX,WAAW;QACX,8BAA8B;QAC9B,eAAe;KAChB;IACD,cAAc,EACZ,2KAA2K;IAC7K,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAiB;IAC5C,kBAAkB;IAClB,sBAAsB;IACtB,UAAU;CACX,CAAC"}
+{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../../src/scanners/authentication/patterns.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAcH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAe;IAC5C,EAAE,EAAE,SAAS;IACb,IAAI,EAAE,kDAAkD;IACxD,WAAW,EACT,mGAAmG;IACrG,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,oDAAoD;IACpE,QAAQ,EAAE;QACR,yBAAyB;QACzB,gBAAgB;QAChB,mCAAmC;QACnC,qBAAqB;QAErB,sBAAsB;QACtB,gBAAgB;QAChB,6BAA6B;QAE7B,sBAAsB;QACtB,gBAAgB;QAChB,iBAAiB;QACjB,oBAAoB;QAEpB,uBAAuB;QACvB,oBAAoB;QACpB,0BAA0B;KAC3B;IACD,gBAAgB,EAAE;QAChB,iCAAiC;QACjC,MAAM;QACN,MAAM;QACN,OAAO;QACP,MAAM;QACN,cAAc;QACd,kBAAkB;QAClB,YAAY;QACZ,gBAAgB;QAChB,gBAAgB;KACjB;IACD,cAAc,EACZ,ySAAyS;IAC3S,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAe;IAChD,EAAE,EAAE,SAAS;IACb,IAAI,EAAE,iDAAiD;IACvD,WAAW,EACT,4GAA4G;IAC9G,QAAQ,EAAE,MAAM;IAChB,cAAc,EAAE,oDAAoD;IACpE,QAAQ,EAAE;QACR,6BAA6B;QAC7B,yEAAyE;QACzE,qFAAqF;QAErF,qCAAqC;QACrC,kEAAkE;QAElE,iCAAiC;QACjC,yCAAyC;QACzC,yCAAyC;KAC1C;IACD,gBAAgB,EAAE;QAChB,iCAAiC;QACjC,WAAW;QACX,WAAW;QACX,mBAAmB;QACnB,gBAAgB;QAChB,oBAAoB;QACpB,MAAM;QACN,cAAc;QACd,aAAa;QACb,WAAW;QACX,YAAY;KACb;IACD,cAAc,EACZ,yNAAyN;IAC3N,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,EAAE,EAAE,SAAS;IACb,IAAI,EAAE,6BAA6B;IACnC,WAAW,EACT,+DAA+D;IACjE,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,oDAAoD;IACpE,QAAQ,EAAE;QACR,4BAA4B;QAC5B,UAAU;QACV,YAAY;QACZ,aAAa;QACb,YAAY;QAEZ,yBAAyB;QACzB,4BAA4B;QAC5B,4BAA4B;QAC5B,wCAAwC;QACxC,qCAAqC;QACrC,wBAAwB;QAExB,qBAAqB;QACrB,wBAAwB;QACxB,kCAAkC;QAElC,iDAAiD;QACjD,6CAA6C;KAC9C;IACD,gBAAgB,EAAE;QAChB,4CAA4C;QAC5C,aAAa;QACb,aAAa;QACb,aAAa;QACb,OAAO;QACP,SAAS;QACT,WAAW;QACX,WAAW;QACX,8BAA8B;QAC9B,eAAe;KAChB;IACD,cAAc,EACZ,2KAA2K;IAC7K,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAiB;IAC5C,kBAAkB;IAClB,sBAAsB;IACtB,UAAU;CACX,CAAC"}

package/dist/scanners/authentication/supabase-callsite.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=supabase-callsite.test.d.ts.map

package/dist/scanners/authentication/supabase-callsite.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase-callsite.test.d.ts","sourceRoot":"","sources":["../../../src/scanners/authentication/supabase-callsite.test.ts"],"names":[],"mappings":""}

package/dist/scanners/authentication/supabase-callsite.test.js

@@ -0,0 +1,34 @@
+import { describe, it, expect, afterEach } from 'vitest';
+import { authenticationScanner } from './index.js';
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import * as os from 'os';
+describe('MFA-001 Supabase call-site precision', () => {
+    let tempDir = '';
+    afterEach(async () => {
+        if (tempDir) {
+            await fs.rm(tempDir, { recursive: true, force: true });
+        }
+    });
+    it('does not treat a shared-client signup route as provider MFA configuration', async () => {
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'supabase-callsite-'));
+        const file = path.join(tempDir, 'route.ts');
+        await fs.writeFile(file, `
+import { createClient } from '@/lib/supabase/server';
+
+export async function POST(req: Request) {
+  const supabase = await createClient();
+  const { data, error } = await supabase.auth.signUp({
+    email: 'user@example.com',
+    password: 'example-password',
+  });
+  return Response.json({ data, error });
+}
+`, 'utf-8');
+        const options = { path: tempDir };
+        const findings = await authenticationScanner.scan([file], options);
+        const mfaConfigFindings = findings.filter((finding) => finding.id === 'MFA-001');
+        expect(mfaConfigFindings).toHaveLength(0);
+    });
+});
+//# sourceMappingURL=supabase-callsite.test.js.map

package/dist/scanners/authentication/supabase-callsite.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase-callsite.test.js","sourceRoot":"","sources":["../../../src/scanners/authentication/supabase-callsite.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEnD,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,IAAI,OAAO,GAAG,EAAE,CAAC;IAEjB,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAE5C,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,EACJ;;;;;;;;;;;CAWL,EACK,OAAO,CACR,CAAC;QAEF,MAAM,OAAO,GAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACnE,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QAEjF,MAAM,CAAC,iBAAiB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/scanners/hipaa2026/false-positives.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=false-positives.test.d.ts.map

package/dist/scanners/hipaa2026/false-positives.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"false-positives.test.d.ts","sourceRoot":"","sources":["../../../src/scanners/hipaa2026/false-positives.test.ts"],"names":[],"mappings":""}

package/dist/scanners/hipaa2026/false-positives.test.js

@@ -0,0 +1,53 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { hipaa2026Scanner } from './index.js';
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import * as os from 'os';
+describe('HIPAA 2026 false-positive regressions', () => {
+    let tempDir = '';
+    beforeEach(async () => {
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hipaa2026-fp-'));
+    });
+    afterEach(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    async function scan(filename, content) {
+        const file = path.join(tempDir, filename);
+        await fs.writeFile(file, content, 'utf-8');
+        return hipaa2026Scanner.scan([file], { path: tempDir });
+    }
+    it('does not treat metadata authors + PHI marketing copy as an MFA flow', async () => {
+        const findings = await scan('layout.tsx', `
+export const metadata = {
+  authors: [{ name: 'vlayer' }],
+  description: 'Find PHI security risks before production',
+};
+      `);
+        expect(findings.some((f) => f.id === 'HIPAA-MFA-001')).toBe(false);
+    });
+    it('does not treat supabase.auth.signUp as a PHI login flow', async () => {
+        const findings = await scan('signup.ts', `
+const result = await supabase.auth.signUp({ email, password });
+const healthProfile = await createHealthProfile(result.data.user?.id);
+      `);
+        expect(findings.some((f) => f.id === 'HIPAA-MFA-001')).toBe(false);
+    });
+    it('does not classify a single invalid-credentials response as a breach', async () => {
+        const findings = await scan('signin.ts', `
+if (error) {
+  return Response.json({ error: 'Invalid credentials' }, { status: 401 });
+}
+      `);
+        expect(findings.some((f) => f.id === 'HIPAA-BREACH-001')).toBe(false);
+    });
+    it('still detects repeated failed login attempts without monitoring', async () => {
+        const findings = await scan('auth-monitoring.ts', `
+const failedLoginAttempts = getFailedLoginAttempts(user.id);
+if (failedLoginAttempts > 5) {
+  lockAccount(user.id);
+}
+      `);
+        expect(findings.some((f) => f.id === 'HIPAA-BREACH-001')).toBe(true);
+    });
+});
+//# sourceMappingURL=false-positives.test.js.map

package/dist/scanners/hipaa2026/false-positives.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"false-positives.test.js","sourceRoot":"","sources":["../../../src/scanners/hipaa2026/false-positives.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,IAAI,OAAO,GAAG,EAAE,CAAC;IAEjB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,IAAI,CAAC,QAAgB,EAAE,OAAe;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC1C,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,QAAQ,GAAG,MAAM,IAAI,CACzB,YAAY,EACZ;;;;;OAKC,CACF,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,QAAQ,GAAG,MAAM,IAAI,CACzB,WAAW,EACX;;;OAGC,CACF,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,QAAQ,GAAG,MAAM,IAAI,CACzB,WAAW,EACX;;;;OAIC,CACF,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,QAAQ,GAAG,MAAM,IAAI,CACzB,oBAAoB,EACpB;;;;;OAKC,CACF,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/scanners/hipaa2026/patterns.d.ts

@@ -23,35 +23,19 @@ export declare const MFA_PATTERNS: HIPAA2026Pattern;
  * HIPAA-ENC-REST-001: Encryption at Rest
  */
 export declare const ENCRYPTION_AT_REST_PATTERNS: HIPAA2026Pattern;
-/**
- * HIPAA-SESSION-001: Automatic Session Timeout
- */
+/** HIPAA-SESSION-001: Automatic Session Timeout */
 export declare const SESSION_TIMEOUT_PATTERNS: HIPAA2026Pattern;
-/**
- * HIPAA-REVOKE-001: Immediate Access Revocation
- */
+/** HIPAA-REVOKE-001: Immediate Access Revocation */
 export declare const ACCESS_REVOCATION_PATTERNS: HIPAA2026Pattern;
-/**
- * HIPAA-BREACH-001: 24-Hour Breach Notification
- */
+/** HIPAA-BREACH-001: 24-Hour Breach Notification */
 export declare const BREACH_NOTIFICATION_PATTERNS: HIPAA2026Pattern;
-/**
- * HIPAA-SEGMENT-001: Network Segmentation
- */
+/** HIPAA-SEGMENT-001: Network Segmentation */
 export declare const NETWORK_SEGMENTATION_PATTERNS: HIPAA2026Pattern;
-/**
- * HIPAA-ASSET-001: Technology Asset Inventory
- * Special pattern - triggers asset inventory generation
- */
+/** HIPAA-ASSET-001: Technology Asset Inventory */
 export declare const ASSET_INVENTORY_PATTERNS: HIPAA2026Pattern;
-/**
- * HIPAA-FLOW-001: ePHI Flow Mapping
- * Special pattern - triggers flow map generation
- */
+/** HIPAA-FLOW-001: ePHI Flow Mapping */
 export declare const PHI_FLOW_MAPPING_PATTERNS: HIPAA2026Pattern;
-/**
- * HIPAA-PENTEST-001: Vulnerability Scanning Configuration
- */
+/** HIPAA-PENTEST-001: Vulnerability Scanning Configuration */
 export declare const VULNERABILITY_SCANNING_PATTERNS: HIPAA2026Pattern;
 export declare const ALL_HIPAA_2026_PATTERNS: HIPAA2026Pattern[];
 //# sourceMappingURL=patterns.d.ts.map

package/dist/scanners/hipaa2026/patterns.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../../src/scanners/hipaa2026/patterns.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,GAAG,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,eAAO,MAAM,YAAY,EAAE,gBA2B1B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,2BAA2B,EAAE,gBA6BzC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB,EAAE,gBA8BtC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B,EAAE,gBA2BxC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,4BAA4B,EAAE,gBAuB1C,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,6BAA6B,EAAE,gBAgC3C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,gBAmBtC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,gBAmBvC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,+BAA+B,EAAE,gBAoB7C,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,gBAAgB,EAUrD,CAAC"}
+{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../../src/scanners/hipaa2026/patterns.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,GAAG,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,eAAO,MAAM,YAAY,EAAE,gBA6B1B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,2BAA2B,EAAE,gBAuBzC,CAAC;AAEF,mDAAmD;AACnD,eAAO,MAAM,wBAAwB,EAAE,gBAqBtC,CAAC;AAEF,oDAAoD;AACpD,eAAO,MAAM,0BAA0B,EAAE,gBAqBxC,CAAC;AAEF,oDAAoD;AACpD,eAAO,MAAM,4BAA4B,EAAE,gBAwB1C,CAAC;AAEF,8CAA8C;AAC9C,eAAO,MAAM,6BAA6B,EAAE,gBAuB3C,CAAC;AAEF,kDAAkD;AAClD,eAAO,MAAM,wBAAwB,EAAE,gBAetC,CAAC;AAEF,wCAAwC;AACxC,eAAO,MAAM,yBAAyB,EAAE,gBAevC,CAAC;AAEF,8DAA8D;AAC9D,eAAO,MAAM,+BAA+B,EAAE,gBAmB7C,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,gBAAgB,EAUrD,CAAC"}

package/dist/scanners/hipaa2026/patterns.js

@@ -13,8 +13,10 @@ export const MFA_PATTERNS = {
     severity: 'critical',
     hipaaReference: '45 CFR §164.312(a)(2)(i) - Access Control (Required)',
     patterns: [
-        // Login/auth without MFA
-        /(?:login|authenticate|signin|auth).*?(?:patient|phi|medical|health)(?!.*?(?:mfa|multi.?factor|2fa|totp|authenticator))/i,
+        // Login/sign-in/authentication flows that also access PHI. Deliberately avoid
+        // the generic token "auth": provider namespaces such as supabase.auth.signUp
+        // and metadata keys such as "authors" are not evidence of a PHI login flow.
+        /(?:\blogin\b|\bauthenticate(?:User)?\b|\bsign(?:-|_)?in\b).*?(?:patient|phi|medical|health)(?!.*?(?:mfa|multi.?factor|2fa|totp|authenticator))/i,
         // Auth configs without MFA
         /(?:passport|auth0|okta|cognito)\.(?:use|configure).*?(?!.*?(?:mfa|multiFactor|requireMFA))/i,
         // Admin endpoints without MFA
@@ -44,17 +46,11 @@ export const ENCRYPTION_AT_REST_PATTERNS = {
     severity: 'critical',
     hipaaReference: '45 CFR §164.312(a)(2)(iv) - Encryption (Required)',
     patterns: [
-        // Database without encryption
         /(?:mongoose|sequelize|typeorm|prisma)\.(?:connect|createConnection).*?(?!.*?(?:encrypt|ssl|tls))/i,
-        // File storage without encryption
         /(?:fs\.writeFile|writeFileSync|s3\.putObject).*?(?:patient|phi|medical)(?!.*?(?:encrypt|cipher))/i,
-        // LocalStorage with PHI
         /localStorage\.setItem.*?(?:patient|ssn|mrn|phi)/i,
-        // Cookie with PHI unencrypted
         /(?:res\.cookie|setCookie).*?(?:patient|phi|medical)(?!.*?(?:encrypt|secure|httpOnly))/i,
-        // MongoDB without encryption
         /MongoClient\.connect.*?(?!.*?(?:ssl|tls|encryption))/i,
-        // PostgreSQL without encryption
         /(?:pg|postgres)\.(?:connect|Pool).*?(?!.*?ssl)/i,
     ],
     negativePatterns: [
@@ -67,9 +63,7 @@ export const ENCRYPTION_AT_REST_PATTERNS = {
     confidence: 'high',
     category: 'encryption',
 };
-/**
- * HIPAA-SESSION-001: Automatic Session Timeout
- */
+/** HIPAA-SESSION-001: Automatic Session Timeout */
 export const SESSION_TIMEOUT_PATTERNS = {
     id: 'HIPAA-SESSION-001',
     name: 'Missing Automatic Session Timeout',
@@ -77,22 +71,13 @@ export const SESSION_TIMEOUT_PATTERNS = {
     severity: 'high',
     hipaaReference: '45 CFR §164.312(a)(2)(iii) - Session Control (Required)',
     patterns: [
-        // Session config without expiration
         /(?:express-session|session)\.(?:configure|use)(?!.*?(?:maxAge|expires|timeout))/i,
-        // Session with timeout > 15 min (900000 ms)
         /maxAge:\s*(?:9[0-9]{5}[0-9]+|[1-9][0-9]{6,})/i,
-        // JWT without expiration
         /jwt\.sign\([^)]*(?!.*?expiresIn)/i,
-        // Cookie session without expiration
         /cookie-session.*?(?!.*?maxAge)/i,
-        // Missing idle timeout
         /session.*?(?!.*?(?:idle|inactivity).*?timeout)/i,
     ],
     negativePatterns: [
-        // Compliant session length: maxAge with a 1–6 digit value (≤ 999999 ms,
-        // i.e. ≤ ~16 min). The \b stops it matching a prefix of a longer (>15 min)
-        // value, which the positive pattern above flags. Includes the exact 900000
-        // (15 min) boundary the autofix recommends — the old [1-8][0-9]{5} excluded it.
         /maxAge:\s*[1-9][0-9]{0,5}\b/i,
         /expiresIn:\s*['"](?:1[0-5]m|[1-9]m)['"]/i,
         /idleTimeout/i,
@@ -101,9 +86,7 @@ export const SESSION_TIMEOUT_PATTERNS = {
     confidence: 'high',
     category: 'access-control',
 };
-/**
- * HIPAA-REVOKE-001: Immediate Access Revocation
- */
+/** HIPAA-REVOKE-001: Immediate Access Revocation */
 export const ACCESS_REVOCATION_PATTERNS = {
     id: 'HIPAA-REVOKE-001',
     name: 'Missing Immediate Access Revocation',
@@ -111,15 +94,9 @@ export const ACCESS_REVOCATION_PATTERNS = {
     severity: 'critical',
     hipaaReference: '45 CFR §164.308(a)(3)(ii)(C) - Termination Procedures (Required)',
     patterns: [
-        // Deactivate user without token revocation
         /(?:deactivate|disable|remove)User(?!.*?(?:revoke|invalidate|blacklist).*?(?:token|session))/i,
-        // Delete user without session cleanup
         /(?:deleteUser|removeUser).*?(?!.*?(?:logout|invalidate|clearSessions))/i,
-        // Termination/deactivation as an actual operation — identifier or method call.
-        // Must NOT match prose/log strings like console.log('User deactivated ...'),
-        // which describe an action rather than perform one (false positive).
         /(?:deactivat|terminat|disabl)e?(?:User|Account|Member|Employee)|(?:user|account|member|employee)(?:Deactivation|Termination)|(?:user|account|member)\.(?:deactivate|terminate|disable)\b/i,
-        // Role change without re-auth
         /(?:updateRole|changePermissions)(?!.*?(?:logout|reauth|invalidate))/i,
     ],
     negativePatterns: [
@@ -132,9 +109,7 @@ export const ACCESS_REVOCATION_PATTERNS = {
     confidence: 'medium',
     category: 'access-control',
 };
-/**
- * HIPAA-BREACH-001: 24-Hour Breach Notification
- */
+/** HIPAA-BREACH-001: 24-Hour Breach Notification */
 export const BREACH_NOTIFICATION_PATTERNS = {
     id: 'HIPAA-BREACH-001',
     name: 'Missing Breach Notification Mechanism',
@@ -144,8 +119,9 @@ export const BREACH_NOTIFICATION_PATTERNS = {
     patterns: [
         // Security errors without breach handler
         /catch\s*\(.*?error.*?\).*?(?:security|unauthorized|breach)(?!.*?(?:notifyBreach|incidentResponse|alertSecurity))/i,
-        // Failed login attempts without monitoring
-        /(?:failed|invalid).*?(?:login|auth)(?!.*?(?:monitor|alert|notify))/i,
+        // Repeated/aggregated failed-login signals without monitoring. A single
+        // "invalid credentials" response is an authentication outcome, not a breach.
+        /(?:failed|invalid).*?(?:login|auth).*?(?:attempts?|count|threshold|rate|repeated|multiple)(?!.*?(?:monitor|alert|notify))/i,
         // Data access anomaly without alert
         /(?:unusual|suspicious).*?access(?!.*?(?:alert|notify|incident))/i,
     ],
@@ -159,9 +135,7 @@ export const BREACH_NOTIFICATION_PATTERNS = {
     confidence: 'medium',
     category: 'audit-logging',
 };
-/**
- * HIPAA-SEGMENT-001: Network Segmentation
- */
+/** HIPAA-SEGMENT-001: Network Segmentation */
 export const NETWORK_SEGMENTATION_PATTERNS = {
     id: 'HIPAA-SEGMENT-001',
     name: 'Missing Network Segmentation for PHI',
@@ -169,25 +143,16 @@ export const NETWORK_SEGMENTATION_PATTERNS = {
     severity: 'critical',
     hipaaReference: '45 CFR §164.312(e)(1) - Transmission Security (Required)',
     patterns: [
-        // CORS allowing all origins for PHI
         /cors\(\{?\s*origin:\s*['"]?\*['"]?.*?(?:patient|phi|medical)/i,
-        // PHI API without network restrictions
         /\/api.*?(?:patient|phi|medical)(?!.*?(?:firewall|vpc|subnet|private))/i,
-        // Internal PHI service publicly accessible
         /(?:express|fastify|koa)\.listen.*?(?:patient|phi)(?!.*?(?:localhost|127\.0\.0\.1|private))/i,
-        // Missing VPC/subnet config on a backend database/storage service.
-        // `storage` is guarded against client-side browser APIs (localStorage,
-        // sessionStorage) — network segmentation does not apply to those.
         /(?:database|(?<!local)(?<!session)storage).*?(?:patient|phi)(?!.*?(?:vpc|subnet|securityGroup))/i,
     ],
     negativePatterns: [
-        /origin:\s*\[.*?\]/i, // Whitelist
+        /origin:\s*\[.*?\]/i,
         /private.*?subnet/i,
         /securityGroup/i,
         /firewall.*?rules/i,
-        // Client-side HTTP *consumption* (fetch/axios) is not an exposed PHI
-        // service. Network segmentation applies to the server/infra that exposes
-        // the endpoint, not to a frontend call that reads from it.
         /\bfetch\s*\(/i,
         /\baxios\b/i,
     ],
@@ -195,10 +160,7 @@ export const NETWORK_SEGMENTATION_PATTERNS = {
     confidence: 'high',
     category: 'access-control',
 };
-/**
- * HIPAA-ASSET-001: Technology Asset Inventory
- * Special pattern - triggers asset inventory generation
- */
+/** HIPAA-ASSET-001: Technology Asset Inventory */
 export const ASSET_INVENTORY_PATTERNS = {
     id: 'HIPAA-ASSET-001',
     name: 'Generate ePHI Technology Asset Inventory',
@@ -206,23 +168,16 @@ export const ASSET_INVENTORY_PATTERNS = {
     severity: 'high',
     hipaaReference: '45 CFR §164.308(a)(1)(ii)(A) - Risk Analysis (Required)',
     patterns: [
-        // Databases
         /(?:mongoose|sequelize|prisma|typeorm|knex)\.(?:connect|model)/i,
-        // Storage services
         /(?:s3|azure\.storage|gcs)\./i,
-        // Third-party integrations
         /(?:stripe|twilio|sendgrid|mailgun)\.(?:api|client)/i,
-        // APIs
         /(?:axios|fetch|got|request)\./i,
     ],
     autoFix: 'Asset inventory will be generated automatically in scan report',
     confidence: 'high',
     category: 'data-retention',
 };
-/**
- * HIPAA-FLOW-001: ePHI Flow Mapping
- * Special pattern - triggers flow map generation
- */
+/** HIPAA-FLOW-001: ePHI Flow Mapping */
 export const PHI_FLOW_MAPPING_PATTERNS = {
     id: 'HIPAA-FLOW-001',
     name: 'Generate ePHI Flow Map',
@@ -230,22 +185,16 @@ export const PHI_FLOW_MAPPING_PATTERNS = {
     severity: 'high',
     hipaaReference: '45 CFR §164.308(a)(1)(ii)(A) - Risk Analysis (Required)',
     patterns: [
-        // Input points
         /(?:req\.body|req\.params|req\.query).*?(?:patient|phi|medical)/i,
-        // Processing
         /(?:process|transform|validate).*?(?:patient|phi)/i,
-        // Storage
         /(?:save|insert|update).*?(?:patient|phi)/i,
-        // Output
         /(?:res\.(?:send|json)|return).*?(?:patient|phi)/i,
     ],
     autoFix: 'PHI flow map will be generated automatically in scan report',
     confidence: 'high',
     category: 'data-retention',
 };
-/**
- * HIPAA-PENTEST-001: Vulnerability Scanning Configuration
- */
+/** HIPAA-PENTEST-001: Vulnerability Scanning Configuration */
 export const VULNERABILITY_SCANNING_PATTERNS = {
     id: 'HIPAA-PENTEST-001',
     name: 'Missing Vulnerability Scanning Configuration',
@@ -253,7 +202,6 @@ export const VULNERABILITY_SCANNING_PATTERNS = {
     severity: 'high',
     hipaaReference: '45 CFR §164.308(a)(8) - Evaluation (Required)',
     patterns: [
-        // Missing security scanning configs
         /package\.json(?!.*?(?:snyk|audit|vulnerability))/i,
     ],
     negativePatterns: [

package/dist/scanners/hipaa2026/patterns.js.map

@@ -1 +1 @@
-{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../../src/scanners/hipaa2026/patterns.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAgBH;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAqB;IAC5C,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,oDAAoD;IAC1D,WAAW,EAAE,sGAAsG;IACnH,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,sDAAsD;IACtE,QAAQ,EAAE;QACR,yBAAyB;QACzB,yHAAyH;QACzH,2BAA2B;QAC3B,6FAA6F;QAC7F,8BAA8B;QAC9B,sDAAsD;QACtD,+BAA+B;QAC/B,mDAAmD;QACnD,wBAAwB;QACxB,kDAAkD;KACnD;IACD,gBAAgB,EAAE;QAChB,qBAAqB;QACrB,cAAc;QACd,wBAAwB;QACxB,iBAAiB;KAClB;IACD,OAAO,EAAE,yFAAyF;IAClG,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAqB;IAC3D,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,wCAAwC;IAC9C,WAAW,EAAE,+DAA+D;IAC5E,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,mDAAmD;IACnE,QAAQ,EAAE;QACR,8BAA8B;QAC9B,mGAAmG;QACnG,kCAAkC;QAClC,mGAAmG;QACnG,wBAAwB;QACxB,kDAAkD;QAClD,8BAA8B;QAC9B,wFAAwF;QACxF,6BAA6B;QAC7B,uDAAuD;QACvD,gCAAgC;QAChC,iDAAiD;KAClD;IACD,gBAAgB,EAAE;QAChB,kBAAkB;QAClB,cAAc;QACd,WAAW;QACX,UAAU;KACX;IACD,OAAO,EAAE,+FAA+F;IACxG,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,YAAY;CACvB,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAqB;IACxD,EAAE,EAAE,mBAAmB;IACvB,IAAI,EAAE,mCAAmC;IACzC,WAAW,EAAE,uEAAuE;IACpF,QAAQ,EAAE,MAAM;IAChB,cAAc,EAAE,yDAAyD;IACzE,QAAQ,EAAE;QACR,oCAAoC;QACpC,kFAAkF;QAClF,4CAA4C;QAC5C,+CAA+C;QAC/C,yBAAyB;QACzB,mCAAmC;QACnC,oCAAoC;QACpC,iCAAiC;QACjC,uBAAuB;QACvB,iDAAiD;KAClD;IACD,gBAAgB,EAAE;QAChB,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,gFAAgF;QAChF,8BAA8B;QAC9B,0CAA0C;QAC1C,cAAc;KACf;IACD,OAAO,EAAE,+EAA+E;IACxF,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqB;IAC1D,EAAE,EAAE,kBAAkB;IACtB,IAAI,EAAE,qCAAqC;IAC3C,WAAW,EAAE,wEAAwE;IACrF,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,kEAAkE;IAClF,QAAQ,EAAE;QACR,2CAA2C;QAC3C,8FAA8F;QAC9F,sCAAsC;QACtC,yEAAyE;QACzE,+EAA+E;QAC/E,6EAA6E;QAC7E,qEAAqE;QACrE,2LAA2L;QAC3L,8BAA8B;QAC9B,sEAAsE;KACvE;IACD,gBAAgB,EAAE;QAChB,kBAAkB;QAClB,wBAAwB;QACxB,sBAAsB;QACtB,oBAAoB;KACrB;IACD,OAAO,EAAE,+FAA+F;IACxG,UAAU,EAAE,QAAQ;IACpB,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAqB;IAC5D,EAAE,EAAE,kBAAkB;IACtB,IAAI,EAAE,uCAAuC;IAC7C,WAAW,EAAE,wEAAwE;IACrF,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,qEAAqE;IACrF,QAAQ,EAAE;QACR,yCAAyC;QACzC,mHAAmH;QACnH,2CAA2C;QAC3C,qEAAqE;QACrE,oCAAoC;QACpC,kEAAkE;KACnE;IACD,gBAAgB,EAAE;QAChB,uBAAuB;QACvB,4BAA4B;QAC5B,sBAAsB;QACtB,eAAe;KAChB;IACD,OAAO,EAAE,0FAA0F;IACnG,UAAU,EAAE,QAAQ;IACpB,QAAQ,EAAE,eAAe;CAC1B,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAqB;IAC7D,EAAE,EAAE,mBAAmB;IACvB,IAAI,EAAE,sCAAsC;IAC5C,WAAW,EAAE,iFAAiF;IAC9F,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,0DAA0D;IAC1E,QAAQ,EAAE;QACR,oCAAoC;QACpC,+DAA+D;QAC/D,uCAAuC;QACvC,wEAAwE;QACxE,2CAA2C;QAC3C,6FAA6F;QAC7F,mEAAmE;QACnE,uEAAuE;QACvE,kEAAkE;QAClE,kGAAkG;KACnG;IACD,gBAAgB,EAAE;QAChB,oBAAoB,EAAE,YAAY;QAClC,mBAAmB;QACnB,gBAAgB;QAChB,mBAAmB;QACnB,qEAAqE;QACrE,yEAAyE;QACzE,2DAA2D;QAC3D,eAAe;QACf,YAAY;KACb;IACD,OAAO,EAAE,gGAAgG;IACzG,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAqB;IACxD,EAAE,EAAE,iBAAiB;IACrB,IAAI,EAAE,0CAA0C;IAChD,WAAW,EAAE,+EAA+E;IAC5F,QAAQ,EAAE,MAAM;IAChB,cAAc,EAAE,yDAAyD;IACzE,QAAQ,EAAE;QACR,YAAY;QACZ,gEAAgE;QAChE,mBAAmB;QACnB,8BAA8B;QAC9B,2BAA2B;QAC3B,qDAAqD;QACrD,OAAO;QACP,gCAAgC;KACjC;IACD,OAAO,EAAE,gEAAgE;IACzE,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAqB;IACzD,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,wBAAwB;IAC9B,WAAW,EAAE,4FAA4F;IACzG,QAAQ,EAAE,MAAM;IAChB,cAAc,EAAE,yDAAyD;IACzE,QAAQ,EAAE;QACR,eAAe;QACf,iEAAiE;QACjE,aAAa;QACb,mDAAmD;QACnD,UAAU;QACV,2CAA2C;QAC3C,SAAS;QACT,kDAAkD;KACnD;IACD,OAAO,EAAE,6DAA6D;IACtE,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAqB;IAC/D,EAAE,EAAE,mBAAmB;IACvB,IAAI,EAAE,8CAA8C;IACpD,WAAW,EAAE,gFAAgF;IAC7F,QAAQ,EAAE,MAAM;IAChB,cAAc,EAAE,+CAA+C;IAC/D,QAAQ,EAAE;QACR,oCAAoC;QACpC,mDAAmD;KACpD;IACD,gBAAgB,EAAE;QAChB,kBAAkB;QAClB,YAAY;QACZ,QAAQ;QACR,YAAY;QACZ,kBAAkB;KACnB;IACD,OAAO,EAAE,iFAAiF;IAC1F,UAAU,EAAE,QAAQ;IACpB,QAAQ,EAAE,eAAe;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAuB;IACzD,YAAY;IACZ,2BAA2B;IAC3B,wBAAwB;IACxB,0BAA0B;IAC1B,4BAA4B;IAC5B,6BAA6B;IAC7B,wBAAwB;IACxB,yBAAyB;IACzB,+BAA+B;CAChC,CAAC"}
+{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../../src/scanners/hipaa2026/patterns.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAgBH;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAqB;IAC5C,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,oDAAoD;IAC1D,WAAW,EAAE,sGAAsG;IACnH,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,sDAAsD;IACtE,QAAQ,EAAE;QACR,8EAA8E;QAC9E,6EAA6E;QAC7E,4EAA4E;QAC5E,iJAAiJ;QACjJ,2BAA2B;QAC3B,6FAA6F;QAC7F,8BAA8B;QAC9B,sDAAsD;QACtD,+BAA+B;QAC/B,mDAAmD;QACnD,wBAAwB;QACxB,kDAAkD;KACnD;IACD,gBAAgB,EAAE;QAChB,qBAAqB;QACrB,cAAc;QACd,wBAAwB;QACxB,iBAAiB;KAClB;IACD,OAAO,EAAE,yFAAyF;IAClG,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAqB;IAC3D,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,wCAAwC;IAC9C,WAAW,EAAE,+DAA+D;IAC5E,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,mDAAmD;IACnE,QAAQ,EAAE;QACR,mGAAmG;QACnG,mGAAmG;QACnG,kDAAkD;QAClD,wFAAwF;QACxF,uDAAuD;QACvD,iDAAiD;KAClD;IACD,gBAAgB,EAAE;QAChB,kBAAkB;QAClB,cAAc;QACd,WAAW;QACX,UAAU;KACX;IACD,OAAO,EAAE,+FAA+F;IACxG,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,YAAY;CACvB,CAAC;AAEF,mDAAmD;AACnD,MAAM,CAAC,MAAM,wBAAwB,GAAqB;IACxD,EAAE,EAAE,mBAAmB;IACvB,IAAI,EAAE,mCAAmC;IACzC,WAAW,EAAE,uEAAuE;IACpF,QAAQ,EAAE,MAAM;IAChB,cAAc,EAAE,yDAAyD;IACzE,QAAQ,EAAE;QACR,kFAAkF;QAClF,+CAA+C;QAC/C,mCAAmC;QACnC,iCAAiC;QACjC,iDAAiD;KAClD;IACD,gBAAgB,EAAE;QAChB,8BAA8B;QAC9B,0CAA0C;QAC1C,cAAc;KACf;IACD,OAAO,EAAE,+EAA+E;IACxF,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF,oDAAoD;AACpD,MAAM,CAAC,MAAM,0BAA0B,GAAqB;IAC1D,EAAE,EAAE,kBAAkB;IACtB,IAAI,EAAE,qCAAqC;IAC3C,WAAW,EAAE,wEAAwE;IACrF,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,kEAAkE;IAClF,QAAQ,EAAE;QACR,8FAA8F;QAC9F,yEAAyE;QACzE,2LAA2L;QAC3L,sEAAsE;KACvE;IACD,gBAAgB,EAAE;QAChB,kBAAkB;QAClB,wBAAwB;QACxB,sBAAsB;QACtB,oBAAoB;KACrB;IACD,OAAO,EAAE,+FAA+F;IACxG,UAAU,EAAE,QAAQ;IACpB,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF,oDAAoD;AACpD,MAAM,CAAC,MAAM,4BAA4B,GAAqB;IAC5D,EAAE,EAAE,kBAAkB;IACtB,IAAI,EAAE,uCAAuC;IAC7C,WAAW,EAAE,wEAAwE;IACrF,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,qEAAqE;IACrF,QAAQ,EAAE;QACR,yCAAyC;QACzC,mHAAmH;QACnH,wEAAwE;QACxE,6EAA6E;QAC7E,4HAA4H;QAC5H,oCAAoC;QACpC,kEAAkE;KACnE;IACD,gBAAgB,EAAE;QAChB,uBAAuB;QACvB,4BAA4B;QAC5B,sBAAsB;QACtB,eAAe;KAChB;IACD,OAAO,EAAE,0FAA0F;IACnG,UAAU,EAAE,QAAQ;IACpB,QAAQ,EAAE,eAAe;CAC1B,CAAC;AAEF,8CAA8C;AAC9C,MAAM,CAAC,MAAM,6BAA6B,GAAqB;IAC7D,EAAE,EAAE,mBAAmB;IACvB,IAAI,EAAE,sCAAsC;IAC5C,WAAW,EAAE,iFAAiF;IAC9F,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,0DAA0D;IAC1E,QAAQ,EAAE;QACR,+DAA+D;QAC/D,wEAAwE;QACxE,6FAA6F;QAC7F,kGAAkG;KACnG;IACD,gBAAgB,EAAE;QAChB,oBAAoB;QACpB,mBAAmB;QACnB,gBAAgB;QAChB,mBAAmB;QACnB,eAAe;QACf,YAAY;KACb;IACD,OAAO,EAAE,gGAAgG;IACzG,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF,kDAAkD;AAClD,MAAM,CAAC,MAAM,wBAAwB,GAAqB;IACxD,EAAE,EAAE,iBAAiB;IACrB,IAAI,EAAE,0CAA0C;IAChD,WAAW,EAAE,+EAA+E;IAC5F,QAAQ,EAAE,MAAM;IAChB,cAAc,EAAE,yDAAyD;IACzE,QAAQ,EAAE;QACR,gEAAgE;QAChE,8BAA8B;QAC9B,qDAAqD;QACrD,gCAAgC;KACjC;IACD,OAAO,EAAE,gEAAgE;IACzE,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF,wCAAwC;AACxC,MAAM,CAAC,MAAM,yBAAyB,GAAqB;IACzD,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,wBAAwB;IAC9B,WAAW,EAAE,4FAA4F;IACzG,QAAQ,EAAE,MAAM;IAChB,cAAc,EAAE,yDAAyD;IACzE,QAAQ,EAAE;QACR,iEAAiE;QACjE,mDAAmD;QACnD,2CAA2C;QAC3C,kDAAkD;KACnD;IACD,OAAO,EAAE,6DAA6D;IACtE,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,gBAAgB;CAC3B,CAAC;AAEF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,+BAA+B,GAAqB;IAC/D,EAAE,EAAE,mBAAmB;IACvB,IAAI,EAAE,8CAA8C;IACpD,WAAW,EAAE,gFAAgF;IAC7F,QAAQ,EAAE,MAAM;IAChB,cAAc,EAAE,+CAA+C;IAC/D,QAAQ,EAAE;QACR,mDAAmD;KACpD;IACD,gBAAgB,EAAE;QAChB,kBAAkB;QAClB,YAAY;QACZ,QAAQ;QACR,YAAY;QACZ,kBAAkB;KACnB;IACD,OAAO,EAAE,iFAAiF;IAC1F,UAAU,EAAE,QAAQ;IACpB,QAAQ,EAAE,eAAe;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAuB;IACzD,YAAY;IACZ,2BAA2B;IAC3B,wBAAwB;IACxB,0BAA0B;IAC1B,4BAA4B;IAC5B,6BAA6B;IAC7B,wBAAwB;IACxB,yBAAyB;IACzB,+BAA+B;CAChC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "verification-layer",
-  "version": "0.27.6",
+  "version": "0.27.8",
   "description": "Open-source HIPAA compliance scanner for healthcare code. 143 rules, 5 HIPAA categories. CLI + CI/CD + VS Code.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",