@flexorch/audit 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 FlexOrch
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,101 @@
+# @flexorch/audit
+
+Zero-dependency PII + quality + noise audit for LLM datasets. Answers one question: **is this dataset ready for LLM training?**
+
+- **PII detection** — email, phone (TR + E.164), credit card (Luhn), IP, TCKN, IBAN, SSN, label-prefixed names
+- **Quality metrics** — completeness, average length, duplicate ratio
+- **Noise metrics** — garbage character ratio, encoding health
+- **Masking** — redact / replace / token / hash strategies
+- **Zero runtime dependencies** — pure Node.js built-ins, Node 18+
+
+```ts
+import { audit, mask } from "@flexorch/audit"
+
+const result = audit(text, { locale: "tr" })
+// {
+//   pii: [{ type: "email", value: "ali@example.com", start: 8, end: 23 }],
+//   quality: { completeness: 1.0, avg_length: 342, duplicate_ratio: null },
+//   noise: { garbage_ratio: 0.0, encoding_ok: true },
+// }
+
+const clean = mask(text, result.pii, { strategy: "redact" })
+// "Contact: [REDACTED_EMAIL]"
+```
+
+## Install
+
+```bash
+npm install @flexorch/audit
+```
+
+## Locale support
+
+| `locale` | Active detectors |
+|----------|-----------------|
+| `"tr"` (default) | email, iban, credit_card, ip + TCKN, phone_tr, name |
+| `"us"` | email, iban, credit_card, ip + SSN, E.164 phone |
+| `"eu"` | email, iban, credit_card, ip + E.164 phone |
+| `"all"` | All of the above (phone_tr takes precedence over generic phone) |
+
+## PII types
+
+| Type | Description | Locale |
+|------|-------------|--------|
+| `email` | RFC-5321 address | all |
+| `iban` | ISO 13616 IBAN (any country) | all |
+| `credit_card` | 16-digit groups, Luhn-validated | all |
+| `ip` | IPv4 address | all |
+| `phone_tr` | Turkish mobile (+90/0 prefix + 10 digits) | tr |
+| `national_id_tr` | TCKN — 11-digit modular arithmetic checksum | tr |
+| `name` | Label-prefixed name (e.g. "Adı: Ali Yıldız", "Full Name: Jane Doe") | tr |
+| `phone` | E.164 international phone | us, eu |
+| `ssn` | US Social Security Number (###-##-####) | us |
+
+## Masking strategies
+
+| Strategy | Example output |
+|----------|----------------|
+| `redact` (default) | `[REDACTED_EMAIL]` |
+| `replace` | `user@example.com` (realistic synthetic) |
+| `token` | `<PII_EMAIL_1>` (unique per type) |
+| `hash` | `[3d4f9a1b2c8e7f0a]` (SHA-256 first 16 hex chars) |
+
+## TypeScript
+
+Full type definitions included. No `@types/` package needed.
+
+```ts
+import { audit, mask, type AuditResult, type PiiFinding } from "@flexorch/audit"
+```
+
+## Quality & noise
+
+`duplicate_ratio` is `null` for single-string input. Compute it across your dataset:
+
+```ts
+const texts = dataset.map((r) => r.text)
+const seen = new Set<string>()
+let duplicates = 0
+for (const t of texts) {
+  if (seen.has(t)) duplicates++
+  else seen.add(t)
+}
+const duplicateRatio = duplicates / texts.length
+```
+
+## Limitations (v0.1)
+
+- Free-standing name detection (without a label prefix) requires NLP/NER — not included.
+- `duplicate_ratio` is per-call; aggregate across your dataset manually (see above).
+- IPv6 not detected.
+- IBAN format-only check; mod-97 validation not performed.
+
+## Also available for Python
+
+```bash
+pip install flexorch-audit
+```
+
+## License
+
+MIT

package/dist/index.cjs

@@ -0,0 +1,245 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  applyMask: () => applyMask,
+  audit: () => audit,
+  detectPii: () => detectPii,
+  mask: () => mask,
+  noiseMetrics: () => noiseMetrics,
+  qualityMetrics: () => qualityMetrics,
+  version: () => version
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/pii.ts
+var EMAIL_RE = /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g;
+var PHONE_INTL_RE = /\+\d{1,3}[\s\-.]?\(?\d{1,4}\)?[\s\-.]?\d{3,4}[\s\-.]?\d{4}\b/g;
+var IBAN_RE = /\b[A-Z]{2}\d{2}[0-9A-Z]{11,30}\b/g;
+var CC_RE = /\b\d{4}[ \-]\d{4}[ \-]\d{4}[ \-]\d{4}\b/g;
+var IPV4_RE = /\b(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\b/g;
+var PHONE_TR_RE = /\b(?:\+90|0)?\s*5\d{2}\s*\d{3}\s*\d{2}\s*\d{2}\b/g;
+var TCKN_RE = /\b([1-9]\d{10})\b/g;
+var NAME_PREFIX_TR = "(?:Ad[\u0131i]\\s*(?:Soyad[\u0131i])?|Soyad[\u0131i]|\u0130sim|M\xFC\u015Fteri\\s+Ad[\u0131i]|Yetkili(?:\\s+Ki\u015Fi)?|\xC7al\u0131\u015Fan\\s+Ad[\u0131i]|Personel\\s+Ad[\u0131i]|Ki\u015Fi\\s+Ad[\u0131i]|Sat\u0131c\u0131\\s+Ad[\u0131i]|Al\u0131c\u0131\\s+Ad[\u0131i]|\u0130lgili\\s+Ki\u015Fi|Hesap\\s+Sahibi)";
+var NAME_PREFIX_EN = "(?:Full\\s+Name|Customer\\s+Name|Employee\\s+Name|Contact\\s+Name|Authorized\\s+(?:By|Person)|Account\\s+Holder|(?<!\\bUser\\s)Name)";
+var NAME_VALUE = "([A-Z\xC7\u011E\u0130\xD6\u015E\xDC][a-z\xE7\u011F\u0131\u015F\xF6\u015F\xFC]+(?:\\s+[A-Z\xC7\u011E\u0130\xD6\u015E\xDC][a-z\xE7\u011F\u0131\u015F\xF6\u015F\xFC]+){0,2})";
+var NAME_RE = new RegExp(
+  `(?:${NAME_PREFIX_TR}|${NAME_PREFIX_EN})\\s*[:\\-]\\s*${NAME_VALUE}`,
+  "gu"
+);
+var SSN_RE = /\b(?!000|666|9\d{2})\d{3}-(?!00)\d{2}-(?!0000)\d{4}\b/g;
+function validTckn(s) {
+  if (s.length !== 11 || s[0] === "0") return false;
+  const d = s.split("").map(Number);
+  const sumOdd = d[0] + d[2] + d[4] + d[6] + d[8];
+  const sumEven = d[1] + d[3] + d[5] + d[7];
+  if ((sumOdd * 7 - sumEven) % 10 !== d[9]) return false;
+  return d.slice(0, 10).reduce((a, b) => a + b, 0) % 10 === d[10];
+}
+function luhn(number) {
+  const digits = number.replace(/\D/g, "");
+  if (digits.length < 13 || digits.length > 19) return false;
+  let total = 0;
+  for (let i = 0; i < digits.length; i++) {
+    let d = parseInt(digits[digits.length - 1 - i]);
+    if (i % 2 === 1) {
+      d *= 2;
+      if (d > 9) d -= 9;
+    }
+    total += d;
+  }
+  return total % 10 === 0;
+}
+var LOCALE_DETECTORS = {
+  tr: /* @__PURE__ */ new Set(["national_id_tr", "phone_tr", "name"]),
+  us: /* @__PURE__ */ new Set(["ssn", "phone"]),
+  eu: /* @__PURE__ */ new Set(["phone"])
+};
+var UNIVERSAL = /* @__PURE__ */ new Set(["email", "iban", "credit_card", "ip"]);
+function activeDetectors(locale) {
+  if (locale === "all") {
+    const active2 = new Set(UNIVERSAL);
+    for (const detectors of Object.values(LOCALE_DETECTORS)) {
+      detectors.forEach((d) => active2.add(d));
+    }
+    if (active2.has("phone_tr")) active2.delete("phone");
+    return active2;
+  }
+  const active = new Set(UNIVERSAL);
+  (LOCALE_DETECTORS[locale] ?? /* @__PURE__ */ new Set()).forEach((d) => active.add(d));
+  return active;
+}
+function findAll(re, text, type) {
+  const results = [];
+  re.lastIndex = 0;
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    results.push({ type, value: m[0], start: m.index, end: m.index + m[0].length });
+  }
+  return results;
+}
+function detectPii(text, locale = "tr") {
+  const active = activeDetectors(locale);
+  const t = text ?? "";
+  const findings = [];
+  if (active.has("email")) findings.push(...findAll(EMAIL_RE, t, "email"));
+  if (active.has("phone")) {
+    PHONE_INTL_RE.lastIndex = 0;
+    let m;
+    while ((m = PHONE_INTL_RE.exec(t)) !== null) {
+      const digits = m[0].replace(/\D/g, "").length;
+      if (digits >= 10) {
+        findings.push({ type: "phone", value: m[0], start: m.index, end: m.index + m[0].length });
+      }
+    }
+  }
+  if (active.has("iban")) findings.push(...findAll(IBAN_RE, t, "iban"));
+  if (active.has("credit_card")) {
+    CC_RE.lastIndex = 0;
+    let m;
+    while ((m = CC_RE.exec(t)) !== null) {
+      if (luhn(m[0])) {
+        findings.push({ type: "credit_card", value: m[0], start: m.index, end: m.index + m[0].length });
+      }
+    }
+  }
+  if (active.has("ip")) findings.push(...findAll(IPV4_RE, t, "ip"));
+  if (active.has("phone_tr")) findings.push(...findAll(PHONE_TR_RE, t, "phone_tr"));
+  if (active.has("national_id_tr")) {
+    TCKN_RE.lastIndex = 0;
+    let m;
+    while ((m = TCKN_RE.exec(t)) !== null) {
+      if (validTckn(m[1])) {
+        findings.push({ type: "national_id_tr", value: m[1], start: m.index, end: m.index + m[0].length });
+      }
+    }
+  }
+  if (active.has("name")) {
+    NAME_RE.lastIndex = 0;
+    let m;
+    while ((m = NAME_RE.exec(t)) !== null) {
+      const idx = m.length - 1;
+      const value = m[idx];
+      const start = m.index + m[0].lastIndexOf(value);
+      findings.push({ type: "name", value, start, end: start + value.length });
+    }
+  }
+  if (active.has("ssn")) findings.push(...findAll(SSN_RE, t, "ssn"));
+  return findings.sort((a, b) => a.start - b.start);
+}
+
+// src/quality.ts
+function qualityMetrics(text) {
+  const stripped = (text ?? "").trim();
+  return {
+    completeness: stripped.length > 0 ? 1 : 0,
+    avg_length: stripped.length,
+    duplicate_ratio: null
+  };
+}
+
+// src/noise.ts
+var SAFE_WHITESPACE = /* @__PURE__ */ new Set([" ", "	", "\n", "\r", "\v", "\f"]);
+var REPLACEMENT_CHAR = "\uFFFD";
+function isGarbage(ch) {
+  if (SAFE_WHITESPACE.has(ch)) return false;
+  const cp = ch.codePointAt(0) ?? 0;
+  return ch === REPLACEMENT_CHAR || cp <= 31 || cp >= 127 && cp <= 159 || cp >= 57344 && cp <= 63743 || // private use area
+  cp >= 55296 && cp <= 57343;
+}
+function noiseMetrics(text) {
+  if (!text) return { garbage_ratio: 0, encoding_ok: true };
+  const n = text.length;
+  let garbage = 0;
+  for (const ch of text) {
+    if (isGarbage(ch)) garbage++;
+  }
+  return {
+    garbage_ratio: Math.round(garbage / n * 1e4) / 1e4,
+    encoding_ok: !text.includes(REPLACEMENT_CHAR)
+  };
+}
+
+// src/mask.ts
+var import_crypto = require("crypto");
+var SYNTHETIC = {
+  email: "user@example.com",
+  phone: "+1 000 000 0000",
+  phone_tr: "0500 000 00 00",
+  national_id_tr: "00000000000",
+  ssn: "000-00-0000",
+  iban: "XX00 0000 0000 0000 0000 00",
+  credit_card: "0000 0000 0000 0000",
+  ip: "0.0.0.0",
+  name: "AD SOYAD"
+};
+var VALID_STRATEGIES = /* @__PURE__ */ new Set(["redact", "replace", "token", "hash"]);
+function applyMask(text, findings, strategy = "redact") {
+  if (!VALID_STRATEGIES.has(strategy)) {
+    throw new Error(`Unknown strategy "${strategy}". Use: redact, replace, token, hash`);
+  }
+  if (!text || findings.length === 0) return text ?? "";
+  let result = text;
+  const counter = {};
+  const sorted = [...findings].sort((a, b) => b.start - a.start);
+  for (const finding of sorted) {
+    const { type, value, start, end } = finding;
+    counter[type] = (counter[type] ?? 0) + 1;
+    const tag = type.toUpperCase();
+    let replacement;
+    if (strategy === "redact") {
+      replacement = `[REDACTED_${tag}]`;
+    } else if (strategy === "replace") {
+      replacement = SYNTHETIC[type] ?? `[${tag}]`;
+    } else if (strategy === "token") {
+      replacement = `<PII_${tag}_${counter[type]}>`;
+    } else {
+      const h = (0, import_crypto.createHash)("sha256").update(value).digest("hex").slice(0, 16);
+      replacement = `[${h}]`;
+    }
+    result = result.slice(0, start) + replacement + result.slice(end);
+  }
+  return result;
+}
+
+// src/index.ts
+var version = "0.1.0";
+function audit(text, options = {}) {
+  const locale = options.locale ?? "tr";
+  return {
+    pii: detectPii(text, locale),
+    quality: qualityMetrics(text),
+    noise: noiseMetrics(text)
+  };
+}
+function mask(text, findings, options = {}) {
+  return applyMask(text, findings, options.strategy ?? "redact");
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  applyMask,
+  audit,
+  detectPii,
+  mask,
+  noiseMetrics,
+  qualityMetrics,
+  version
+});

package/dist/index.d.cts

@@ -0,0 +1,73 @@
+interface PiiFinding {
+    type: string;
+    value: string;
+    start: number;
+    end: number;
+}
+declare function detectPii(text: string, locale?: string): PiiFinding[];
+
+interface QualityMetrics {
+    completeness: number;
+    avg_length: number;
+    duplicate_ratio: null;
+}
+declare function qualityMetrics(text: string): QualityMetrics;
+
+interface NoiseMetrics {
+    garbage_ratio: number;
+    encoding_ok: boolean;
+}
+declare function noiseMetrics(text: string): NoiseMetrics;
+
+type MaskStrategy = "redact" | "replace" | "token" | "hash";
+declare function applyMask(text: string, findings: PiiFinding[], strategy?: MaskStrategy): string;
+
+/**
+ * @flexorch/audit — zero-dependency PII + quality + noise audit for LLM datasets.
+ *
+ * @example
+ * import { audit, mask } from "@flexorch/audit"
+ *
+ * const result = audit(text, { locale: "tr" })
+ * // {
+ * //   pii: [{ type: "email", value: "ali@example.com", start: 8, end: 23 }],
+ * //   quality: { completeness: 1.0, avg_length: 342, duplicate_ratio: null },
+ * //   noise: { garbage_ratio: 0.0, encoding_ok: true },
+ * // }
+ *
+ * const clean = mask(text, result.pii, { strategy: "redact" })
+ * // "Contact: [REDACTED_EMAIL]"
+ */
+
+declare const version = "0.1.0";
+interface AuditOptions {
+    /**
+     * Active locale-specific detectors.
+     * - "tr"  — Turkish: TCKN, phone_tr, name  (default)
+     * - "us"  — US: SSN, E.164 phone
+     * - "eu"  — EU: E.164 phone
+     * - "all" — All detectors
+     *
+     * Universal detectors (email, iban, credit_card, ip) are always active.
+     */
+    locale?: string;
+}
+interface AuditResult {
+    pii: PiiFinding[];
+    quality: QualityMetrics;
+    noise: NoiseMetrics;
+}
+interface MaskOptions {
+    /** @default "redact" */
+    strategy?: MaskStrategy;
+}
+/**
+ * Audit *text* for LLM dataset readiness.
+ */
+declare function audit(text: string, options?: AuditOptions): AuditResult;
+/**
+ * Apply masking to PII findings in *text*.
+ */
+declare function mask(text: string, findings: PiiFinding[], options?: MaskOptions): string;
+
+export { type AuditOptions, type AuditResult, type MaskOptions, type MaskStrategy, type NoiseMetrics, type PiiFinding, type QualityMetrics, applyMask, audit, detectPii, mask, noiseMetrics, qualityMetrics, version };

package/dist/index.d.ts

@@ -0,0 +1,73 @@
+interface PiiFinding {
+    type: string;
+    value: string;
+    start: number;
+    end: number;
+}
+declare function detectPii(text: string, locale?: string): PiiFinding[];
+
+interface QualityMetrics {
+    completeness: number;
+    avg_length: number;
+    duplicate_ratio: null;
+}
+declare function qualityMetrics(text: string): QualityMetrics;
+
+interface NoiseMetrics {
+    garbage_ratio: number;
+    encoding_ok: boolean;
+}
+declare function noiseMetrics(text: string): NoiseMetrics;
+
+type MaskStrategy = "redact" | "replace" | "token" | "hash";
+declare function applyMask(text: string, findings: PiiFinding[], strategy?: MaskStrategy): string;
+
+/**
+ * @flexorch/audit — zero-dependency PII + quality + noise audit for LLM datasets.
+ *
+ * @example
+ * import { audit, mask } from "@flexorch/audit"
+ *
+ * const result = audit(text, { locale: "tr" })
+ * // {
+ * //   pii: [{ type: "email", value: "ali@example.com", start: 8, end: 23 }],
+ * //   quality: { completeness: 1.0, avg_length: 342, duplicate_ratio: null },
+ * //   noise: { garbage_ratio: 0.0, encoding_ok: true },
+ * // }
+ *
+ * const clean = mask(text, result.pii, { strategy: "redact" })
+ * // "Contact: [REDACTED_EMAIL]"
+ */
+
+declare const version = "0.1.0";
+interface AuditOptions {
+    /**
+     * Active locale-specific detectors.
+     * - "tr"  — Turkish: TCKN, phone_tr, name  (default)
+     * - "us"  — US: SSN, E.164 phone
+     * - "eu"  — EU: E.164 phone
+     * - "all" — All detectors
+     *
+     * Universal detectors (email, iban, credit_card, ip) are always active.
+     */
+    locale?: string;
+}
+interface AuditResult {
+    pii: PiiFinding[];
+    quality: QualityMetrics;
+    noise: NoiseMetrics;
+}
+interface MaskOptions {
+    /** @default "redact" */
+    strategy?: MaskStrategy;
+}
+/**
+ * Audit *text* for LLM dataset readiness.
+ */
+declare function audit(text: string, options?: AuditOptions): AuditResult;
+/**
+ * Apply masking to PII findings in *text*.
+ */
+declare function mask(text: string, findings: PiiFinding[], options?: MaskOptions): string;
+
+export { type AuditOptions, type AuditResult, type MaskOptions, type MaskStrategy, type NoiseMetrics, type PiiFinding, type QualityMetrics, applyMask, audit, detectPii, mask, noiseMetrics, qualityMetrics, version };

package/dist/index.js

@@ -0,0 +1,212 @@
+// src/pii.ts
+var EMAIL_RE = /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g;
+var PHONE_INTL_RE = /\+\d{1,3}[\s\-.]?\(?\d{1,4}\)?[\s\-.]?\d{3,4}[\s\-.]?\d{4}\b/g;
+var IBAN_RE = /\b[A-Z]{2}\d{2}[0-9A-Z]{11,30}\b/g;
+var CC_RE = /\b\d{4}[ \-]\d{4}[ \-]\d{4}[ \-]\d{4}\b/g;
+var IPV4_RE = /\b(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\b/g;
+var PHONE_TR_RE = /\b(?:\+90|0)?\s*5\d{2}\s*\d{3}\s*\d{2}\s*\d{2}\b/g;
+var TCKN_RE = /\b([1-9]\d{10})\b/g;
+var NAME_PREFIX_TR = "(?:Ad[\u0131i]\\s*(?:Soyad[\u0131i])?|Soyad[\u0131i]|\u0130sim|M\xFC\u015Fteri\\s+Ad[\u0131i]|Yetkili(?:\\s+Ki\u015Fi)?|\xC7al\u0131\u015Fan\\s+Ad[\u0131i]|Personel\\s+Ad[\u0131i]|Ki\u015Fi\\s+Ad[\u0131i]|Sat\u0131c\u0131\\s+Ad[\u0131i]|Al\u0131c\u0131\\s+Ad[\u0131i]|\u0130lgili\\s+Ki\u015Fi|Hesap\\s+Sahibi)";
+var NAME_PREFIX_EN = "(?:Full\\s+Name|Customer\\s+Name|Employee\\s+Name|Contact\\s+Name|Authorized\\s+(?:By|Person)|Account\\s+Holder|(?<!\\bUser\\s)Name)";
+var NAME_VALUE = "([A-Z\xC7\u011E\u0130\xD6\u015E\xDC][a-z\xE7\u011F\u0131\u015F\xF6\u015F\xFC]+(?:\\s+[A-Z\xC7\u011E\u0130\xD6\u015E\xDC][a-z\xE7\u011F\u0131\u015F\xF6\u015F\xFC]+){0,2})";
+var NAME_RE = new RegExp(
+  `(?:${NAME_PREFIX_TR}|${NAME_PREFIX_EN})\\s*[:\\-]\\s*${NAME_VALUE}`,
+  "gu"
+);
+var SSN_RE = /\b(?!000|666|9\d{2})\d{3}-(?!00)\d{2}-(?!0000)\d{4}\b/g;
+function validTckn(s) {
+  if (s.length !== 11 || s[0] === "0") return false;
+  const d = s.split("").map(Number);
+  const sumOdd = d[0] + d[2] + d[4] + d[6] + d[8];
+  const sumEven = d[1] + d[3] + d[5] + d[7];
+  if ((sumOdd * 7 - sumEven) % 10 !== d[9]) return false;
+  return d.slice(0, 10).reduce((a, b) => a + b, 0) % 10 === d[10];
+}
+function luhn(number) {
+  const digits = number.replace(/\D/g, "");
+  if (digits.length < 13 || digits.length > 19) return false;
+  let total = 0;
+  for (let i = 0; i < digits.length; i++) {
+    let d = parseInt(digits[digits.length - 1 - i]);
+    if (i % 2 === 1) {
+      d *= 2;
+      if (d > 9) d -= 9;
+    }
+    total += d;
+  }
+  return total % 10 === 0;
+}
+var LOCALE_DETECTORS = {
+  tr: /* @__PURE__ */ new Set(["national_id_tr", "phone_tr", "name"]),
+  us: /* @__PURE__ */ new Set(["ssn", "phone"]),
+  eu: /* @__PURE__ */ new Set(["phone"])
+};
+var UNIVERSAL = /* @__PURE__ */ new Set(["email", "iban", "credit_card", "ip"]);
+function activeDetectors(locale) {
+  if (locale === "all") {
+    const active2 = new Set(UNIVERSAL);
+    for (const detectors of Object.values(LOCALE_DETECTORS)) {
+      detectors.forEach((d) => active2.add(d));
+    }
+    if (active2.has("phone_tr")) active2.delete("phone");
+    return active2;
+  }
+  const active = new Set(UNIVERSAL);
+  (LOCALE_DETECTORS[locale] ?? /* @__PURE__ */ new Set()).forEach((d) => active.add(d));
+  return active;
+}
+function findAll(re, text, type) {
+  const results = [];
+  re.lastIndex = 0;
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    results.push({ type, value: m[0], start: m.index, end: m.index + m[0].length });
+  }
+  return results;
+}
+function detectPii(text, locale = "tr") {
+  const active = activeDetectors(locale);
+  const t = text ?? "";
+  const findings = [];
+  if (active.has("email")) findings.push(...findAll(EMAIL_RE, t, "email"));
+  if (active.has("phone")) {
+    PHONE_INTL_RE.lastIndex = 0;
+    let m;
+    while ((m = PHONE_INTL_RE.exec(t)) !== null) {
+      const digits = m[0].replace(/\D/g, "").length;
+      if (digits >= 10) {
+        findings.push({ type: "phone", value: m[0], start: m.index, end: m.index + m[0].length });
+      }
+    }
+  }
+  if (active.has("iban")) findings.push(...findAll(IBAN_RE, t, "iban"));
+  if (active.has("credit_card")) {
+    CC_RE.lastIndex = 0;
+    let m;
+    while ((m = CC_RE.exec(t)) !== null) {
+      if (luhn(m[0])) {
+        findings.push({ type: "credit_card", value: m[0], start: m.index, end: m.index + m[0].length });
+      }
+    }
+  }
+  if (active.has("ip")) findings.push(...findAll(IPV4_RE, t, "ip"));
+  if (active.has("phone_tr")) findings.push(...findAll(PHONE_TR_RE, t, "phone_tr"));
+  if (active.has("national_id_tr")) {
+    TCKN_RE.lastIndex = 0;
+    let m;
+    while ((m = TCKN_RE.exec(t)) !== null) {
+      if (validTckn(m[1])) {
+        findings.push({ type: "national_id_tr", value: m[1], start: m.index, end: m.index + m[0].length });
+      }
+    }
+  }
+  if (active.has("name")) {
+    NAME_RE.lastIndex = 0;
+    let m;
+    while ((m = NAME_RE.exec(t)) !== null) {
+      const idx = m.length - 1;
+      const value = m[idx];
+      const start = m.index + m[0].lastIndexOf(value);
+      findings.push({ type: "name", value, start, end: start + value.length });
+    }
+  }
+  if (active.has("ssn")) findings.push(...findAll(SSN_RE, t, "ssn"));
+  return findings.sort((a, b) => a.start - b.start);
+}
+
+// src/quality.ts
+function qualityMetrics(text) {
+  const stripped = (text ?? "").trim();
+  return {
+    completeness: stripped.length > 0 ? 1 : 0,
+    avg_length: stripped.length,
+    duplicate_ratio: null
+  };
+}
+
+// src/noise.ts
+var SAFE_WHITESPACE = /* @__PURE__ */ new Set([" ", "	", "\n", "\r", "\v", "\f"]);
+var REPLACEMENT_CHAR = "\uFFFD";
+function isGarbage(ch) {
+  if (SAFE_WHITESPACE.has(ch)) return false;
+  const cp = ch.codePointAt(0) ?? 0;
+  return ch === REPLACEMENT_CHAR || cp <= 31 || cp >= 127 && cp <= 159 || cp >= 57344 && cp <= 63743 || // private use area
+  cp >= 55296 && cp <= 57343;
+}
+function noiseMetrics(text) {
+  if (!text) return { garbage_ratio: 0, encoding_ok: true };
+  const n = text.length;
+  let garbage = 0;
+  for (const ch of text) {
+    if (isGarbage(ch)) garbage++;
+  }
+  return {
+    garbage_ratio: Math.round(garbage / n * 1e4) / 1e4,
+    encoding_ok: !text.includes(REPLACEMENT_CHAR)
+  };
+}
+
+// src/mask.ts
+import { createHash } from "crypto";
+var SYNTHETIC = {
+  email: "user@example.com",
+  phone: "+1 000 000 0000",
+  phone_tr: "0500 000 00 00",
+  national_id_tr: "00000000000",
+  ssn: "000-00-0000",
+  iban: "XX00 0000 0000 0000 0000 00",
+  credit_card: "0000 0000 0000 0000",
+  ip: "0.0.0.0",
+  name: "AD SOYAD"
+};
+var VALID_STRATEGIES = /* @__PURE__ */ new Set(["redact", "replace", "token", "hash"]);
+function applyMask(text, findings, strategy = "redact") {
+  if (!VALID_STRATEGIES.has(strategy)) {
+    throw new Error(`Unknown strategy "${strategy}". Use: redact, replace, token, hash`);
+  }
+  if (!text || findings.length === 0) return text ?? "";
+  let result = text;
+  const counter = {};
+  const sorted = [...findings].sort((a, b) => b.start - a.start);
+  for (const finding of sorted) {
+    const { type, value, start, end } = finding;
+    counter[type] = (counter[type] ?? 0) + 1;
+    const tag = type.toUpperCase();
+    let replacement;
+    if (strategy === "redact") {
+      replacement = `[REDACTED_${tag}]`;
+    } else if (strategy === "replace") {
+      replacement = SYNTHETIC[type] ?? `[${tag}]`;
+    } else if (strategy === "token") {
+      replacement = `<PII_${tag}_${counter[type]}>`;
+    } else {
+      const h = createHash("sha256").update(value).digest("hex").slice(0, 16);
+      replacement = `[${h}]`;
+    }
+    result = result.slice(0, start) + replacement + result.slice(end);
+  }
+  return result;
+}
+
+// src/index.ts
+var version = "0.1.0";
+function audit(text, options = {}) {
+  const locale = options.locale ?? "tr";
+  return {
+    pii: detectPii(text, locale),
+    quality: qualityMetrics(text),
+    noise: noiseMetrics(text)
+  };
+}
+function mask(text, findings, options = {}) {
+  return applyMask(text, findings, options.strategy ?? "redact");
+}
+export {
+  applyMask,
+  audit,
+  detectPii,
+  mask,
+  noiseMetrics,
+  qualityMetrics,
+  version
+};

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@flexorch/audit",
+  "version": "0.1.0",
+  "description": "Zero-dependency PII + quality + noise audit for LLM datasets (TR/EU/US)",
+  "keywords": [
+    "pii",
+    "privacy",
+    "llm",
+    "dataset",
+    "audit",
+    "tckn",
+    "kvkk",
+    "gdpr"
+  ],
+  "license": "MIT",
+  "author": "FlexOrch",
+  "homepage": "https://github.com/flexorch/flexorch-audit-js",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/flexorch/flexorch-audit-js.git"
+  },
+  "bugs": {
+    "url": "https://github.com/flexorch/flexorch-audit-js/issues"
+  },
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsup src/index.ts --format cjs,esm --dts --clean",
+    "test": "node --test tests/*.test.js",
+    "prepublishOnly": "npm run build && npm test"
+  },
+  "devDependencies": {
+    "@types/node": "^25.6.0",
+    "tsup": "^8.0.0",
+    "typescript": "^5.0.0"
+  }
+}