@form-engine-ts/privacy 2.7.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 form-engine-ts contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,12 @@
+# @form-engine-ts/privacy
+
+Framework-independent sensitive-data candidate detection for form-engine-ts. The standard detector scans only text and
+textarea answers for email addresses, phone numbers, HTTP(S) URLs, and postal codes. Rules and custom detectors are
+injectable, and findings are advisory so applications can choose confirm, block, or audit behavior.
+
+```ts
+import { createStandardPrivacyDetector } from "@form-engine-ts/privacy";
+
+const detector = createStandardPrivacyDetector();
+const findings = detector.detect(schema, values);
+```

package/dist/index.cjs

@@ -0,0 +1,83 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  createStandardPrivacyDetector: () => createStandardPrivacyDetector
+});
+module.exports = __toCommonJS(index_exports);
+var STANDARD_RULES = [
+  { type: "email", pattern: /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/giu },
+  { type: "url", pattern: /\bhttps?:\/\/[^\s<>"']+[^\s<>"'.,;:!?)]/giu },
+  { type: "phone", pattern: /(?:\+?\d[\d\s().-]{6,}\d)/gu },
+  { type: "postal_code", pattern: /(?:〒\s*)?\b\d{3}-?\d{4}\b/gu }
+];
+function configuredRules(config) {
+  const rules = new Map(STANDARD_RULES.map((rule) => [rule.type, rule]));
+  for (const rule of config.rules ?? []) {
+    if (rule.type.trim().length === 0) throw new TypeError("Privacy detector rule type must not be empty.");
+    if (!(rule.pattern instanceof RegExp)) throw new TypeError(`Privacy detector rule ${rule.type} requires a RegExp.`);
+    if (rule.enabled === false) rules.delete(rule.type);
+    else rules.set(rule.type, rule);
+  }
+  return [...rules.values()];
+}
+function detectRule(fieldId, text, rule) {
+  const flags = rule.pattern.flags.includes("g") ? rule.pattern.flags : `${rule.pattern.flags}g`;
+  const pattern = new RegExp(rule.pattern.source, flags);
+  const findings = [];
+  for (const match of text.matchAll(pattern)) {
+    const matchedText = match[0];
+    if (matchedText.length === 0 || match.index === void 0) continue;
+    if (rule.type === "phone" && matchedText.replaceAll(/\D/gu, "").length < 8) continue;
+    findings.push({
+      fieldId,
+      type: rule.type,
+      start: match.index,
+      end: match.index + matchedText.length,
+      matchedText
+    });
+  }
+  return findings;
+}
+function createStandardPrivacyDetector(config = {}) {
+  const rules = configuredRules(config);
+  const customDetectors = [...config.customDetectors ?? []];
+  if (customDetectors.some((detector) => typeof detector !== "function")) {
+    throw new TypeError("customDetectors must contain only functions.");
+  }
+  return {
+    detect(schema, values) {
+      const findings = [];
+      for (const field of schema.fields) {
+        if (field.type !== "text" && field.type !== "textarea") continue;
+        const value = values[field.id];
+        if (typeof value !== "string" || value.length === 0) continue;
+        for (const rule of rules) findings.push(...detectRule(field.id, value, rule));
+        for (const detector of customDetectors) findings.push(...detector(field.id, value));
+      }
+      return findings;
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createStandardPrivacyDetector
+});

package/dist/index.d.cts

@@ -0,0 +1,24 @@
+import { FormSchema } from '@form-engine-ts/core';
+
+interface SensitiveDataFinding {
+    readonly fieldId: string;
+    readonly type: "email" | "phone" | "url" | "postal_code" | string;
+    readonly start?: number;
+    readonly end?: number;
+    readonly matchedText?: string;
+}
+interface SensitiveDataDetectorRule {
+    readonly type: string;
+    readonly pattern: RegExp;
+    readonly enabled?: boolean;
+}
+interface PrivacyDetectorConfig {
+    readonly rules?: readonly SensitiveDataDetectorRule[];
+    readonly customDetectors?: readonly ((fieldId: string, text: string) => readonly SensitiveDataFinding[])[];
+}
+interface SensitiveDataDetector {
+    detect(schema: FormSchema, values: Record<string, unknown>): readonly SensitiveDataFinding[];
+}
+declare function createStandardPrivacyDetector(config?: PrivacyDetectorConfig): SensitiveDataDetector;
+
+export { type PrivacyDetectorConfig, type SensitiveDataDetector, type SensitiveDataDetectorRule, type SensitiveDataFinding, createStandardPrivacyDetector };

package/dist/index.d.ts

@@ -0,0 +1,24 @@
+import { FormSchema } from '@form-engine-ts/core';
+
+interface SensitiveDataFinding {
+    readonly fieldId: string;
+    readonly type: "email" | "phone" | "url" | "postal_code" | string;
+    readonly start?: number;
+    readonly end?: number;
+    readonly matchedText?: string;
+}
+interface SensitiveDataDetectorRule {
+    readonly type: string;
+    readonly pattern: RegExp;
+    readonly enabled?: boolean;
+}
+interface PrivacyDetectorConfig {
+    readonly rules?: readonly SensitiveDataDetectorRule[];
+    readonly customDetectors?: readonly ((fieldId: string, text: string) => readonly SensitiveDataFinding[])[];
+}
+interface SensitiveDataDetector {
+    detect(schema: FormSchema, values: Record<string, unknown>): readonly SensitiveDataFinding[];
+}
+declare function createStandardPrivacyDetector(config?: PrivacyDetectorConfig): SensitiveDataDetector;
+
+export { type PrivacyDetectorConfig, type SensitiveDataDetector, type SensitiveDataDetectorRule, type SensitiveDataFinding, createStandardPrivacyDetector };

package/dist/index.js

@@ -0,0 +1,58 @@
+// src/index.ts
+var STANDARD_RULES = [
+  { type: "email", pattern: /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/giu },
+  { type: "url", pattern: /\bhttps?:\/\/[^\s<>"']+[^\s<>"'.,;:!?)]/giu },
+  { type: "phone", pattern: /(?:\+?\d[\d\s().-]{6,}\d)/gu },
+  { type: "postal_code", pattern: /(?:〒\s*)?\b\d{3}-?\d{4}\b/gu }
+];
+function configuredRules(config) {
+  const rules = new Map(STANDARD_RULES.map((rule) => [rule.type, rule]));
+  for (const rule of config.rules ?? []) {
+    if (rule.type.trim().length === 0) throw new TypeError("Privacy detector rule type must not be empty.");
+    if (!(rule.pattern instanceof RegExp)) throw new TypeError(`Privacy detector rule ${rule.type} requires a RegExp.`);
+    if (rule.enabled === false) rules.delete(rule.type);
+    else rules.set(rule.type, rule);
+  }
+  return [...rules.values()];
+}
+function detectRule(fieldId, text, rule) {
+  const flags = rule.pattern.flags.includes("g") ? rule.pattern.flags : `${rule.pattern.flags}g`;
+  const pattern = new RegExp(rule.pattern.source, flags);
+  const findings = [];
+  for (const match of text.matchAll(pattern)) {
+    const matchedText = match[0];
+    if (matchedText.length === 0 || match.index === void 0) continue;
+    if (rule.type === "phone" && matchedText.replaceAll(/\D/gu, "").length < 8) continue;
+    findings.push({
+      fieldId,
+      type: rule.type,
+      start: match.index,
+      end: match.index + matchedText.length,
+      matchedText
+    });
+  }
+  return findings;
+}
+function createStandardPrivacyDetector(config = {}) {
+  const rules = configuredRules(config);
+  const customDetectors = [...config.customDetectors ?? []];
+  if (customDetectors.some((detector) => typeof detector !== "function")) {
+    throw new TypeError("customDetectors must contain only functions.");
+  }
+  return {
+    detect(schema, values) {
+      const findings = [];
+      for (const field of schema.fields) {
+        if (field.type !== "text" && field.type !== "textarea") continue;
+        const value = values[field.id];
+        if (typeof value !== "string" || value.length === 0) continue;
+        for (const rule of rules) findings.push(...detectRule(field.id, value, rule));
+        for (const detector of customDetectors) findings.push(...detector(field.id, value));
+      }
+      return findings;
+    }
+  };
+}
+export {
+  createStandardPrivacyDetector
+};

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@form-engine-ts/privacy",
+  "version": "2.7.0",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/nitta-a/form-engine-ts.git",
+    "directory": "packages/privacy"
+  },
+  "bugs": {
+    "url": "https://github.com/nitta-a/form-engine-ts/issues"
+  },
+  "homepage": "https://github.com/nitta-a/form-engine-ts#readme",
+  "keywords": [
+    "form",
+    "privacy",
+    "pii",
+    "typescript"
+  ],
+  "dependencies": {
+    "@form-engine-ts/core": "2.7.0"
+  },
+  "scripts": {
+    "build": "tsup src/index.ts --format esm,cjs --dts --clean --external @form-engine-ts/core",
+    "check": "biome check . && tsc --noEmit",
+    "test": "vitest run --globals",
+    "typecheck": "tsc --noEmit"
+  }
+}