@frontmcp/ui 0.5.0 → 0.6.0

package/src/runtime/sanitizer.d.ts

@@ -1,171 +0,0 @@
-/**
- * Input Sanitizer
- *
- * Provides PII detection and redaction for tool inputs before they are
- * exposed to widget code. This protects sensitive data from being
- * accidentally exposed in client-side widgets.
- *
- * Built-in patterns:
- * - Email addresses → [EMAIL]
- * - Phone numbers → [PHONE]
- * - Credit card numbers → [CARD]
- * - SSN / National IDs → [ID]
- * - IP addresses → [IP]
- *
- * @example
- * ```typescript
- * import { sanitizeInput, createSanitizer } from './sanitizer';
- *
- * // Auto-detect and redact PII
- * const sanitized = sanitizeInput({
- *   user: 'john@example.com',
- *   phone: '555-123-4567',
- *   message: 'Hello world',
- * });
- * // Result: { user: '[EMAIL]', phone: '[PHONE]', message: 'Hello world' }
- *
- * // Redact specific fields
- * const sanitized2 = sanitizeInput(data, ['email', 'ssn']);
- *
- * // Custom sanitizer
- * const sanitized3 = sanitizeInput(data, (key, value) => {
- *   if (key === 'secret') return '[REDACTED]';
- *   return value;
- * });
- * ```
- */
-/**
- * Redaction placeholder tokens
- */
-export declare const REDACTION_TOKENS: {
-    readonly EMAIL: "[EMAIL]";
-    readonly PHONE: "[PHONE]";
-    readonly CARD: "[CARD]";
-    readonly ID: "[ID]";
-    readonly IP: "[IP]";
-    readonly REDACTED: "[REDACTED]";
-};
-/**
- * PII detection patterns
- */
-export declare const PII_PATTERNS: {
-    email: RegExp;
-    emailInText: RegExp;
-    phone: RegExp;
-    phoneInText: RegExp;
-    creditCard: RegExp;
-    creditCardInText: RegExp;
-    ssn: RegExp;
-    ssnInText: RegExp;
-    ipv4: RegExp;
-    ipv4InText: RegExp;
-};
-/**
- * Custom sanitizer function type
- */
-export type SanitizerFn = (key: string, value: unknown, path: string[]) => unknown;
-/**
- * Sanitizer options
- */
-export interface SanitizeOptions {
-    /**
-     * How to handle PII detection:
-     * - true: Auto-detect and redact common PII patterns
-     * - string[]: Only redact values in fields with these names
-     * - SanitizerFn: Custom sanitizer function
-     */
-    mode: true | string[] | SanitizerFn;
-    /**
-     * Maximum depth for recursive sanitization
-     * @default 10
-     */
-    maxDepth?: number;
-    /**
-     * Whether to sanitize PII patterns within string values
-     * @default true
-     */
-    sanitizeInText?: boolean;
-}
-/**
- * Check if a string matches an email pattern
- */
-export declare function isEmail(value: string): boolean;
-/**
- * Check if a string matches a phone pattern
- */
-export declare function isPhone(value: string): boolean;
-/**
- * Check if a string matches a credit card pattern
- */
-export declare function isCreditCard(value: string): boolean;
-/**
- * Check if a string matches an SSN pattern
- */
-export declare function isSSN(value: string): boolean;
-/**
- * Check if a string matches an IPv4 pattern
- */
-export declare function isIPv4(value: string): boolean;
-/**
- * Detect PII type in a string value
- */
-export declare function detectPIIType(value: string): keyof typeof REDACTION_TOKENS | null;
-/**
- * Redact PII patterns from text
- */
-export declare function redactPIIFromText(text: string): string;
-/**
- * Sanitize input data by redacting PII.
- *
- * @param input - The input data to sanitize
- * @param mode - Sanitization mode:
- *   - `true`: Auto-detect and redact common PII patterns
- *   - `string[]`: Redact values in fields with these names
- *   - `SanitizerFn`: Custom sanitizer function
- * @returns Sanitized copy of the input
- *
- * @example
- * ```typescript
- * // Auto-detect PII
- * sanitizeInput({ email: 'test@example.com' });
- * // { email: '[EMAIL]' }
- *
- * // Redact specific fields
- * sanitizeInput({ password: 'secret', name: 'John' }, ['password']);
- * // { password: '[REDACTED]', name: 'John' }
- *
- * // Custom sanitizer
- * sanitizeInput(data, (key, value) => key === 'token' ? '[TOKEN]' : value);
- * ```
- */
-export declare function sanitizeInput(input: Record<string, unknown>, mode?: true | string[] | SanitizerFn): Record<string, unknown>;
-/**
- * Create a reusable sanitizer function with preset options.
- *
- * @param mode - Sanitization mode
- * @returns Sanitizer function
- *
- * @example
- * ```typescript
- * const sanitizer = createSanitizer(['email', 'phone', 'ssn']);
- *
- * const clean1 = sanitizer(userData1);
- * const clean2 = sanitizer(userData2);
- * ```
- */
-export declare function createSanitizer(mode?: true | string[] | SanitizerFn): (input: Record<string, unknown>) => Record<string, unknown>;
-/**
- * Check if an object contains any detected PII.
- * Does not modify the input.
- *
- * @param input - The input to check
- * @param options - Optional configuration
- * @param options.maxDepth - Maximum recursion depth (default: 10)
- * @returns Object with boolean `hasPII` and `fields` array of field paths
- */
-export declare function detectPII(input: Record<string, unknown>, options?: {
-    maxDepth?: number;
-}): {
-    hasPII: boolean;
-    fields: string[];
-};

package/src/runtime/sanitizer.js

@@ -1,318 +0,0 @@
-"use strict";
-/**
- * Input Sanitizer
- *
- * Provides PII detection and redaction for tool inputs before they are
- * exposed to widget code. This protects sensitive data from being
- * accidentally exposed in client-side widgets.
- *
- * Built-in patterns:
- * - Email addresses → [EMAIL]
- * - Phone numbers → [PHONE]
- * - Credit card numbers → [CARD]
- * - SSN / National IDs → [ID]
- * - IP addresses → [IP]
- *
- * @example
- * ```typescript
- * import { sanitizeInput, createSanitizer } from './sanitizer';
- *
- * // Auto-detect and redact PII
- * const sanitized = sanitizeInput({
- *   user: 'john@example.com',
- *   phone: '555-123-4567',
- *   message: 'Hello world',
- * });
- * // Result: { user: '[EMAIL]', phone: '[PHONE]', message: 'Hello world' }
- *
- * // Redact specific fields
- * const sanitized2 = sanitizeInput(data, ['email', 'ssn']);
- *
- * // Custom sanitizer
- * const sanitized3 = sanitizeInput(data, (key, value) => {
- *   if (key === 'secret') return '[REDACTED]';
- *   return value;
- * });
- * ```
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PII_PATTERNS = exports.REDACTION_TOKENS = void 0;
-exports.isEmail = isEmail;
-exports.isPhone = isPhone;
-exports.isCreditCard = isCreditCard;
-exports.isSSN = isSSN;
-exports.isIPv4 = isIPv4;
-exports.detectPIIType = detectPIIType;
-exports.redactPIIFromText = redactPIIFromText;
-exports.sanitizeInput = sanitizeInput;
-exports.createSanitizer = createSanitizer;
-exports.detectPII = detectPII;
-/**
- * Redaction placeholder tokens
- */
-exports.REDACTION_TOKENS = {
-    EMAIL: '[EMAIL]',
-    PHONE: '[PHONE]',
-    CARD: '[CARD]',
-    ID: '[ID]',
-    IP: '[IP]',
-    REDACTED: '[REDACTED]',
-};
-/**
- * PII detection patterns
- */
-exports.PII_PATTERNS = {
-    // Email: user@domain.tld
-    email: /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/,
-    // Email embedded in text
-    emailInText: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g,
-    // Phone: Various formats (US-centric but flexible)
-    phone: /^[+]?[(]?[0-9]{1,4}[)]?[-\s.]?[0-9]{1,4}[-\s.]?[0-9]{1,9}$/,
-    // Phone embedded in text
-    phoneInText: /(?:\+?1[-.\s]?)?\(?[0-9]{3}\)?[-.\s]?[0-9]{3}[-.\s]?[0-9]{4}/g,
-    // Credit card: 13-19 digits (with optional separators)
-    creditCard: /^(?:[0-9]{4}[-\s]?){3,4}[0-9]{1,4}$/,
-    // Credit card embedded in text
-    creditCardInText: /\b(?:[0-9]{4}[-\s]?){3,4}[0-9]{1,4}\b/g,
-    // SSN: XXX-XX-XXXX
-    ssn: /^[0-9]{3}[-]?[0-9]{2}[-]?[0-9]{4}$/,
-    // SSN embedded in text
-    ssnInText: /\b[0-9]{3}[-]?[0-9]{2}[-]?[0-9]{4}\b/g,
-    // IPv4 address
-    ipv4: /^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/,
-    // IPv4 embedded in text
-    ipv4InText: /\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b/g,
-};
-/**
- * Check if a string matches an email pattern
- */
-function isEmail(value) {
-    return exports.PII_PATTERNS.email.test(value);
-}
-/**
- * Check if a string matches a phone pattern
- */
-function isPhone(value) {
-    return exports.PII_PATTERNS.phone.test(value);
-}
-/**
- * Check if a string matches a credit card pattern
- */
-function isCreditCard(value) {
-    // Remove separators for digit count check
-    const digits = value.replace(/[-\s]/g, '');
-    return digits.length >= 13 && digits.length <= 19 && exports.PII_PATTERNS.creditCard.test(value);
-}
-/**
- * Check if a string matches an SSN pattern
- */
-function isSSN(value) {
-    return exports.PII_PATTERNS.ssn.test(value);
-}
-/**
- * Check if a string matches an IPv4 pattern
- */
-function isIPv4(value) {
-    return exports.PII_PATTERNS.ipv4.test(value);
-}
-/**
- * Detect PII type in a string value
- */
-function detectPIIType(value) {
-    if (isEmail(value))
-        return 'EMAIL';
-    if (isCreditCard(value))
-        return 'CARD';
-    if (isSSN(value))
-        return 'ID';
-    if (isPhone(value))
-        return 'PHONE';
-    if (isIPv4(value))
-        return 'IP';
-    return null;
-}
-/**
- * Redact PII patterns from text
- */
-function redactPIIFromText(text) {
-    let result = text;
-    // Order matters - more specific patterns first
-    result = result.replace(exports.PII_PATTERNS.creditCardInText, exports.REDACTION_TOKENS.CARD);
-    result = result.replace(exports.PII_PATTERNS.ssnInText, exports.REDACTION_TOKENS.ID);
-    result = result.replace(exports.PII_PATTERNS.emailInText, exports.REDACTION_TOKENS.EMAIL);
-    result = result.replace(exports.PII_PATTERNS.phoneInText, exports.REDACTION_TOKENS.PHONE);
-    result = result.replace(exports.PII_PATTERNS.ipv4InText, exports.REDACTION_TOKENS.IP);
-    return result;
-}
-/**
- * Sanitize a value based on its type
- */
-function sanitizeValue(key, value, path, options, depth, visited) {
-    const maxDepth = options.maxDepth ?? 10;
-    // Prevent infinite recursion
-    if (depth > maxDepth) {
-        return value;
-    }
-    // Handle null/undefined
-    if (value === null || value === undefined) {
-        return value;
-    }
-    // Handle custom sanitizer function
-    if (typeof options.mode === 'function') {
-        return options.mode(key, value, path);
-    }
-    // Handle field name list
-    if (Array.isArray(options.mode)) {
-        const lowerKey = key.toLowerCase();
-        if (options.mode.some((f) => f.toLowerCase() === lowerKey)) {
-            return exports.REDACTION_TOKENS.REDACTED;
-        }
-        // Continue to recurse into objects/arrays
-    }
-    // Handle string values
-    if (typeof value === 'string') {
-        // Auto-detect mode: check if entire string is PII
-        if (options.mode === true) {
-            const piiType = detectPIIType(value);
-            if (piiType) {
-                return exports.REDACTION_TOKENS[piiType];
-            }
-            // Check for PII patterns embedded in text
-            if (options.sanitizeInText !== false) {
-                const redacted = redactPIIFromText(value);
-                if (redacted !== value) {
-                    return redacted;
-                }
-            }
-        }
-        return value;
-    }
-    // Handle arrays
-    if (Array.isArray(value)) {
-        // Check for circular reference
-        if (visited.has(value)) {
-            return exports.REDACTION_TOKENS.REDACTED;
-        }
-        visited.add(value);
-        return value.map((item, index) => sanitizeValue(String(index), item, [...path, String(index)], options, depth + 1, visited));
-    }
-    // Handle objects
-    if (typeof value === 'object') {
-        // Check for circular reference
-        if (visited.has(value)) {
-            return exports.REDACTION_TOKENS.REDACTED;
-        }
-        visited.add(value);
-        const result = {};
-        for (const [k, v] of Object.entries(value)) {
-            result[k] = sanitizeValue(k, v, [...path, k], options, depth + 1, visited);
-        }
-        return result;
-    }
-    // Return primitives as-is
-    return value;
-}
-/**
- * Sanitize input data by redacting PII.
- *
- * @param input - The input data to sanitize
- * @param mode - Sanitization mode:
- *   - `true`: Auto-detect and redact common PII patterns
- *   - `string[]`: Redact values in fields with these names
- *   - `SanitizerFn`: Custom sanitizer function
- * @returns Sanitized copy of the input
- *
- * @example
- * ```typescript
- * // Auto-detect PII
- * sanitizeInput({ email: 'test@example.com' });
- * // { email: '[EMAIL]' }
- *
- * // Redact specific fields
- * sanitizeInput({ password: 'secret', name: 'John' }, ['password']);
- * // { password: '[REDACTED]', name: 'John' }
- *
- * // Custom sanitizer
- * sanitizeInput(data, (key, value) => key === 'token' ? '[TOKEN]' : value);
- * ```
- */
-function sanitizeInput(input, mode = true) {
-    // Return empty object for invalid inputs to maintain type contract
-    if (!input || typeof input !== 'object') {
-        return {};
-    }
-    const options = {
-        mode,
-        maxDepth: 10,
-        sanitizeInText: true,
-    };
-    const visited = new WeakSet();
-    return sanitizeValue('', input, [], options, 0, visited);
-}
-/**
- * Create a reusable sanitizer function with preset options.
- *
- * @param mode - Sanitization mode
- * @returns Sanitizer function
- *
- * @example
- * ```typescript
- * const sanitizer = createSanitizer(['email', 'phone', 'ssn']);
- *
- * const clean1 = sanitizer(userData1);
- * const clean2 = sanitizer(userData2);
- * ```
- */
-function createSanitizer(mode = true) {
-    return (input) => sanitizeInput(input, mode);
-}
-/**
- * Check if an object contains any detected PII.
- * Does not modify the input.
- *
- * @param input - The input to check
- * @param options - Optional configuration
- * @param options.maxDepth - Maximum recursion depth (default: 10)
- * @returns Object with boolean `hasPII` and `fields` array of field paths
- */
-function detectPII(input, options) {
-    const maxDepth = options?.maxDepth ?? 10;
-    const fields = [];
-    const visited = new WeakSet();
-    const check = (value, path, depth) => {
-        // Prevent stack overflow on deeply nested structures
-        if (depth > maxDepth)
-            return;
-        if (value === null || value === undefined)
-            return;
-        if (typeof value === 'string') {
-            if (detectPIIType(value)) {
-                fields.push(path.join('.'));
-            }
-            return;
-        }
-        if (Array.isArray(value)) {
-            // Check for circular reference
-            if (visited.has(value))
-                return;
-            visited.add(value);
-            value.forEach((item, index) => check(item, [...path, String(index)], depth + 1));
-            return;
-        }
-        if (typeof value === 'object') {
-            // Check for circular reference
-            if (visited.has(value))
-                return;
-            visited.add(value);
-            for (const [k, v] of Object.entries(value)) {
-                check(v, [...path, k], depth + 1);
-            }
-        }
-    };
-    check(input, [], 0);
-    return {
-        hasPII: fields.length > 0,
-        fields,
-    };
-}
-//# sourceMappingURL=sanitizer.js.map

package/src/runtime/sanitizer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sanitizer.js","sourceRoot":"","sources":["../../../src/runtime/sanitizer.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;;;AAkFH,0BAEC;AAKD,0BAEC;AAKD,oCAIC;AAKD,sBAEC;AAKD,wBAEC;AAKD,sCAOC;AAKD,8CAWC;AAkHD,sCAiBC;AAgBD,0CAIC;AAWD,8BAgDC;AA9VD;;GAEG;AACU,QAAA,gBAAgB,GAAG;IAC9B,KAAK,EAAE,SAAS;IAChB,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,QAAQ;IACd,EAAE,EAAE,MAAM;IACV,EAAE,EAAE,MAAM;IACV,QAAQ,EAAE,YAAY;CACd,CAAC;AAEX;;GAEG;AACU,QAAA,YAAY,GAAG;IAC1B,yBAAyB;IACzB,KAAK,EAAE,kDAAkD;IAEzD,yBAAyB;IACzB,WAAW,EAAE,iDAAiD;IAE9D,mDAAmD;IACnD,KAAK,EAAE,4DAA4D;IAEnE,yBAAyB;IACzB,WAAW,EAAE,+DAA+D;IAE5E,uDAAuD;IACvD,UAAU,EAAE,qCAAqC;IAEjD,+BAA+B;IAC/B,gBAAgB,EAAE,wCAAwC;IAE1D,mBAAmB;IACnB,GAAG,EAAE,oCAAoC;IAEzC,uBAAuB;IACvB,SAAS,EAAE,uCAAuC;IAElD,eAAe;IACf,IAAI,EAAE,6FAA6F;IAEnG,wBAAwB;IACxB,UAAU,EAAE,gGAAgG;CAC7G,CAAC;AAgCF;;GAEG;AACH,SAAgB,OAAO,CAAC,KAAa;IACnC,OAAO,oBAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,SAAgB,OAAO,CAAC,KAAa;IACnC,OAAO,oBAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,SAAgB,YAAY,CAAC,KAAa;IACxC,0CAA0C;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,MAAM,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,IAAI,oBAAY,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC;AAED;;GAEG;AACH,SAAgB,KAAK,CAAC,KAAa;IACjC,OAAO,oBAAY,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,SAAgB,MAAM,CAAC,KAAa;IAClC,OAAO,oBAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa,CAAC,KAAa;IACzC,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACnC,IAAI,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACvC,IAAI,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACnC,IAAI,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAAC,IAAY;IAC5C,IAAI,MAAM,GAAG,IAAI,CAAC;IAElB,+CAA+C;IAC/C,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,oBAAY,CAAC,gBAAgB,EAAE,wBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,oBAAY,CAAC,SAAS,EAAE,wBAAgB,CAAC,EAAE,CAAC,CAAC;IACrE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,oBAAY,CAAC,WAAW,EAAE,wBAAgB,CAAC,KAAK,CAAC,CAAC;IAC1E,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,oBAAY,CAAC,WAAW,EAAE,wBAAgB,CAAC,KAAK,CAAC,CAAC;IAC1E,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,oBAAY,CAAC,UAAU,EAAE,wBAAgB,CAAC,EAAE,CAAC,CAAC;IAEtE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CACpB,GAAW,EACX,KAAc,EACd,IAAc,EACd,OAAwB,EACxB,KAAa,EACb,OAAwB;IAExB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IAExC,6BAA6B;IAC7B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,wBAAwB;IACxB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mCAAmC;IACnC,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,yBAAyB;IACzB,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC3D,OAAO,wBAAgB,CAAC,QAAQ,CAAC;QACnC,CAAC;QACD,0CAA0C;IAC5C,CAAC;IAED,uBAAuB;IACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,kDAAkD;QAClD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,wBAAgB,CAAC,OAAO,CAAC,CAAC;YACnC,CAAC;YAED,0CAA0C;YAC1C,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;gBACrC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAC1C,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;oBACvB,OAAO,QAAQ,CAAC;gBAClB,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,gBAAgB;IAChB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,+BAA+B;QAC/B,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,wBAAgB,CAAC,QAAQ,CAAC;QACnC,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC/B,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,EAAE,OAAO,CAAC,CAC1F,CAAC;IACJ,CAAC;IAED,iBAAiB;IACjB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,+BAA+B;QAC/B,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,wBAAgB,CAAC,QAAQ,CAAC;QACnC,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,MAAM,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,0BAA0B;IAC1B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAgB,aAAa,CAC3B,KAA8B,EAC9B,OAAsC,IAAI;IAE1C,mEAAmE;IACnE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAoB;QAC/B,IAAI;QACJ,QAAQ,EAAE,EAAE;QACZ,cAAc,EAAE,IAAI;KACrB,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,OAAO,EAAU,CAAC;IACtC,OAAO,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,CAA4B,CAAC;AACtF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAgB,eAAe,CAC7B,OAAsC,IAAI;IAE1C,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,SAAS,CACvB,KAA8B,EAC9B,OAA+B;IAK/B,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,EAAE,CAAC;IACzC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,OAAO,EAAU,CAAC;IAEtC,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,IAAc,EAAE,KAAa,EAAQ,EAAE;QACpE,qDAAqD;QACrD,IAAI,KAAK,GAAG,QAAQ;YAAE,OAAO;QAE7B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAElD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9B,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,+BAA+B;YAC/B,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO;YAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACnB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;YACjF,OAAO;QACT,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,+BAA+B;YAC/B,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO;YAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACnB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;gBACtE,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAEpB,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC;QACzB,MAAM;KACP,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Input Sanitizer\n *\n * Provides PII detection and redaction for tool inputs before they are\n * exposed to widget code. This protects sensitive data from being\n * accidentally exposed in client-side widgets.\n *\n * Built-in patterns:\n * - Email addresses → [EMAIL]\n * - Phone numbers → [PHONE]\n * - Credit card numbers → [CARD]\n * - SSN / National IDs → [ID]\n * - IP addresses → [IP]\n *\n * @example\n * ```typescript\n * import { sanitizeInput, createSanitizer } from './sanitizer';\n *\n * // Auto-detect and redact PII\n * const sanitized = sanitizeInput({\n *   user: 'john@example.com',\n *   phone: '555-123-4567',\n *   message: 'Hello world',\n * });\n * // Result: { user: '[EMAIL]', phone: '[PHONE]', message: 'Hello world' }\n *\n * // Redact specific fields\n * const sanitized2 = sanitizeInput(data, ['email', 'ssn']);\n *\n * // Custom sanitizer\n * const sanitized3 = sanitizeInput(data, (key, value) => {\n *   if (key === 'secret') return '[REDACTED]';\n *   return value;\n * });\n * ```\n */\n\n/**\n * Redaction placeholder tokens\n */\nexport const REDACTION_TOKENS = {\n  EMAIL: '[EMAIL]',\n  PHONE: '[PHONE]',\n  CARD: '[CARD]',\n  ID: '[ID]',\n  IP: '[IP]',\n  REDACTED: '[REDACTED]',\n} as const;\n\n/**\n * PII detection patterns\n */\nexport const PII_PATTERNS = {\n  // Email: user@domain.tld\n  email: /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$/,\n\n  // Email embedded in text\n  emailInText: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}/g,\n\n  // Phone: Various formats (US-centric but flexible)\n  phone: /^[+]?[(]?[0-9]{1,4}[)]?[-\\s.]?[0-9]{1,4}[-\\s.]?[0-9]{1,9}$/,\n\n  // Phone embedded in text\n  phoneInText: /(?:\\+?1[-.\\s]?)?\\(?[0-9]{3}\\)?[-.\\s]?[0-9]{3}[-.\\s]?[0-9]{4}/g,\n\n  // Credit card: 13-19 digits (with optional separators)\n  creditCard: /^(?:[0-9]{4}[-\\s]?){3,4}[0-9]{1,4}$/,\n\n  // Credit card embedded in text\n  creditCardInText: /\\b(?:[0-9]{4}[-\\s]?){3,4}[0-9]{1,4}\\b/g,\n\n  // SSN: XXX-XX-XXXX\n  ssn: /^[0-9]{3}[-]?[0-9]{2}[-]?[0-9]{4}$/,\n\n  // SSN embedded in text\n  ssnInText: /\\b[0-9]{3}[-]?[0-9]{2}[-]?[0-9]{4}\\b/g,\n\n  // IPv4 address\n  ipv4: /^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/,\n\n  // IPv4 embedded in text\n  ipv4InText: /\\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\b/g,\n};\n\n/**\n * Custom sanitizer function type\n */\nexport type SanitizerFn = (key: string, value: unknown, path: string[]) => unknown;\n\n/**\n * Sanitizer options\n */\nexport interface SanitizeOptions {\n  /**\n   * How to handle PII detection:\n   * - true: Auto-detect and redact common PII patterns\n   * - string[]: Only redact values in fields with these names\n   * - SanitizerFn: Custom sanitizer function\n   */\n  mode: true | string[] | SanitizerFn;\n\n  /**\n   * Maximum depth for recursive sanitization\n   * @default 10\n   */\n  maxDepth?: number;\n\n  /**\n   * Whether to sanitize PII patterns within string values\n   * @default true\n   */\n  sanitizeInText?: boolean;\n}\n\n/**\n * Check if a string matches an email pattern\n */\nexport function isEmail(value: string): boolean {\n  return PII_PATTERNS.email.test(value);\n}\n\n/**\n * Check if a string matches a phone pattern\n */\nexport function isPhone(value: string): boolean {\n  return PII_PATTERNS.phone.test(value);\n}\n\n/**\n * Check if a string matches a credit card pattern\n */\nexport function isCreditCard(value: string): boolean {\n  // Remove separators for digit count check\n  const digits = value.replace(/[-\\s]/g, '');\n  return digits.length >= 13 && digits.length <= 19 && PII_PATTERNS.creditCard.test(value);\n}\n\n/**\n * Check if a string matches an SSN pattern\n */\nexport function isSSN(value: string): boolean {\n  return PII_PATTERNS.ssn.test(value);\n}\n\n/**\n * Check if a string matches an IPv4 pattern\n */\nexport function isIPv4(value: string): boolean {\n  return PII_PATTERNS.ipv4.test(value);\n}\n\n/**\n * Detect PII type in a string value\n */\nexport function detectPIIType(value: string): keyof typeof REDACTION_TOKENS | null {\n  if (isEmail(value)) return 'EMAIL';\n  if (isCreditCard(value)) return 'CARD';\n  if (isSSN(value)) return 'ID';\n  if (isPhone(value)) return 'PHONE';\n  if (isIPv4(value)) return 'IP';\n  return null;\n}\n\n/**\n * Redact PII patterns from text\n */\nexport function redactPIIFromText(text: string): string {\n  let result = text;\n\n  // Order matters - more specific patterns first\n  result = result.replace(PII_PATTERNS.creditCardInText, REDACTION_TOKENS.CARD);\n  result = result.replace(PII_PATTERNS.ssnInText, REDACTION_TOKENS.ID);\n  result = result.replace(PII_PATTERNS.emailInText, REDACTION_TOKENS.EMAIL);\n  result = result.replace(PII_PATTERNS.phoneInText, REDACTION_TOKENS.PHONE);\n  result = result.replace(PII_PATTERNS.ipv4InText, REDACTION_TOKENS.IP);\n\n  return result;\n}\n\n/**\n * Sanitize a value based on its type\n */\nfunction sanitizeValue(\n  key: string,\n  value: unknown,\n  path: string[],\n  options: SanitizeOptions,\n  depth: number,\n  visited: WeakSet<object>,\n): unknown {\n  const maxDepth = options.maxDepth ?? 10;\n\n  // Prevent infinite recursion\n  if (depth > maxDepth) {\n    return value;\n  }\n\n  // Handle null/undefined\n  if (value === null || value === undefined) {\n    return value;\n  }\n\n  // Handle custom sanitizer function\n  if (typeof options.mode === 'function') {\n    return options.mode(key, value, path);\n  }\n\n  // Handle field name list\n  if (Array.isArray(options.mode)) {\n    const lowerKey = key.toLowerCase();\n    if (options.mode.some((f) => f.toLowerCase() === lowerKey)) {\n      return REDACTION_TOKENS.REDACTED;\n    }\n    // Continue to recurse into objects/arrays\n  }\n\n  // Handle string values\n  if (typeof value === 'string') {\n    // Auto-detect mode: check if entire string is PII\n    if (options.mode === true) {\n      const piiType = detectPIIType(value);\n      if (piiType) {\n        return REDACTION_TOKENS[piiType];\n      }\n\n      // Check for PII patterns embedded in text\n      if (options.sanitizeInText !== false) {\n        const redacted = redactPIIFromText(value);\n        if (redacted !== value) {\n          return redacted;\n        }\n      }\n    }\n\n    return value;\n  }\n\n  // Handle arrays\n  if (Array.isArray(value)) {\n    // Check for circular reference\n    if (visited.has(value)) {\n      return REDACTION_TOKENS.REDACTED;\n    }\n    visited.add(value);\n    return value.map((item, index) =>\n      sanitizeValue(String(index), item, [...path, String(index)], options, depth + 1, visited),\n    );\n  }\n\n  // Handle objects\n  if (typeof value === 'object') {\n    // Check for circular reference\n    if (visited.has(value)) {\n      return REDACTION_TOKENS.REDACTED;\n    }\n    visited.add(value);\n    const result: Record<string, unknown> = {};\n    for (const [k, v] of Object.entries(value as Record<string, unknown>)) {\n      result[k] = sanitizeValue(k, v, [...path, k], options, depth + 1, visited);\n    }\n    return result;\n  }\n\n  // Return primitives as-is\n  return value;\n}\n\n/**\n * Sanitize input data by redacting PII.\n *\n * @param input - The input data to sanitize\n * @param mode - Sanitization mode:\n *   - `true`: Auto-detect and redact common PII patterns\n *   - `string[]`: Redact values in fields with these names\n *   - `SanitizerFn`: Custom sanitizer function\n * @returns Sanitized copy of the input\n *\n * @example\n * ```typescript\n * // Auto-detect PII\n * sanitizeInput({ email: 'test@example.com' });\n * // { email: '[EMAIL]' }\n *\n * // Redact specific fields\n * sanitizeInput({ password: 'secret', name: 'John' }, ['password']);\n * // { password: '[REDACTED]', name: 'John' }\n *\n * // Custom sanitizer\n * sanitizeInput(data, (key, value) => key === 'token' ? '[TOKEN]' : value);\n * ```\n */\nexport function sanitizeInput(\n  input: Record<string, unknown>,\n  mode: true | string[] | SanitizerFn = true,\n): Record<string, unknown> {\n  // Return empty object for invalid inputs to maintain type contract\n  if (!input || typeof input !== 'object') {\n    return {};\n  }\n\n  const options: SanitizeOptions = {\n    mode,\n    maxDepth: 10,\n    sanitizeInText: true,\n  };\n\n  const visited = new WeakSet<object>();\n  return sanitizeValue('', input, [], options, 0, visited) as Record<string, unknown>;\n}\n\n/**\n * Create a reusable sanitizer function with preset options.\n *\n * @param mode - Sanitization mode\n * @returns Sanitizer function\n *\n * @example\n * ```typescript\n * const sanitizer = createSanitizer(['email', 'phone', 'ssn']);\n *\n * const clean1 = sanitizer(userData1);\n * const clean2 = sanitizer(userData2);\n * ```\n */\nexport function createSanitizer(\n  mode: true | string[] | SanitizerFn = true,\n): (input: Record<string, unknown>) => Record<string, unknown> {\n  return (input) => sanitizeInput(input, mode);\n}\n\n/**\n * Check if an object contains any detected PII.\n * Does not modify the input.\n *\n * @param input - The input to check\n * @param options - Optional configuration\n * @param options.maxDepth - Maximum recursion depth (default: 10)\n * @returns Object with boolean `hasPII` and `fields` array of field paths\n */\nexport function detectPII(\n  input: Record<string, unknown>,\n  options?: { maxDepth?: number },\n): {\n  hasPII: boolean;\n  fields: string[];\n} {\n  const maxDepth = options?.maxDepth ?? 10;\n  const fields: string[] = [];\n  const visited = new WeakSet<object>();\n\n  const check = (value: unknown, path: string[], depth: number): void => {\n    // Prevent stack overflow on deeply nested structures\n    if (depth > maxDepth) return;\n\n    if (value === null || value === undefined) return;\n\n    if (typeof value === 'string') {\n      if (detectPIIType(value)) {\n        fields.push(path.join('.'));\n      }\n      return;\n    }\n\n    if (Array.isArray(value)) {\n      // Check for circular reference\n      if (visited.has(value)) return;\n      visited.add(value);\n      value.forEach((item, index) => check(item, [...path, String(index)], depth + 1));\n      return;\n    }\n\n    if (typeof value === 'object') {\n      // Check for circular reference\n      if (visited.has(value)) return;\n      visited.add(value);\n      for (const [k, v] of Object.entries(value as Record<string, unknown>)) {\n        check(v, [...path, k], depth + 1);\n      }\n    }\n  };\n\n  check(input, [], 0);\n\n  return {\n    hasPII: fields.length > 0,\n    fields,\n  };\n}\n"]}