@link-foundation/sensitive-data-sanitizer 0.0.0-stage → 0.11.31

package/src/identity.js

@@ -0,0 +1,274 @@
+import { collectMatches } from './detection.js';
+
+export const identityTypes = new Set([
+  'SSN',
+  'US_SSN',
+  'BRAZIL_CPF_NUMBER',
+  'INDIA_PAN_INDIVIDUAL',
+  'UK_NATIONAL_INSURANCE_NUMBER',
+  'SPAIN_DNI_NUMBER',
+  'US_HEALTHCARE_NPI',
+  'DRIVER_LICENSE',
+  'DRIVERS_LICENSE',
+  'NATIONAL_ID',
+  'CHINA_RESIDENT_ID_NUMBER',
+  'HONG_KONG_ID_NUMBER',
+  'SOUTH_AFRICA_ID_NUMBER',
+  'TAIWAN_ID_NUMBER',
+  'TURKEY_ID_NUMBER',
+  'GOVERNMENT_ID',
+  'DOD_ID_NUMBER',
+  'JAPAN_INDIVIDUAL_NUMBER',
+  'INDIA_GST_INDIVIDUAL',
+  'US_MEDICARE_BENEFICIARY_ID_NUMBER',
+  'ID',
+  'PASSPORT_NUMBER',
+  'PASSPORT_MRZ',
+  'BOOKING_REFERENCE',
+  'TICKET_NUMBER',
+  'VISA_NUMBER',
+  'UK_NHS',
+  'KR_RRN',
+  'IT_FISCAL_CODE',
+  'SG_NRIC_FIN',
+  'PL_PESEL',
+  'SE_PERSONNUMMER',
+  'ZA_ID_NUMBER',
+  'AU_TFN',
+  'CA_SIN',
+  'RU_SNILS',
+  'RU_INN',
+]);
+export function isIdentityType(type) {
+  return (
+    identityTypes.has(type) ||
+    /PASSPORT|(?:DRIVERS?|DRIVING)_?LICENSE|IDENTITY|NATIONAL_?(?:ID|IDENTIFICATION)|PERSONAL_?(?:ID|IDENTIFICATION)|UNIQUE_?IDENTIFICATION|SOCIAL_?(?:SECURITY|INSURANCE|IDENTIFICATION)|RESIDENT_?REGISTRATION|(?:TAX|TAXPAYER).*?(?:IDENTIFICATION|NUMBER|REFERENCE)|AADHAAR|FISCAL_CODE|PESEL|RRN|NHS|SNILS|INN_NUMBER/.test(
+      type
+    )
+  );
+}
+const personal = (type, rule, confidence = 0.85) => ({
+  type,
+  rule,
+  category: 'personal',
+  confidence,
+});
+const passportContext =
+  /(?<![\p{L}\p{N}_])(?:passports?|series and number|document number|паспорт[\p{L}]*|загран[\p{L}]*|серия|номер|pasaporte|Reisepass|passeport|passaporto|护照|パスポート)(?![\p{L}\p{N}_])/iu;
+
+export function mrzCheck(value) {
+  let sum = 0;
+  for (let i = 0; i < value.length; i++) {
+    const char = value[i];
+    const digit =
+      char === '<'
+        ? 0
+        : /\d/.test(char)
+          ? Number(char)
+          : char.charCodeAt(0) - 55;
+    sum += digit * [7, 3, 1][i % 3];
+  }
+  return String(sum % 10);
+}
+function mrzConfidence(value) {
+  const compact = value.replace(/[ \t\r\n]/g, '');
+  const match =
+    /^([A-Z0-9<]{9})([\d<])[A-Z<]{3}(\d{6})(\d)[MF<](\d{6})([\d<])/.exec(
+      compact
+    );
+  if (match) {
+    return mrzCheck(match[1]) === match[2] &&
+      mrzCheck(match[3]) === match[4] &&
+      mrzCheck(match[5]) === match[6]
+      ? 0.99
+      : 0.85;
+  }
+  const td1Header = /^[IAC][A-Z<][A-Z<]{3}([A-Z0-9<]{9})([\d<])/.exec(compact);
+  if (td1Header) {
+    return mrzCheck(td1Header[1]) === td1Header[2] ? 0.99 : 0.85;
+  }
+  const td1Data = /^([\d<]{6})(\d)[MF<]([\d<]{6})(\d)[A-Z<]{3}/.exec(compact);
+  return td1Data &&
+    mrzCheck(td1Data[1]) === td1Data[2] &&
+    mrzCheck(td1Data[3]) === td1Data[4]
+    ? 0.99
+    : 0.85;
+}
+function detectMrz(text, emit) {
+  // Each candidate has a finite span. Checks improve confidence, never gate
+  // redaction: OCR damage and truncated personal data remain sensitive.
+  const patterns = [
+    /(?<![A-Za-z0-9_])[PIACV][A-Z<][ \t\r\n]{0,4}[A-Z<]{3}[ \t\r\n]{0,4}[A-Z0-9<][A-Z0-9< \t\r\n]{8,100}/g,
+    /(?<![A-Za-z0-9_])[A-Z]{2,30}<<[A-Z< \t\r\n]{2,72}/g,
+    /(?<![A-Za-z0-9_])[A-Z0-9<]{9}[\d<][ \t\r\n]{0,4}[A-Z<]{3}[ \t\r\n]{0,4}[\d<]{6}[\d<][ \t\r\n]{0,4}[MF<][ \t\r\n]{0,4}[\d<]{6}[\d<][A-Z0-9< \t\r\n]{0,40}/g,
+    /(?<![A-Za-z0-9_])[\d<]{6}[\d<][ \t\r\n]{0,4}[MF<][ \t\r\n]{0,4}[\d<]{6}[\d<][ \t\r\n]{0,4}[A-Z<]{3}[A-Z0-9< \t\r\n]{4,20}/g,
+    /(?<![A-Za-z0-9_])[A-Z0-9<]{9}[\d<][ \t\r\n]{0,4}[A-Z<]{3}[ \t\r\n]{0,4}\d{6}(?:\d[ \t\r\n]{0,4}[MF<](?:[ \t\r\n]{0,4}[\d<]{1,7})?)?/g,
+  ];
+  patterns.forEach((pattern, index) => {
+    for (const match of text.matchAll(pattern)) {
+      const value = (
+          /[a-z]/.test(text[match.index + match[0].length] ?? '')
+            ? match[0].replace(/(?:[ \t\r\n]+)[A-Z]{1,6}$/, '')
+            : match[0]
+        ).trimEnd(),
+        compact = value.replace(/[ \t\r\n]/g, '');
+      const validShape =
+        index === 0
+          ? /^[PIACV][A-Z<][A-Z<]{3}(?:[A-Z]{2,}<<[A-Z<]+|[A-Z0-9<]{9}[\d<]<{2,})/.test(
+              compact
+            )
+          : index === 1
+            ? /^[A-Z]{2,}<<[A-Z]+</.test(compact)
+            : index === 3
+              ? /\d/.test(compact.slice(0, 7))
+              : /[A-Z0-9]/.test(compact.slice(0, 9));
+      if (validShape) {
+        emit({
+          start: match.index,
+          end: match.index + value.length,
+          ...personal('PASSPORT_MRZ', 'mrz', mrzConfidence(value)),
+        });
+      }
+    }
+  });
+}
+function numericNeighbour(text, start, end) {
+  return (
+    /\d[ ()+.-]{0,4}$/.test(text.slice(Math.max(0, start - 5), start)) ||
+    /^[ ()+.-]{0,4}\d/.test(text.slice(end, end + 5))
+  );
+}
+function detectPassports(text, emit) {
+  const patterns = [
+    /(?<![\p{L}\p{N}_])(?:\d{2}[ -]\d{2}[ -]\d{6}|\d{4}[ -]\d{6}|\d{2}[ -]\d{7})(?![\p{L}\p{N}_])/gu,
+    /(?<![\p{L}\p{N}_])(?:\d{9}|[CFGHJK][0-9CFGHJKLMNPRTVWXYZ]{8}|[A-Z]\d{7}|M\d{3}[A-Z]\d{4}|[A-Z]{2}\d{7})(?![\p{L}\p{N}_])/gu,
+    /(?<![\p{L}\p{N}_])[A-Z0-9<]{9}\d(?![\p{L}\p{N}_])/gu,
+  ];
+  patterns.forEach((pattern, index) => {
+    for (const match of text.matchAll(pattern)) {
+      const value = match[0],
+        start = match.index,
+        end = start + value.length;
+      const context = text.slice(
+        Math.max(0, start - 80),
+        Math.min(text.length, end + 80)
+      );
+      const checked =
+        index === 2 &&
+        /[A-Z]/.test(value) &&
+        mrzCheck(value.slice(0, 9)) === value[9];
+      if ((index === 2 && !checked) || numericNeighbour(text, start, end)) {
+        continue;
+      }
+      if (
+        /^\d+$/.test(value) &&
+        /(?:timestamp|epoch|version|commit|thread|call)[ :=_-]*$/i.test(
+          text.slice(Math.max(0, start - 24), start)
+        )
+      ) {
+        continue;
+      }
+      emit({
+        start,
+        end,
+        ...personal(
+          'PASSPORT_NUMBER',
+          'passport-format',
+          checked ? 0.99 : passportContext.test(context) ? 0.9 : 0.4
+        ),
+      });
+    }
+  });
+}
+const booking =
+  /(?<![\p{L}\p{N}_])(?:booking(?:[ _-]+(?:reference|code))?|reservation(?:[ _-]+code)?|confirmation(?:[ _-]+code)?|бронь|record[ _-]+locator|PNR|код брони|номер брони|бронирование)[ \t]*[:=：]?[ \t]*[`"']?([A-Z0-9]{4,8})(?![\p{L}\p{N}_])/giu;
+const ticket =
+  /(?<![\p{L}\p{N}_])(?:e[ -]?ticket|ticket[ _-]*(?:number|no)?|номер билета|электронный билет)[ \t]*[:=：]?[ \t]*[`"']?(\d{3}[ -]?\d{10})(?![\p{L}\p{N}_])/giu;
+const visa =
+  /(?<![\p{L}\p{N}_])(?:e[ -]?visa|visa|номер визы|виза)(?:[ \t_-]+(?:registration|application|number|no|code|номер|код)){0,3}[ \t]*[:=：]?[ \t]*[`"']?([A-Z0-9][A-Z0-9-]{4,31})(?![\p{L}\p{N}_])/giu;
+const placeholder =
+  /^(?:NONE|UNKNOWN|NULL|UNDEFINED|REDACTED|EXAMPLE|SAMPLE|PENDING|HOTEL|BOOKING|REFERENCE|REGISTRATION|APPLICATION|NUMBER|CODE|FAILED|ERROR|HTTP|OK|CANCELLED|CONFIRMED|SUCCESS|READY|ACTIVE|CLOSED)$/i;
+function detectTravel(text, emit) {
+  collectMatches(
+    text,
+    booking,
+    emit,
+    personal('BOOKING_REFERENCE', 'booking-context'),
+    1,
+    (v) => !placeholder.test(v) && (v === v.toUpperCase() || /\d/.test(v))
+  );
+  collectMatches(
+    text,
+    /(?:AirIndia|Air-?India|AirFrance|BritishAirways|Lufthansa|Emirates|Qatar|Delta|United|Ryanair|Aeroflot|Аэрофлот)[-_]([A-Z0-9]{5,8})(?=[-_.])/g,
+    emit,
+    personal('BOOKING_REFERENCE', 'booking-filename', 0.9),
+    1,
+    (v) => !placeholder.test(v)
+  );
+  collectMatches(
+    text,
+    ticket,
+    emit,
+    personal('TICKET_NUMBER', 'ticket-context'),
+    1
+  );
+  collectMatches(
+    text,
+    visa,
+    emit,
+    personal('VISA_NUMBER', 'visa-context'),
+    1,
+    (v) => !placeholder.test(v) && /\d/.test(v)
+  );
+}
+
+export function detectIdentity(text, emit) {
+  detectMrz(text, emit);
+  detectPassports(text, emit);
+  detectTravel(text, emit);
+}
+
+export function fakeIdentityValue(value, type, options) {
+  if (!isIdentityType(type)) {
+    return false;
+  }
+  if (options.fakeValues?.includes(value)) {
+    return true;
+  }
+  if (options.fakeIdentity !== 'specimen-and-synthetic') {
+    return false;
+  }
+  const compact = value.replace(/\s/g, '').toUpperCase();
+  if (/^(?:SPECIMEN|ОБРАЗЕЦ|MUSTERMANN)$/.test(compact)) {
+    return true;
+  }
+  if (type === 'PASSPORT_MRZ') {
+    if (
+      /^[PIACV][A-Z<]UTO/.test(compact) ||
+      /^(?:UTO)?ERIKSSON<<ANNA<MARIA</.test(compact) ||
+      /^L898902C3[\d<]UTO/.test(compact) ||
+      /^[\d<]{7}[MF<][\d<]{7}UTO/.test(compact)
+    ) {
+      return true;
+    }
+    const document = /^[PIACV][A-Z<][A-Z<]{3}/.test(compact)
+      ? compact.slice(5, 14)
+      : compact.slice(0, 9);
+    return (
+      /^(?:C01X00T47|T22000129)$/.test(document) || syntheticDocument(document)
+    );
+  }
+  return (
+    /^(?:L898902C3(?:6)?|D23145890(?:7)?|C01X00T47|T22000129)$/.test(compact) ||
+    syntheticDocument(compact)
+  );
+}
+function syntheticDocument(value) {
+  const digits = value.replace(/[ \t-]/g, '');
+  return (
+    (digits.length >= 5 && /^(\d)\1+$/.test(digits)) ||
+    /012345|123456|234567|345678|456789|987654|876543|765432|654321|543210/.test(
+      digits
+    )
+  );
+}

package/src/index.d.ts

@@ -0,0 +1,321 @@
+export type Category = 'credential' | 'personal';
+/** UTF-16 offsets, zero-based start and exclusive end; never contains source values. */
+export interface Finding {
+  start: number;
+  end: number;
+  category: Category;
+  type: string;
+  rule: string;
+  /** Detector confidence, not a cross-engine probability calibration. */
+  confidence?: number;
+  likelihood?:
+    | 'VERY_UNLIKELY'
+    | 'UNLIKELY'
+    | 'POSSIBLE'
+    | 'LIKELY'
+    | 'VERY_LIKELY';
+  /** One-based line and UTF-16 column, populated by inspect. */
+  line?: number;
+  column?: number;
+  /** Reviewed/generated fake exemption; generated credentials require explicit opt-in. */
+  kept?: 'fake';
+  /** Returned finding replaced with, or recognized as, a generated fake. */
+  faked?: true;
+}
+export interface PersonalValue {
+  type: string;
+  value: string;
+}
+export interface PublicEntity {
+  type: 'PERSON' | 'ORGANIZATION' | 'EMAIL';
+  value: string;
+  /** Organization-controlled HTTPS evidence, reviewed by the policy author. */
+  source: string;
+  /** ISO calendar date. The library does not fetch the evidence. */
+  reviewedAt: string;
+}
+export interface Detector {
+  id?: string;
+  /** Required detectors must throw on failure and return offsets for this exact input. */
+  detect(text: string): Finding[] | Promise<Finding[]>;
+}
+export interface SanitizerOptions {
+  /** Preserve all personal/account data; credential findings still redact. */
+  credentialsOnly?: boolean;
+  profile?: 'publication';
+  confirmedPersonal?: Array<{ value: string; type: string }>;
+  knownSecrets?: string[];
+  knownPersonal?: PersonalValue[];
+  publicEntities?: PublicEntity[];
+  /** Built-in exact public entities/resolvers and role mail on known domains. */
+  publicKnowledge?: boolean;
+  findings?: Finding[];
+  transformation?: Transformation;
+  transformations?: Record<string, Transformation>;
+  preserveEncoding?: boolean;
+  /** First/last two characters and a fixed *** marker for identity values >=5. */
+  identityMask?: boolean;
+  /** Explicit opt-in. Words such as test/fake/example never grant exemptions. */
+  fakeIdentity?: false | 'specimen-and-synthetic';
+  /** Reviewed exact fake identity values, maintained outside published text. */
+  fakeValues?: string[];
+  /** Scan JSON string keys/values in bounded batches and preserve parseability. */
+  structured?: 'json' | 'jsonl';
+  /** Property names whose metadata heuristics may be suppressed. */
+  structuralFields?: string[];
+  /** Personal replacement threshold, default 0.5. Inspect retains lower scores. */
+  minConfidence?: number;
+  /** Alias for minConfidence; specifying both requires equal values. */
+  threshold?: number;
+  /** Explicit network/callback verification; credentials never qualify. */
+  verifyPublic?: (candidate: {
+    type: PublicEntity['type'];
+    value: string;
+  }) => Promise<PublicEntity | undefined>;
+
+  paranoid?: boolean;
+  decode?: boolean;
+  maxInputLength?: number;
+  maxFindings?: number;
+  debug?: (event: { event: 'detected'; count: number }) => void;
+  /** Used by createSanitizer; synchronous functions use native rules only. */
+  detectors?: Detector[];
+  /** Required by default in createSanitizer. */
+  secretlint?: boolean;
+}
+export interface SanitizedText {
+  text: string;
+  findings: Finding[];
+  /** Number of disjoint replacements after overlapping detections are merged. */
+  redactions: number;
+}
+export interface Sanitizer {
+  inspect(text: string): Promise<Finding[]>;
+  sanitize(text: string): Promise<SanitizedText>;
+}
+export interface JsonlSanitizer extends Sanitizer {
+  sanitizeJsonl(text: string): Promise<SanitizedText>;
+}
+export declare const REDACTED: '[REDACTED]';
+export declare function inspect(
+  text: string,
+  options?: SanitizerOptions
+): Finding[];
+export declare function sanitize(
+  text: string,
+  options?: SanitizerOptions
+): SanitizedText;
+/** Apply validated findings; use sanitize for automatic residual verification. */
+export declare function redact(
+  text: string,
+  findings: Finding[],
+  options?: SanitizerOptions
+): string;
+export declare function createSanitizer(
+  options?: SanitizerOptions
+): JsonlSanitizer;
+export declare function entropy(value: string): number;
+export declare function luhn(value: string): boolean;
+export declare function codePointRange(
+  text: string,
+  start: number,
+  end: number
+): { start: number; end: number };
+export declare function byteRange(
+  text: string,
+  start: number,
+  end: number
+): { start: number; end: number };
+export declare function fromGitleaks(
+  text: string,
+  report: Array<{ Secret: string; [key: string]: unknown }>
+): Finding[];
+export declare function fromTrufflehog(
+  text: string,
+  report: Array<{ Raw: string; RawV2?: string; [key: string]: unknown }>
+): Finding[];
+export declare function fromDetectSecrets(
+  text: string,
+  report: {
+    results: Record<
+      string,
+      Array<{ line_number: number; [key: string]: unknown }>
+    >;
+  },
+  filename: string
+): Finding[];
+export declare function fromPresidio(
+  text: string,
+  report: Array<{
+    start: number;
+    end: number;
+    entity_type: string;
+    [key: string]: unknown;
+  }>
+): Finding[];
+export declare function fromOffsetReport(
+  text: string,
+  entries: Array<{
+    start: number;
+    end: number;
+    category: Category;
+    type: string;
+    [key: string]: unknown;
+  }>,
+  options: { unit: 'utf16' | 'codepoint' | 'byte'; rule: string }
+): Finding[];
+export declare function knownSecretsFromEnv(
+  env?: Record<string, string | undefined>,
+  names?: string[]
+): string[];
+/** Reversible UTF-8 view: invalid bytes use unpaired U+DC80..U+DCFF. */
+export declare function decodeLogBytes(bytes: Uint8Array): string;
+/** Encode sanitized text while restoring surrogate-escaped invalid bytes. */
+export declare function encodeLogText(text: string): Uint8Array;
+export declare function knownSecretsFromGitHubConfig(options?: {
+  path?: string;
+}): Promise<string[]>;
+export declare function personalVariants(
+  entries: PersonalValue[]
+): PersonalValue[];
+export interface LocalScannerOptions {
+  command?: string;
+  timeoutMs?: number;
+  maxOutputBytes?: number;
+}
+export declare function createGitleaksDetector(
+  options?: LocalScannerOptions
+): Detector;
+export declare function createTrufflehogDetector(
+  options?: LocalScannerOptions
+): Detector;
+export declare function createPresidioDetector(
+  options: LocalScannerOptions & { args: string[] }
+): Detector;
+export interface HistoryAudit {
+  scanned: number;
+  complete: boolean;
+  findings: Array<{
+    object: string;
+    type: 'blob' | 'commit' | 'tag';
+    findings: Finding[];
+  }>;
+  skipped: Array<{ object: string; reason: string }>;
+}
+export declare function auditGitHistory(
+  repository: string,
+  options?: {
+    sanitizer?: Pick<Sanitizer, 'inspect'>;
+    maxObjects?: number;
+    maxBytes?: number;
+    maxTotalBytes?: number;
+  }
+): Promise<HistoryAudit>;
+export type Transformation =
+  | { mode: 'redact' | 'hive-mask' }
+  | {
+      mode: 'mask';
+      keepStart?: number;
+      keepEnd?: number;
+      marker?: string;
+      minLength?: number;
+    }
+  | { mode: 'pseudonym' | 'format-preserving'; key: string }
+  | {
+      mode: 'fake';
+      /** At least 16 UTF-8 bytes; keep this pseudonymisation key private. */
+      key: string;
+      /** Emit visibly invalid fake credentials; default is full redaction. */
+      credentials?: boolean;
+      /** Keep original MRZ issuer/nationality unless Utopia is requested. */
+      mrzCountry?: 'UTO';
+    }
+  | { mode: 'date-shift'; days: number }
+  | { mode: 'bucket'; size: number };
+export interface StreamOptions extends SanitizerOptions {
+  /** Atomic file APIs only: spool input privately, collect, then redact. */
+  twoPass?: boolean;
+  maxRegistryValues?: number;
+  sanitizerOptions?: SanitizerOptions;
+  sanitizer?: Sanitizer;
+  maxRecordBytes?: number;
+  batchBytes?: number;
+  maxTotalBytes?: number;
+  worker?: boolean;
+  /** JSONL record workers, 1–16; default 2, or 1 for callbacks/Deno. */
+  workers?: number;
+  workerHeapMb?: number;
+  workerTimeoutMs?: number;
+  replace?: boolean;
+}
+export declare function sanitizeStream(
+  source: AsyncIterable<string | Uint8Array> | Iterable<string | Uint8Array>,
+  options?: StreamOptions
+): AsyncGenerator<string>;
+export declare function sanitizeStreamToFile(
+  source: AsyncIterable<string | Uint8Array> | Iterable<string | Uint8Array>,
+  path: string,
+  options?: StreamOptions
+): Promise<{ outputBytes: number }>;
+export declare function sanitizeFileToFile(
+  source: string,
+  target: string,
+  options?: StreamOptions
+): Promise<{ inputBytes: number; outputBytes: number }>;
+export declare function sanitizeFileBounded(
+  source: string,
+  target: string,
+  options?: StreamOptions
+): Promise<{ inputBytes: number; outputBytes: number }>;
+export declare const entityCatalogs: Record<
+  'google' | 'azure' | 'aws',
+  { source: string; sha256: string; names: string[] }
+>;
+export declare function createWikidataVerifier(options?: {
+  fetch?: typeof fetch;
+  language?: string;
+  timeoutMs?: number;
+  maxEntries?: number;
+}): NonNullable<SanitizerOptions['verifyPublic']>;
+export declare function knownSecretsFromGitHubAuth(options?: {
+  command?: string;
+  hostname?: string;
+  timeoutMs?: number;
+}): Promise<string[]>;
+export interface OutboundOptions {
+  sanitizer?: Pick<Sanitizer, 'sanitize'>;
+  sanitizerOptions?: SanitizerOptions;
+}
+export declare function sanitizePayload<T>(
+  value: T,
+  options?: OutboundOptions
+): Promise<T>;
+export declare function createSentryBeforeSend<T>(
+  options?: OutboundOptions
+): (event: T) => Promise<T | null>;
+export declare function createOutboundSanitizer<T, R>(
+  publish: (payload: T) => R | Promise<R>,
+  options?: OutboundOptions
+): (payload: T) => Promise<R>;
+export interface HistoryRewrite {
+  applied: boolean;
+  repository: string;
+  before: HistoryAudit;
+  after?: HistoryAudit;
+  changedPaths: number;
+  changedRefs: number;
+}
+export declare function rewriteGitHistory(
+  source: string,
+  destination: string,
+  options?: {
+    apply?: boolean;
+    sanitizer?: Sanitizer;
+    sanitizerOptions?: SanitizerOptions;
+    filterRepoCommand?: string;
+    maxPaths?: number;
+    maxObjects?: number;
+    maxBytes?: number;
+    maxTotalBytes?: number;
+  }
+): Promise<HistoryRewrite>;

package/src/index.js

@@ -0,0 +1,40 @@
+/** Sensitive text detection and verified publication APIs. */
+
+export { inspect, sanitize, redact } from './sanitizer.js';
+export { createSanitizer } from './engines.js';
+export { REDACTED, entropy, luhn } from './detection.js';
+export { codePointRange } from './projection.js';
+export {
+  fromGitleaks,
+  fromTrufflehog,
+  fromDetectSecrets,
+  fromPresidio,
+  byteRange,
+  fromOffsetReport,
+} from './adapters.js';
+export { knownSecretsFromEnv, personalVariants } from './known.js';
+export { auditGitHistory } from './history.js';
+export {
+  createGitleaksDetector,
+  createTrufflehogDetector,
+  createPresidioDetector,
+} from './external.js';
+
+export { entityCatalogs } from './entities.js';
+export {
+  sanitizeStream,
+  sanitizeStreamToFile,
+  sanitizeFileToFile,
+  sanitizeFileBounded,
+} from './stream.js';
+
+export { createWikidataVerifier } from './public-verifier.js';
+export {
+  sanitizePayload,
+  createSentryBeforeSend,
+  createOutboundSanitizer,
+} from './outbound.js';
+export { knownSecretsFromGitHubAuth } from './known.js';
+export { knownSecretsFromGitHubConfig } from './known.js';
+export { decodeLogBytes, encodeLogText } from './log-bytes.js';
+export { rewriteGitHistory } from './history-rewrite.js';