@link-foundation/sensitive-data-sanitizer 0.0.0-stage → 0.11.31

package/examples/sanitize-session.mjs

@@ -0,0 +1,27 @@
+import { createSanitizer } from '../src/index.js';
+
+// Synthetic data: supply real knownSecrets from your secret store in memory.
+const sanitizer = createSanitizer({
+  profile: 'publication',
+  structured: 'jsonl',
+  structuralFields: ['id', 'type', 'name', 'description'],
+  knownSecrets: ['an-opaque-synthetic-secret'],
+  publicEntities: [
+    {
+      type: 'EMAIL',
+      value: 'press@example.org',
+      source: 'https://example.org/contact',
+      reviewedAt: '2026-10-07',
+    },
+  ],
+});
+const session = JSON.stringify({
+  type: 'tool_result',
+  id: 'req_123',
+  name: 'Read',
+  stdout: 'password=short contact=private@example.org',
+  publicContact: 'press@example.org',
+});
+const result = await sanitizer.sanitizeJsonl(session);
+console.log(result.text);
+console.log({ findings: result.findings.length });

package/examples/shared-tool-logs.mjs

@@ -0,0 +1,21 @@
+import { createReadStream } from 'node:fs';
+import {
+  knownSecretsFromEnv,
+  knownSecretsFromGitHubConfig,
+  sanitizeStreamToFile,
+} from '../src/index.js';
+
+// Shared integration for upload-log tools. Publish the output only after the
+// atomic operation succeeds. Neither helper prints credential values.
+const [input, output] = process.argv.slice(2);
+if (!input || !output) {
+  throw new Error('Usage: node examples/shared-tool-logs.mjs INPUT OUTPUT');
+}
+await sanitizeStreamToFile(createReadStream(input), output, {
+  twoPass: true,
+  credentialsOnly: true,
+  knownSecrets: [
+    ...knownSecretsFromEnv(),
+    ...(await knownSecretsFromGitHubConfig()),
+  ],
+});

package/examples/stream-jsonl.mjs

@@ -0,0 +1,17 @@
+import { createReadStream } from 'node:fs';
+import { sanitizeStreamToFile } from '../src/index.js';
+
+const [source, target] = process.argv.slice(2);
+if (!source || !target) {
+  throw new Error(
+    'Usage: node examples/stream-jsonl.mjs SOURCE.jsonl NEWFILE.jsonl'
+  );
+}
+await sanitizeStreamToFile(createReadStream(source), target, {
+  profile: 'publication',
+  structured: 'jsonl',
+  // Collect identities before redacting earlier unlabelled occurrences.
+  twoPass: true,
+  workers: 2,
+});
+console.log('Verified session written:', target);

package/package.json

@@ -1,6 +1,126 @@
 {
   "name": "@link-foundation/sensitive-data-sanitizer",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.11.31",
+  "description": "Offline sensitive-text sanitization with credential, multilingual personal-data and scanner union detection",
+  "type": "module",
+  "main": "src/index.js",
+  "types": "src/index.d.ts",
+  "bin": {
+    "sensitive-data-sanitizer": "./bin/sensitive-data-sanitizer.js",
+    "sensitive-data-sanitizer-legacy": "./bin/legacy-example-package-name.js"
+  },
+  "files": [
+    "bin/",
+    "src/",
+    "docs/API.md",
+    "docs/COVERAGE.md",
+    "docs/HISTORY-REMEDIATION.md",
+    "examples/combined-scanners.mjs",
+    "examples/presidio-bridge.py",
+    "examples/sanitize-session.mjs",
+    "examples/realistic-fakes.mjs",
+    "examples/stream-jsonl.mjs",
+    "CHANGELOG.md",
+    "LICENSE",
+    "README.md",
+    "examples/shared-tool-logs.mjs"
+  ],
+  "exports": {
+    ".": {
+      "types": "./src/index.d.ts",
+      "import": "./src/index.js"
+    },
+    "./eslint-plugin": {
+      "types": "./src/eslint-plugin.d.ts",
+      "import": "./src/eslint-plugin.js"
+    },
+    "./legacy": {
+      "types": "./src/legacy.d.ts",
+      "browser": "./src/arithmetic.js",
+      "import": "./src/legacy.js"
+    }
+  },
+  "scripts": {
+    "test": "node --test --test-timeout=30000 tests/*.test.js",
+    "lint": "node scripts/lint.mjs",
+    "lint:all": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "check:duplication": "jscpd .",
+    "check:secrets": "secretlint \"**/*\"",
+    "check": "npm run lint && npm run format:check && npm run check:duplication",
+    "example:web:dev": "npm --prefix examples/universal-app run dev",
+    "example:web:build": "npm --prefix examples/universal-app run build",
+    "example:web:preview": "npm --prefix examples/universal-app run preview",
+    "example:web:preview-images": "node scripts/update-preview-images.mjs",
+    "example:desktop:package": "npm --prefix examples/universal-app run desktop:package",
+    "example:desktop:make": "npm --prefix examples/universal-app run desktop:make",
+    "example:mobile:sync": "npm --prefix examples/universal-app run mobile:sync",
+    "prepare": "node scripts/install-git-hooks.mjs",
+    "changeset": "changeset",
+    "changeset:version": "node scripts/changeset-version.mjs",
+    "changeset:publish": "changeset publish",
+    "changeset:status": "changeset status --since=origin/main"
+  },
+  "keywords": [
+    "sanitization",
+    "redaction",
+    "secrets",
+    "pii",
+    "privacy",
+    "logs",
+    "cli"
+  ],
+  "author": "",
+  "license": "Unlicense",
+  "devEngines": {
+    "packageManager": {
+      "name": "npm"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/link-foundation/sensitive-data-sanitizer.git"
+  },
+  "engines": {
+    "node": ">=22.13.0"
+  },
+  "devDependencies": {
+    "@changesets/cli": "^3.0.3",
+    "eslint": "^9.38.0",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-prettier": "^5.5.4",
+    "husky": "^9.1.7",
+    "jscpd": "^5.4.0",
+    "lint-staged": "^16.4.0",
+    "mrz": "^5.0.2",
+    "prettier": "^3.6.2",
+    "secretlint": "13.0.7",
+    "test-anywhere": "^0.8.48"
+  },
+  "lint-staged": {
+    "*.{js,mjs,cjs}": [
+      "eslint --fix --max-warnings 0 --no-warn-ignored",
+      "prettier --write",
+      "prettier --check"
+    ],
+    "*.md": [
+      "prettier --write",
+      "prettier --check"
+    ]
+  },
+  "dependencies": {
+    "@faker-js/faker": "^10.6.0",
+    "@secretlint/core": "13.0.7",
+    "@secretlint/profiler": "13.0.7",
+    "@secretlint/secretlint-rule-preset-recommend": "13.0.7",
+    "libphonenumber-js": "1.13.14",
+    "re2-wasm": "1.0.2",
+    "re2js": "^2.9.0",
+    "yaml": "^2.9.1"
+  }
+}

package/src/adapters.js

@@ -0,0 +1,204 @@
+import { failure, escapePattern } from './detection.js';
+import { codePointRange } from './projection.js';
+import { decodedRuns } from './encoded.js';
+import { sanitizeFinding } from './sanitizer.js';
+
+function occurrences(text, values, rule) {
+  const result = [];
+  for (const value of new Set(values)) {
+    if (typeof value !== 'string' || !value || /^\*+$/.test(value)) {
+      throw failure('ERR_REPORT');
+    }
+    let found = false;
+    for (const match of text.matchAll(new RegExp(escapePattern(value), 'g'))) {
+      found = true;
+      result.push({
+        start: match.index,
+        end: match.index + value.length,
+        type: 'SECRET',
+        category: 'credential',
+        rule,
+      });
+    }
+    // Scanners can report decoded values; mask their entire source capsule.
+    for (const run of decodedRuns(text)) {
+      if (run.text.includes(value)) {
+        found = true;
+        result.push({
+          start: run.start,
+          end: run.end,
+          type: 'SECRET',
+          category: 'credential',
+          rule,
+        });
+      }
+    }
+    if (!found) {
+      throw failure('ERR_REPORT');
+    }
+  }
+  return result;
+}
+
+export function fromGitleaks(text, report) {
+  if (!Array.isArray(report)) {
+    throw failure('ERR_REPORT');
+  }
+  return occurrences(
+    text,
+    report.map((entry) => entry.Secret),
+    'gitleaks'
+  );
+}
+
+export function fromTrufflehog(text, report) {
+  if (!Array.isArray(report)) {
+    throw failure('ERR_REPORT');
+  }
+  return occurrences(text, report.flatMap(truffleValues), 'trufflehog');
+}
+
+function truffleValues(entry) {
+  const values = [entry?.Raw, entry?.RawV2];
+  if (
+    values.some(
+      (value) =>
+        value !== null && value !== undefined && typeof value !== 'string'
+    ) ||
+    !values.some((value) => typeof value === 'string' && value.length > 0)
+  ) {
+    throw failure('ERR_REPORT');
+  }
+  return values.filter(
+    (value) => typeof value === 'string' && value.length > 0
+  );
+}
+
+export function fromDetectSecrets(text, report, filename) {
+  const entries = report?.results?.[filename];
+  if (!Array.isArray(entries)) {
+    throw failure('ERR_REPORT');
+  }
+  const lines = text.split('\n');
+  const offsets = [0];
+  for (const line of lines) {
+    offsets.push(offsets.at(-1) + line.length + 1);
+  }
+  return entries.map((entry) => {
+    const index = entry.line_number - 1;
+    if (
+      !Number.isInteger(index) ||
+      index < 0 ||
+      index >= lines.length ||
+      !lines[index].length
+    ) {
+      throw failure('ERR_REPORT');
+    }
+    // Hashed baselines contain no literal secret; redact the complete line.
+    return {
+      start: offsets[index],
+      end: offsets[index] + lines[index].length,
+      type: 'SECRET',
+      category: 'credential',
+      rule: 'detect-secrets',
+    };
+  });
+}
+
+export function fromPresidio(text, report) {
+  if (!Array.isArray(report)) {
+    throw failure('ERR_REPORT');
+  }
+  const types = new Set([
+    'PERSON',
+    'ORGANIZATION',
+    'EMAIL_ADDRESS',
+    'PHONE_NUMBER',
+    'LOCATION',
+    'DATE_TIME',
+    'CREDIT_CARD',
+    'IP_ADDRESS',
+    'IBAN_CODE',
+    'US_SSN',
+    'US_PASSPORT',
+    'PASSWORD',
+  ]);
+  return report.map((entry) => {
+    if (
+      !types.has(entry.entity_type) &&
+      !/^[A-Z]{2}_[A-Z_]{1,50}$/.test(entry.entity_type)
+    ) {
+      throw failure('ERR_REPORT');
+    }
+    let range;
+    try {
+      range = codePointRange(text, entry.start, entry.end);
+    } catch {
+      throw failure('ERR_REPORT');
+    }
+    const type =
+      {
+        EMAIL_ADDRESS: 'EMAIL',
+        PHONE_NUMBER: 'PHONE',
+        LOCATION: 'ADDRESS',
+        PASSWORD: 'SECRET',
+      }[entry.entity_type] ?? entry.entity_type;
+    return {
+      ...range,
+      type,
+      category: type === 'SECRET' ? 'credential' : 'personal',
+      rule: 'presidio',
+    };
+  });
+}
+
+export function byteRange(text, start, end) {
+  if (
+    !Number.isInteger(start) ||
+    !Number.isInteger(end) ||
+    start < 0 ||
+    end <= start
+  ) {
+    throw failure('ERR_REPORT');
+  }
+  let bytes = 0,
+    units = 0;
+  const offsets = new Map([[0, 0]]);
+  for (const char of text) {
+    bytes += Buffer.byteLength(char, 'utf8');
+    units += char.length;
+    offsets.set(bytes, units);
+  }
+  if (!offsets.has(start) || !offsets.has(end)) {
+    throw failure('ERR_REPORT');
+  }
+  return { start: offsets.get(start), end: offsets.get(end) };
+}
+
+/** Adapt a trusted detector's offset report without retaining quotes or scores. */
+export function fromOffsetReport(text, entries, { unit, rule } = {}) {
+  if (
+    !Array.isArray(entries) ||
+    !['utf16', 'codepoint', 'byte'].includes(unit)
+  ) {
+    throw failure('ERR_REPORT');
+  }
+  return entries.map((entry) => {
+    let range;
+    try {
+      if (unit === 'byte') {
+        range = byteRange(text, entry.start, entry.end);
+      } else if (unit === 'codepoint') {
+        range = codePointRange(text, entry.start, entry.end);
+      } else {
+        range = { start: entry.start, end: entry.end };
+      }
+      return sanitizeFinding(
+        { ...range, category: entry.category, type: entry.type, rule },
+        text.length
+      );
+    } catch {
+      throw failure('ERR_REPORT');
+    }
+  });
+}

package/src/arithmetic.js

@@ -0,0 +1,11 @@
+/** Browser-compatible utilities retained from the original template. */
+
+/** Add two numbers. */
+export const add = (a, b) => a + b;
+
+/** Multiply two numbers. */
+export const multiply = (a, b) => a * b;
+
+/** Resolve after the requested number of milliseconds. */
+export const delay = (ms) =>
+  new Promise((resolve) => globalThis.setTimeout(resolve, ms));

package/src/confidence.js

@@ -0,0 +1,65 @@
+// A valid check digit is common in arbitrary log numbers. Context decides
+// whether that evidence merits a replacement; inspect retains low scores.
+export function threshold(options) {
+  return options.minConfidence ?? options.threshold ?? 0.5;
+}
+export function actionable(finding, options) {
+  return (
+    finding.kept !== 'fake' &&
+    (finding.category === 'credential' ||
+      finding.confidence >= threshold(options))
+  );
+}
+export function numericNoise(text, start) {
+  const before = text
+    .slice(Math.max(0, start - 80), start)
+    .split(/[\r\n|;]/)
+    .at(-1);
+  return /(?<![\p{L}\p{N}])(?:timestamp|ts|time|created_at|updated_at|elapsed|duration|ms|epoch|order|run|size|bytes|port|pid|line|col)["']?[ :=_-]*$/iu.test(
+    before
+  );
+}
+export function epochNumber(value) {
+  const digits = value.replace(/\D/g, '');
+  const seconds = digits.length === 13 ? Number(digits) / 1000 : Number(digits);
+  return (
+    [10, 13].includes(digits.length) &&
+    seconds >= 946684800 &&
+    seconds < 4102444800
+  );
+}
+export function cardEvidence(text, start, value) {
+  const identityContext =
+    /(?<![\p{L}\p{N}_])(?:card|visa|mastercard|amex|discover|jcb|unionpay|mir|diners|карта)(?![\p{L}\p{N}_])/iu.test(
+      text.slice(Math.max(0, start - 64), start + value.length + 32)
+    );
+  return identityContext || (!numericNoise(text, start) && !epochNumber(value));
+}
+export function cardNetwork(value) {
+  const d = value.replace(/\D/g, ''),
+    n = d.length;
+  return primaryCard(d, n) || otherCard(d, n);
+}
+function primaryCard(d, n) {
+  return (
+    (/^4/.test(d) && [13, 16, 19].includes(n)) ||
+    ((/^5[1-5]/.test(d) ||
+      (Number(d.slice(0, 4)) >= 2221 && Number(d.slice(0, 4)) <= 2720)) &&
+      n === 16) ||
+    (/^3[47]/.test(d) && n === 15) ||
+    ((/^6011|^65|^64[4-9]/.test(d) ||
+      (Number(d.slice(0, 6)) >= 622126 && Number(d.slice(0, 6)) <= 622925)) &&
+      [16, 19].includes(n))
+  );
+}
+function otherCard(d, n) {
+  return (
+    (Number(d.slice(0, 4)) >= 3528 &&
+      Number(d.slice(0, 4)) <= 3589 &&
+      n >= 16 &&
+      n <= 19) ||
+    (/^62/.test(d) && n >= 16 && n <= 19) ||
+    (/^220[0-4]/.test(d) && n >= 16 && n <= 19) ||
+    (/^3(?:0[0-5]|[68])/.test(d) && n === 14)
+  );
+}