@link-foundation/sensitive-data-sanitizer 0.0.0-stage → 0.12.0

package/src/personal.js

@@ -0,0 +1,248 @@
+import { collectMatches, escapePattern } from './detection.js';
+import { firstNames } from './names.js';
+import { labels } from './rules.js';
+import { transliteratedGivenNames } from './transliteration.js';
+import { serviceAccounts } from './public.js';
+const labelWords = new Set(Object.values(labels).flat());
+
+const details = (type, rule, confidence = 0.85) => ({
+  type,
+  rule,
+  category: 'personal',
+  confidence,
+});
+const names = Object.entries(firstNames).map(([language, list]) => {
+  const words = list.split(' ').map(escapePattern).join('|');
+  const surname = ['ar', 'he', 'hi', 'th'].includes(language)
+    ? '[\\p{L}\\p{M}]{2,32}'
+    : "[\\p{Lu}][\\p{L}\\p{M}’'-]{1,32}";
+  const pattern = ['ja', 'zh', 'ko'].includes(language)
+    ? `(?:${words})[\\p{Script=Han}\\p{Script=Hiragana}\\p{Script=Katakana}\\p{Script=Hangul}]{1,4}`
+    : `(?:${words})[ \\t]+${surname}${language === 'vi' ? `(?:[ \\t]+${surname})?` : ''}`;
+  return new RegExp(`(?<![\\p{L}\\p{M}])${pattern}(?![\\p{L}\\p{M}])`, 'gu');
+});
+
+// ISO 13616 national lengths; checksum arithmetic never exceeds 3 digits.
+const ibanLengths = Object.fromEntries(
+  'AD24 AE23 AL28 AT20 AZ28 BA20 BE16 BG22 BH22 BI27 BR29 BY28 CH21 CR22 CY28 CZ24 DE22 DJ27 DK18 DO28 EE20 EG29 ES24 FI18 FK18 FO18 FR27 GB22 GE22 GI23 GL18 GR27 GT28 HR21 HU28 IE22 IL23 IQ23 IS26 IT27 JO30 KW30 KZ20 LB28 LC32 LI21 LT20 LU20 LV21 LY25 MC27 MD24 ME22 MK19 MN20 MR27 MT31 MU30 NI28 NL18 NO15 OM23 PK24 PL28 PS29 PT25 QA29 RO24 RS22 RU33 SA24 SC31 SD18 SE24 SI19 SK24 SM27 SO23 ST25 SV28 TL23 TN24 TR26 UA29 VA22 VG24 XK20'
+    .split(' ')
+    .map((entry) => [entry.slice(0, 2), Number(entry.slice(2))])
+);
+
+export function iban(value) {
+  const compact = value.replace(/\s/g, '').toUpperCase();
+  if (
+    !/^[A-Z]{2}\d{2}[A-Z0-9]+$/.test(compact) ||
+    compact.length !== ibanLengths[compact.slice(0, 2)]
+  ) {
+    return false;
+  }
+  const rotated = compact.slice(4) + compact.slice(0, 4);
+  let remainder = 0;
+  for (const char of rotated) {
+    const digits = /\d/.test(char) ? char : String(char.charCodeAt(0) - 55);
+    for (const digit of digits) {
+      remainder = (remainder * 10 + Number(digit)) % 97;
+    }
+  }
+  return remainder === 1;
+}
+
+function detectIban(text, emit) {
+  for (const match of text.matchAll(
+    /(?<![A-Z0-9])[A-Z]{2}\d{2}(?:[ ]?[A-Z0-9]){8,40}/g
+  )) {
+    const needed = ibanLengths[match[0].slice(0, 2)];
+    if (!needed) {
+      continue;
+    }
+    let end = 0,
+      count = 0;
+    while (end < match[0].length && count < needed) {
+      if (match[0][end] !== ' ') {
+        count++;
+      }
+      end++;
+    }
+    const value = match[0].slice(0, end);
+    if (iban(value)) {
+      emit({
+        start: match.index,
+        end: match.index + end,
+        ...details('IBAN', 'iban-checksum', 0.99),
+      });
+    }
+  }
+}
+
+const latinGiven = Object.entries(firstNames)
+  .filter(([locale]) =>
+    ['en', 'es', 'fr', 'de', 'pt', 'ruLatn', 'tr'].includes(locale)
+  )
+  .flatMap(([, list]) => list.split(' '))
+  .concat(transliteratedGivenNames)
+  .map(escapePattern)
+  .join('|');
+const slavicSurname =
+  '[\\p{L}]{2,28}(?:ova|eva|ov|ev|in|ina|enko|sky|ski|skaya)';
+const latinPairs = new RegExp(
+  `(?<![\\p{L}\\p{M}])(?:${latinGiven})[ \\t]+(?:${slavicSurname}|Smith|Jones|Brown|Roe|Doe)(?![\\p{L}\\p{M}])`,
+  'giu'
+);
+const shapedName = '[\\p{Lu}][\\p{L}\\p{M}]{1,31}';
+const suffixes =
+  'ova eva ov ev in ina enko sky ski skaya ова ева ов ев ин ина енко ский ская'
+    .split(' ')
+    .map((s) => [...s].map((c) => `[${c}${c.toUpperCase()}]`).join(''))
+    .join('|');
+const shapedSurname = `[\\p{Lu}][\\p{L}]{1,28}(?:${suffixes})`;
+const slavicPairs = new RegExp(
+  `(?<![\\p{L}\\p{M}])(?:${shapedName}[ \\t]+${shapedSurname}|${shapedSurname}[ \\t]+${shapedName})(?![\\p{L}\\p{M}])`,
+  'gu'
+);
+const documentWord =
+  /^(?:PASSPORT|VISA|ID|PHOTO|SCAN|ПАСПОРТ|ВИЗА|СКАН|ФОТО)$/iu;
+const placeWord = /^(?:Bay|Sands|Hotel|Street|Road|Avenue)$/iu;
+const givenWords = new Set(
+  Object.values(firstNames)
+    .flatMap((list) => list.toLowerCase().split(' '))
+    .concat(transliteratedGivenNames.map((name) => name.toLowerCase()))
+);
+function nameShaped(candidates) {
+  return (
+    candidates.some((token) => givenWords.has(token[0].toLowerCase())) ||
+    candidates.every((token) =>
+      /^(?:\p{Lu}\p{Ll}[\p{L}\p{M}]*|\p{Lu}{2,32})$/u.test(token[0])
+    )
+  );
+}
+function documentReference(text, match) {
+  const following = text.slice(
+    match.index + match[0].length,
+    match.index + match[0].length + 16
+  );
+  return (
+    /^\.[a-z\d]{1,10}(?![\p{L}\p{N}_])/iu.test(following) ||
+    /[/\\]/.test(text[match.index - 1] ?? '')
+  );
+}
+function detectDocumentNames(text, emit) {
+  for (const match of text.matchAll(
+    /(?<![\p{L}\p{N}_-])[\p{L}]{2,32}(?:[_-][\p{L}]{2,32}){1,12}(?![\p{L}\p{N}_-])/gu
+  )) {
+    if (!documentReference(text, match)) {
+      continue;
+    }
+    // Field names such as NATIONAL_ID identify the label, not its value.
+    if (
+      /^[ \t]*(?:["'][ \t]*)?[:=：]/.test(
+        text.slice(match.index + match[0].length)
+      )
+    ) {
+      continue;
+    }
+    const tokens = [...match[0].matchAll(/\p{L}+/gu)];
+    for (let i = 0; i < tokens.length; i++) {
+      if (!documentWord.test(tokens[i][0])) {
+        continue;
+      }
+      for (const step of [-1, 1]) {
+        const candidates = [];
+        for (
+          let j = i + step;
+          j >= 0 && j < tokens.length && candidates.length < 4;
+          j += step
+        ) {
+          if (documentWord.test(tokens[j][0])) {
+            break;
+          }
+          candidates.push(tokens[j]);
+        }
+        if (candidates.length < 2 || candidates.length > 3) {
+          continue;
+        }
+        candidates.sort((a, b) => a.index - b.index);
+        if (!nameShaped(candidates)) {
+          continue;
+        }
+        emit({
+          start: match.index + candidates[0].index,
+          end:
+            match.index + candidates.at(-1).index + candidates.at(-1)[0].length,
+          ...details('PERSON', 'name-document', 0.9),
+        });
+      }
+    }
+  }
+}
+const russianFull =
+  /(?<![\p{L}])(?:[А-ЯЁ][а-яё]{2,30}[ \t]+){2}[А-ЯЁ][а-яё]{2,30}(?:вич|вна|ична)|(?<![\p{L}])(?:[А-ЯЁ][а-яё]{2,30}[ \t]+){2}(?:оглы|кызы)(?![\p{L}])/gu;
+export function detectPersonal(text, emit) {
+  detectDocumentNames(text, emit);
+  for (const pattern of [latinPairs, slavicPairs, russianFull]) {
+    collectMatches(
+      text,
+      pattern,
+      emit,
+      details('PERSON', 'name-identity', 0.9),
+      0,
+      (value) => !placeWord.test(value.split(/[ \t]+/).at(-1))
+    );
+  }
+  for (const pattern of names) {
+    collectMatches(
+      text,
+      pattern,
+      emit,
+      details('PERSON', 'name-gazetteer', 0.7),
+      0,
+      (value) =>
+        !labelWords.has(value) && !placeWord.test(value.split(/[ \t]+/).at(-1))
+    );
+  }
+  collectMatches(
+    text,
+    /(?:компании|организации|company|organization|société|empresa|Firma)[ \t]+([\p{Lu}][\p{L}\p{M}&'-]{1,80})/gu,
+    emit,
+    details('ORGANIZATION', 'organization-context', 0.7),
+    1
+  );
+  collectMatches(
+    text,
+    /(?<![\d(])(?:[78][ -]?)?\(\d{3}\)[ -]?\d{3}[ -]\d{2}[ -]?\d{2}(?!\d)|(?<!\d)(?:\d{3}[.-]){2}\d{4}(?!\d)/g,
+    emit,
+    details('PHONE', 'national-phone')
+  );
+  collectMatches(
+    text,
+    /(?<![\p{L}\p{N}])\d{1,6}[A-Za-z]?[ \t]+(?:[\p{Lu}][\p{L}.'-]*[ \t]+){1,5}(?:Street|St|Road|Rd|Avenue|Ave|Lane|Ln|Drive|Dr|Boulevard|Blvd|Way|Straße|Strasse|Rue|Calle|Rua)\b(?:,[ \t]+(?:[^\r\n<>]{1,80}?[ \t]+(?:[A-Z]{1,2}\d[A-Z\d]?[ \t]+\d[A-Z]{2}|\d{5}(?:-\d{4})?)\b|(?:[\p{Lu}][\p{Ll}.'-]+[ \t]*){1,4}))?/gu,
+    emit,
+    details('ADDRESS', 'postal-address')
+  );
+  collectMatches(
+    text,
+    /(?<![\da-fA-F:.-])(?:[\da-fA-F]{2}[:-]){5}[\da-fA-F]{2}(?![\da-fA-F:.-])/g,
+    emit,
+    details('MAC_ADDRESS', 'mac')
+  );
+  collectMatches(
+    text,
+    /(?<![\p{L}\p{N}_.\]])@[\p{L}\p{N}_]{2,32}(?![\p{L}\p{N}_.])/gu,
+    emit,
+    details('USERNAME', 'messenger-handle', 0.65),
+    0,
+    (_value, match) =>
+      !/^\/[a-z0-9][a-z0-9_.-]*/i.test(
+        text.slice(match.index + match[0].length)
+      )
+  );
+  collectMatches(
+    text,
+    /(?:\/Users\/|\/home\/|[A-Za-z]:\\Users\\)([^/\\\s"'<>[\]]+)/g,
+    emit,
+    details('USERNAME', 'home-path', 0.95),
+    1,
+    (value) => !serviceAccounts.has(value.toLowerCase())
+  );
+  detectIban(text, emit);
+}

package/src/projection.js

@@ -0,0 +1,126 @@
+// Map a detection view back to the original UTF-16 offsets. Normalization
+// never writes to the original text, and offsets remain valid after emoji.
+import { failure } from './detection.js';
+
+// Unicode Nd zero codepoints. NFKC already maps mathematical/fullwidth digits;
+// other numeral systems need explicit conversion with original-source spans.
+const digitZeros = [
+  0x30, 0x660, 0x6f0, 0x7c0, 0x966, 0x9e6, 0xa66, 0xae6, 0xb66, 0xbe6, 0xc66,
+  0xce6, 0xd66, 0xde6, 0xe50, 0xed0, 0xf20, 0x1040, 0x1090, 0x17e0, 0x1810,
+  0x1946, 0x19d0, 0x1a80, 0x1a90, 0x1b50, 0x1bb0, 0x1c40, 0x1c50, 0xa620,
+  0xa8d0, 0xa900, 0xa9d0, 0xa9f0, 0xaa50, 0xabf0, 0x104a0, 0x10d30, 0x11066,
+  0x110f0, 0x11136, 0x111d0, 0x112f0, 0x11450, 0x114d0, 0x11650, 0x116c0,
+  0x11730, 0x118e0, 0x11950, 0x11c50, 0x11d50, 0x11da0, 0x16a60, 0x16ac0,
+  0x16b50, 0x1e140, 0x1e2f0, 0x1e950, 0x1fbf0,
+];
+function asciiDigits(value) {
+  return value.replace(/\p{Nd}/gu, (digit) => {
+    const code = digit.codePointAt(0);
+    const zero = digitZeros.find((start) => code >= start && code <= start + 9);
+    return zero === undefined ? digit : String(code - zero);
+  });
+}
+
+export function projectText(input) {
+  if (
+    // eslint-disable-next-line no-control-regex -- ANSI escape sequences are removed from the detection view.
+    !/\x1b\[|\\u[\da-fA-F]{4}|[\u200b-\u200f\u202a-\u202e\u2060-\u206f\ufeff]/u.test(
+      input
+    ) &&
+    input.normalize('NFKC') === input &&
+    !/[^0-9]/.test(input.replace(/[^\p{Nd}]/gu, ''))
+  ) {
+    return { text: input, changed: false };
+  }
+  const writer = projectionWriter(input.length);
+  // eslint-disable-next-line no-control-regex -- Tokenize ANSI sequences with their original offsets.
+  const units = /\x1b\[[0-?]*[ -/]*[@-~]|\\u[\da-fA-F]{4}|[\s\S]\p{M}*/gu;
+  let changed = false;
+  for (const match of input.matchAll(units)) {
+    const raw = match[0];
+    let value = raw;
+    if (
+      raw.startsWith('\x1b[') ||
+      /^[\u200b-\u200f\u202a-\u202e\u2060-\u206f\ufeff]$/u.test(raw)
+    ) {
+      changed = true;
+      continue;
+    }
+    if (/^\\u[\da-fA-F]{4}$/.test(raw)) {
+      value = String.fromCharCode(parseInt(raw.slice(2), 16));
+    }
+    if (/^[\u200b-\u200f\u202a-\u202e\u2060-\u206f\ufeff]$/u.test(value)) {
+      changed = true;
+      continue;
+    }
+    value = asciiDigits(value.normalize('NFKC'));
+    changed ||= value !== raw;
+    writer.append(value, match.index, match.index + raw.length);
+  }
+  return { ...writer.finish(), changed };
+}
+
+export function codePointRange(text, start, end) {
+  if (
+    !Number.isInteger(start) ||
+    !Number.isInteger(end) ||
+    start < 0 ||
+    end <= start
+  ) {
+    throw new Error('Invalid code point range.');
+  }
+  const offsets = [0];
+  let offset = 0;
+  for (const char of text) {
+    offset += char.length;
+    offsets.push(offset);
+  }
+  if (end >= offsets.length) {
+    throw new Error('Invalid code point range.');
+  }
+  return { start: offsets[start], end: offsets[end] };
+}
+
+function projectionWriter(inputLength) {
+  // Input length has already been checked by the caller. Unicode NFKC can
+  // expand a single scalar to at most 18 scalars; retain a finite bound.
+  const maxLength = Math.max(inputLength * 18, 16);
+  let capacity = Math.min(Math.max(inputLength, 16), maxLength);
+  let starts = new Uint32Array(capacity),
+    ends = new Uint32Array(capacity);
+  const parts = [];
+  let length = 0,
+    chunk = '';
+  return {
+    append(value, start, end) {
+      if (length + value.length > maxLength) {
+        throw failure('ERR_LIMIT');
+      }
+      if (length + value.length > capacity) {
+        capacity = Math.min(
+          Math.max(capacity * 2, length + value.length),
+          maxLength
+        );
+        const nextStarts = new Uint32Array(capacity),
+          nextEnds = new Uint32Array(capacity);
+        nextStarts.set(starts);
+        nextEnds.set(ends);
+        starts = nextStarts;
+        ends = nextEnds;
+      }
+      chunk += value;
+      if (chunk.length >= 8192) {
+        parts.push(chunk);
+        chunk = '';
+      }
+      for (let j = 0; j < value.length; j++) {
+        starts[length] = start;
+        ends[length++] = end;
+      }
+    },
+    finish() {
+      parts.push(chunk);
+      return { text: parts.join(''), starts, ends };
+    },
+  };
+}

package/src/propagation.js

@@ -0,0 +1,163 @@
+import { personalPattern, maxPropagationLength, failure } from './detection.js';
+import { actionable } from './confidence.js';
+import { nameAliases } from './transliteration.js';
+
+function mrzSeeds(value, finding, seeds) {
+  for (const match of value.matchAll(
+    /(?:[PIACV][A-Z<][A-Z<]{3})?([A-Z]{2,30})<<([A-Z]+(?:<[A-Z]+)*)/g
+  )) {
+    const surname =
+      match.index > 0 && /[PIACV][A-Z<]$/.test(value.slice(0, match.index))
+        ? match[1].slice(3)
+        : match[1];
+    for (const name of [surname, ...match[2].split('<')]) {
+      seeds.set(name, { ...finding, type: 'PERSON' });
+    }
+  }
+  const number = /(?:^|[\r\n])([A-Z0-9]{9})[\d<][A-Z<]{3}\d{6}/.exec(value);
+  if (number) {
+    seeds.set(number[1], { ...finding, type: 'PASSPORT_NUMBER' });
+  }
+}
+function decodedValue(value) {
+  if (value.includes('\\')) {
+    try {
+      return JSON.parse(`"${value}"`);
+    } catch {
+      /* Plain paths are not JSON. */
+    }
+  }
+  return value;
+}
+
+function eligibleSeed(finding, options) {
+  return (
+    finding.category === 'personal' &&
+    finding.type !== 'ENCODED_SENSITIVE' &&
+    !['confirmed-personal', 'document-propagation'].includes(finding.rule) &&
+    actionable(finding, options) &&
+    (finding.confidence >= 0.85 ||
+      [
+        'PERSON',
+        'PASSPORT_NUMBER',
+        'BOOKING_REFERENCE',
+        'VISA_NUMBER',
+        'TICKET_NUMBER',
+        'PASSPORT_MRZ',
+      ].includes(finding.type))
+  );
+}
+// Only confirmed values seed propagation. A low-score numeric coincidence
+// must never turn every log occurrence into a high-score identity.
+export function confirmedSeeds(text, findings, options) {
+  const seeds = new Map();
+  for (const finding of findings) {
+    if (!eligibleSeed(finding, options)) {
+      continue;
+    }
+    if (
+      finding.end - finding.start > maxPropagationLength &&
+      finding.type !== 'PASSPORT_MRZ'
+    ) {
+      options.debug?.({
+        event: 'propagation-skipped',
+        reason: 'length',
+        type: finding.type,
+      });
+      continue;
+    }
+    const value = decodedValue(text.slice(finding.start, finding.end)).trim();
+    if (finding.type === 'PASSPORT_MRZ') {
+      mrzSeeds(value, finding, seeds);
+    } else if (value.length >= 2) {
+      seeds.set(value, finding);
+      if (finding.type === 'PERSON') {
+        for (const name of value.match(/\p{L}{2,}/gu) ?? []) {
+          seeds.set(name, finding);
+        }
+      }
+    }
+  }
+  for (const [value, finding] of [...seeds]) {
+    if (finding.type === 'PERSON') {
+      for (const alias of nameAliases(value)) {
+        seeds.set(alias, finding);
+      }
+    }
+  }
+  return seeds;
+}
+export function confirmationOptions(text, findings, options) {
+  const values = new Map(
+    (options.confirmedPersonal ?? []).map((entry) => [entry.value, entry])
+  );
+  for (const [value, finding] of confirmedSeeds(text, findings, options)) {
+    values.set(value, { value, type: finding.type });
+    if (values.size > (options.maxFindings ?? 100000)) {
+      throw failure('ERR_LIMIT');
+    }
+  }
+  return { ...options, confirmedPersonal: [...values.values()] };
+}
+function rangeFilter(ranges) {
+  let index = 0;
+  return (match) => {
+    if (!ranges) {
+      return true;
+    }
+    while (index < ranges.length && ranges[index].end <= match.index) {
+      index++;
+    }
+    const range = ranges[index];
+    return (
+      !!range &&
+      match.index >= range.start &&
+      match.index + match[0].length <= range.end
+    );
+  };
+}
+export function propagate(text, findings, options, ranges) {
+  const result = [...findings];
+  const seen = new Set(findings.map((f) => `${f.start}:${f.end}:${f.type}`));
+  for (const [value, seed] of confirmedSeeds(text, findings, options)) {
+    const pattern = new RegExp(personalPattern(value), 'giu');
+    const withinRange = rangeFilter(ranges);
+    for (const match of text.matchAll(pattern)) {
+      if (!withinRange(match)) {
+        continue;
+      }
+      if (
+        /[\p{L}\p{N}]/u.test(text[match.index - 1] ?? '') ||
+        /[\p{L}\p{N}]/u.test(text[match.index + match[0].length] ?? '')
+      ) {
+        continue;
+      }
+      // A confirmed full name already protects its components at this location.
+      // Keep that span intact for public-name verification and transformations.
+      if (
+        findings.some(
+          (f) =>
+            f.type === seed.type &&
+            f.start <= match.index &&
+            f.end >= match.index + match[0].length
+        )
+      ) {
+        continue;
+      }
+      const id = `${match.index}:${match.index + match[0].length}:${seed.type}`;
+      if (!seen.has(id)) {
+        seen.add(id);
+        result.push({
+          ...seed,
+          start: match.index,
+          end: match.index + match[0].length,
+          rule: 'document-propagation',
+        });
+        if (result.length > (options.maxFindings ?? 100000)) {
+          throw failure('ERR_LIMIT');
+        }
+      }
+    }
+  }
+  return result;
+}

package/src/public-verifier.js

@@ -0,0 +1,77 @@
+import { URL } from 'node:url';
+import { failure } from './detection.js';
+/** Opt-in network lookup: sends only candidate public names, never credentials. */
+export function createWikidataVerifier({
+  fetch: request = globalThis.fetch,
+  language = 'en',
+  timeoutMs = 5000,
+  maxEntries = 256,
+} = {}) {
+  if (
+    typeof request !== 'function' ||
+    !/^[a-z]{2,3}(?:-[a-z]+)?$/i.test(language) ||
+    !Number.isSafeInteger(timeoutMs) ||
+    timeoutMs <= 0 ||
+    !Number.isSafeInteger(maxEntries) ||
+    maxEntries <= 0
+  ) {
+    throw failure('ERR_CONFIG');
+  }
+  const cache = new Map();
+  return async ({ type, value }) => {
+    if (!['PERSON', 'ORGANIZATION'].includes(type)) {
+      return undefined;
+    }
+    const key = `${type}:${value}`;
+    if (cache.has(key)) {
+      return cache.get(key);
+    }
+    const url = new URL('https://www.wikidata.org/w/api.php');
+    for (const [name, setting] of Object.entries({
+      action: 'wbsearchentities',
+      format: 'json',
+      language,
+      search: value,
+      limit: '5',
+    })) {
+      url.searchParams.set(name, setting);
+    }
+    let payload;
+    try {
+      const response = await request(url, {
+        signal: AbortSignal.timeout(timeoutMs),
+      });
+      if (!response.ok) {
+        throw failure('ERR_PUBLIC_VERIFICATION');
+      }
+      payload = await response.json();
+      if (!Array.isArray(payload.search)) {
+        throw failure('ERR_PUBLIC_VERIFICATION');
+      }
+    } catch {
+      throw failure('ERR_PUBLIC_VERIFICATION');
+    }
+    const match = payload.search.find(
+      (entry) =>
+        entry.label?.normalize('NFC') === value.normalize('NFC') &&
+        /^Q\d+$/.test(entry.id) &&
+        (type === 'PERSON'
+          ? /(?:scientist|politician|writer|actor|singer|historian|physicist|mathematician|president|entrepreneur|philosopher)/i
+          : /(?:company|organization|organisation|foundation|agency|university)/i
+        ).test(entry.description ?? '')
+    );
+    const result = match
+      ? {
+          type,
+          value,
+          source: `https://www.wikidata.org/wiki/${match.id}`,
+          reviewedAt: new Date().toISOString().slice(0, 10),
+        }
+      : undefined;
+    if (cache.size >= maxEntries) {
+      cache.delete(cache.keys().next().value);
+    }
+    cache.set(key, result);
+    return result;
+  };
+}