@link-foundation/sensitive-data-sanitizer 0.20.0 → 0.21.0

package/src/detection.js

@@ -5,26 +5,21 @@ import {
   uatpCard,
 } from './confidence.js';
 import { isIP } from 'node:net';
+import { Buffer } from 'node:buffer';
 import { serviceRules } from './rules.js';
-import { detectContext, valueRange, authorizationRange } from './context.js';
-import { detectPersonal } from './personal.js';
+import { detectContext, valueRange, authorizationRanges } from './context.js';
 import { detectGitleaks } from './gitleaks.js';
-import { detectCatalog } from './entities.js';
-import { detectIdentity } from './identity.js';
-import { detectNational } from './national.js';
-import { detectPersonalContext } from './personal-context.js';
-import { detectPersonalEvidence } from './personal-evidence.js';
 import {
   detectCredentialFormats,
   credentialPlaceholder,
+  maskedValue,
 } from './credentials.js';
 import { localAddress } from './public.js';
 import { detectKnownPersonal } from './personal-variants.js';
-import { detectDocumentEntities } from './document-entities.js';
-import { detectProseAndDocuments } from './proper-names.js';
 import { builtInEnabled } from './policy.js';
-import { detectStrict } from './strict.js';
+import { feature } from './features.js';
 import { tokenChecksum } from './token-checksum.js';
+import { refineCredentialSpans, cookieValues } from './credential-spans.js';
 
 export const REDACTED = '[REDACTED]';
 export const failure = (code = 'ERR_SANITIZATION', location = {}) =>
@@ -56,6 +51,30 @@ export function personalPattern(value) {
     .map(escapePattern)
     .join('[ \\t_-]+');
 }
+// Hex and base64 spellings of a known secret, at any length. The generic
+// decoders need 16 or more encoded characters, so they cannot see short ones.
+const encodedForms = new Map();
+function knownEncodedForms(value) {
+  let pattern = encodedForms.get(value);
+  if (!pattern) {
+    const bytes = Buffer.from(value, 'utf8');
+    const hex = bytes.toString('hex');
+    const base64 = bytes.toString('base64').replace(/=+$/, '');
+    const url = bytes.toString('base64url');
+    const alternatives = [...new Set([hex, hex.toUpperCase()])].join('|');
+    const base64Forms = [...new Set([base64, url])].map(escapePattern);
+    pattern = new RegExp(
+      `(?<![\\da-fA-F])(?:${alternatives})(?![\\da-fA-F])|(?<![\\w+/-])(?:${base64Forms.join('|')})(?:={0,2}(?![\\w+/=-]))`,
+      'g'
+    );
+    if (encodedForms.size > 1024) {
+      encodedForms.clear();
+    }
+    encodedForms.set(value, pattern);
+  }
+  return pattern;
+}
+
 export function escapePattern(text) {
   return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
@@ -130,34 +149,42 @@ export function luhn(value) {
 function detectCookies(text, emit) {
   for (const match of text.matchAll(/(?:Set-)?Cookie[ \t]*:[ \t]*/gi)) {
     const range = valueRange(text, match.index + match[0].length, 'line');
-    if (
-      range &&
-      range.end > range.start &&
-      text.slice(range.start, range.end) !== REDACTED
-    ) {
-      emit({
-        ...range,
-        type: 'SECRET',
-        category: 'credential',
-        rule: 'cookie',
-      });
+    for (const value of range
+      ? cookieValues(text, range.start, range.end)
+      : []) {
+      if (!maskedValue(text.slice(value.start, value.end))) {
+        emit({
+          ...value,
+          type: 'SECRET',
+          category: 'credential',
+          rule: 'cookie',
+        });
+      }
     }
   }
 }
 
 export function nativeDetect(text, options, emit) {
-  const output = emit;
-  emit = (finding) => {
+  const found = [];
+  detectNative(text, options, (finding) => found.push(finding));
+  for (const finding of refineCredentialSpans(text, found)) {
     if (builtInEnabled(finding, options)) {
-      output(finding);
+      emit(finding);
     }
-  };
+  }
+}
+
+function detectNative(text, options, emit) {
   const credential = { type: 'SECRET', category: 'credential' };
   for (const value of options.knownSecrets ?? []) {
     collectMatches(text, new RegExp(escapePattern(value), 'g'), emit, {
       ...credential,
       rule: 'known-secret',
     });
+    collectMatches(text, knownEncodedForms(value), emit, {
+      ...credential,
+      rule: 'known-secret',
+    });
   }
   detectKnownPersonal(
     text,
@@ -194,14 +221,7 @@ export function nativeDetect(text, options, emit) {
   }
   detectContext(text, emit, options.credentialsOnly);
   if (!options.credentialsOnly) {
-    detectPersonal(text, emit);
-    detectProseAndDocuments(text, emit, options, detectDocumentEntities);
-    detectCatalog(text, emit);
-    detectIdentity(text, emit);
-    detectNational(text, emit);
-    detectPersonalContext(text, emit);
-    detectPersonalEvidence(text, emit);
-    detectStrict(text, emit, options);
+    feature('detectPersonalData')(text, emit, options);
   }
   detectCredentialFormats(text, emit);
   // detect-secrets-style quoted entropy detection; bare commit hashes and
@@ -262,9 +282,11 @@ function detectAuthorization(text, emit, credential) {
   for (const match of text.matchAll(
     /(?:Proxy-)?Authorization[ \t]*:[ \t]*/gi
   )) {
-    const range = authorizationRange(text, match.index + match[0].length);
-    if (range && !credentialPlaceholder(text.slice(range.start, range.end))) {
-      emit({ ...range, ...credential, rule: 'authorization' });
+    const start = match.index + match[0].length;
+    for (const range of authorizationRanges(text, start)) {
+      if (!credentialPlaceholder(text.slice(range.start, range.end))) {
+        emit({ ...range, ...credential, rule: 'authorization' });
+      }
     }
   }
 }
@@ -291,7 +313,16 @@ function detectPersonalFormats(text, options, emit) {
   collectMatches(
     text,
     /(?<![\p{L}\p{N}_.!#$%&'*+/?^`{|}~-])[\p{L}\p{N}_.!#$%&'*+/?^`{|}~-]+@[\p{L}\p{N}](?:[\p{L}\p{N}.-]{0,252})\.[\p{L}]{2,63}(?![\p{L}\p{N}_-])/gu,
-    (finding) => emit(emailAfterMention(text, finding)),
+    (finding) => {
+      // `https://user:password@host` is URL user info, not an address.
+      if (
+        !/[a-z][a-z0-9+.-]*:\/\/[^\s/@]*:$/i.test(
+          text.slice(Math.max(0, finding.start - 256), finding.start)
+        )
+      ) {
+        emit(emailAfterMention(text, finding));
+      }
+    },
     { type: 'EMAIL', category: 'personal', rule: 'email' }
   );
   collectMatches(

package/src/encoded.js

@@ -1,68 +1,101 @@
 import { TextDecoder } from 'node:util';
 import { Buffer } from 'node:buffer';
-import { failure } from './detection.js';
 import { jsonStringRuns } from './json-string-runs.js';
 
+// Decoded candidates are re-scanned by every detector, so their number is
+// bounded per window of the input; a denser window falls back to masking the
+// remaining candidates as `encoded-limit` runs, without blocking the text.
+const WINDOW = 65536;
+const WINDOW_CANDIDATES = 4096;
+
+const WRAPPED =
+  /(?<![A-Za-z0-9_+/-])[A-Za-z0-9_+/-]{16,128}(?:\r?\n[A-Za-z0-9_+/-]{1,128})+={0,2}(?![A-Za-z0-9_+/-])/g;
+
 export function* decodedRuns(text, depth = 0) {
   if (depth >= 2) {
     return;
   }
+  // Wrapped runs come first: a line inside a decoded wrapped run is covered
+  // by the run's own finding and is not decoded again.
   const patterns = [
+    WRAPPED,
     /(?<![A-Za-z0-9_+/-])[A-Za-z0-9_+/-]{16}[A-Za-z0-9_+/-]*={0,2}(?![A-Za-z0-9_+/-])/g,
     /(?:[^\s"'<>?=&:/]{0,128}%[\da-fA-F]{2})+(?:[^\s"'<>?=&:/]{0,128})/g,
-    /(?<![A-Za-z0-9_+/-])[A-Za-z0-9_+/-]{16,128}(?:\r?\n[A-Za-z0-9_+/-]{1,128})+={0,2}(?![A-Za-z0-9_+/-])/g,
     /(?:&#(?:x[\da-fA-F]{1,6}|\d{1,7});|&(?:amp|lt|gt|quot|apos|nbsp);){2,2048}/g,
     /(?:\\x[\da-fA-F]{2}){2,2048}/g,
     undefined, // JSON candidates use a linear scanner below.
   ];
-  const seen = new Set();
-  let count = 0;
+  const scan = { depth, seen: new Set(), counts: new Map(), covered: [] };
   for (const [index, pattern] of patterns.entries()) {
-    const marker = ['', '%', '\n', '&', '\\x', '"'][index];
+    const marker = ['\n', '', '%', '&', '\\x', '"'][index];
     if (marker && !text.includes(marker)) {
       continue;
     }
+    const inWrappedRun = coverage(scan.covered);
     for (const match of candidateMatches(text, pattern)) {
-      const raw = match[0];
-      if (raw.length > 8192) {
-        if (isLimitedTextRun(raw)) {
-          yield {
-            start: match.index,
-            end: match.index + raw.length,
-            limited: true,
-            depth,
-          };
-        }
-        continue;
-      }
-      const candidates = decodeCandidates(raw);
-      for (const candidate of candidates) {
-        const { text: decoded, encoding } = candidate;
-        const key = `${match.index}:${raw.length}:${decoded}`;
-        if (seen.has(key) || !decodedText(raw, decoded)) {
-          continue;
-        }
-        seen.add(key);
-        if (++count > 4096) {
-          throw failure('ERR_LIMIT');
-        }
-        const inset = encoding === 'json-content' ? 1 : 0;
-        const run = {
-          start: match.index + inset,
-          end: match.index + raw.length - inset,
-          text: decoded,
-          encoding,
-          depth,
-        };
-        yield run;
-        for (const inner of decodedRuns(decoded, depth + 1)) {
-          yield { ...run, text: inner.text, depth: inner.depth };
-        }
+      if (index !== 1 || !inWrappedRun(match.index)) {
+        yield* matchRuns(match, index === 0, scan);
       }
     }
   }
 }
 
+// Tests ascending offsets against the sorted, disjoint wrapped runs.
+function coverage(covered) {
+  let cursor = 0;
+  return (start) => {
+    while (cursor < covered.length && covered[cursor].end <= start) {
+      cursor++;
+    }
+    return cursor < covered.length && covered[cursor].start <= start;
+  };
+}
+
+function* matchRuns(match, wrapped, scan) {
+  const raw = match[0];
+  const start = match.index;
+  const end = start + raw.length;
+  const limited = { start, end, limited: true, depth: scan.depth };
+  if (raw.length > 8192) {
+    if (isLimitedTextRun(raw, wrapped)) {
+      scan.covered.push(limited);
+      yield limited;
+    }
+    return;
+  }
+  const window = Math.floor(start / WINDOW);
+  for (const candidate of decodeCandidates(raw)) {
+    const { text: decoded, encoding } = candidate;
+    const key = `${start}:${raw.length}:${decoded}`;
+    if (scan.seen.has(key) || !decodedText(raw, decoded)) {
+      continue;
+    }
+    scan.seen.add(key);
+    const count = (scan.counts.get(window) ?? 0) + 1;
+    scan.counts.set(window, count);
+    if (count > WINDOW_CANDIDATES) {
+      yield limited;
+      return;
+    }
+    if (wrapped && scan.covered.at(-1)?.start !== start) {
+      scan.covered.push({ start, end });
+    }
+    const inset = encoding === 'json-content' ? 1 : 0;
+    const run = {
+      start: start + inset,
+      end: end - inset,
+      text: decoded,
+      encoding,
+      depth: scan.depth,
+      ...(candidate.layout && { layout: candidate.layout }),
+    };
+    yield run;
+    for (const inner of decodedRuns(decoded, scan.depth + 1)) {
+      yield { ...run, text: inner.text, depth: inner.depth };
+    }
+  }
+}
+
 function candidateMatches(text, pattern) {
   return pattern ? text.matchAll(pattern) : jsonStringRuns(text);
 }
@@ -76,20 +109,59 @@ function decodedText(raw, decoded) {
   );
 }
 
-function isLimitedTextRun(raw) {
+function isLimitedTextRun(raw, wrapped) {
   // Bare opaque identifiers may share the base64 alphabet. Require a
-  // textual decode, or an explicit percent/wrapped encoding boundary.
-  const probe = decodeCandidates(raw.slice(0, 4096), true);
+  // textual decode, an explicit percent encoding, or the uniform layout of
+  // wrapped base64 (`base64 -w`, PEM bodies). Lists of identifiers or commit
+  // hashes are ordinary lines and are scanned one by one.
+  if (raw.includes('%')) {
+    return true;
+  }
+  const head = wrapped
+    ? raw.slice(0, 8192).replace(/\s/g, '').slice(0, 4096)
+    : raw.slice(0, 4096);
+  const probe = decodeCandidates(head, true);
   return (
-    raw.includes('%') ||
-    raw.includes('\n') ||
     probe.some(
       // eslint-disable-next-line no-control-regex -- Exclude binary controls from the bounded UTF-8 text probe.
       (c) => c.text && !/[\x00-\x08\x0e-\x1f\x7f]/.test(c.text)
+    ) ||
+    (wrapped && isWrappedBinary(raw))
+  );
+}
+
+// Wrapped binary base64 uses the standard alphabet, lines of one width that
+// is a multiple of four and is not plain hexadecimal.
+function isWrappedBinary(raw) {
+  // Trim the padding without a regular expression: `/=+$/` backtracks
+  // quadratically over long `=` runs that are not at the end.
+  let end = raw.length;
+  while (end > 0 && raw.charCodeAt(end - 1) === 61) {
+    end -= 1;
+  }
+  const lines = raw.slice(0, end).split(/\r?\n/);
+  const width = lines[0].length;
+  return (
+    width % 4 === 0 &&
+    !/[-_]/.test(raw) &&
+    !/^[\da-fA-F\s]+$/.test(raw) &&
+    lines.every((line, i) =>
+      i === lines.length - 1 ? line.length <= width : line.length === width
     )
   );
 }
 
+// Line width and separator of a wrapped run, re-applied when re-encoding.
+function wrapLayout(raw) {
+  if (!raw.includes('\n')) {
+    return undefined;
+  }
+  return {
+    width: raw.split(/\r?\n/, 1)[0].length,
+    newline: raw.includes('\r\n') ? '\r\n' : '\n',
+  };
+}
+
 function decodeCandidates(raw, partial) {
   const candidates = [];
   if (raw.startsWith('"')) {
@@ -153,8 +225,7 @@ function decodeCandidates(raw, partial) {
           text: new TextDecoder('utf-8', { fatal: true }).decode(bytes, {
             stream: partial,
           }),
-          wrapped: raw.includes('\n'),
-          padded: raw.endsWith('='),
+          layout: wrapLayout(raw),
         });
       } catch {
         /* Binary content. */
@@ -167,6 +238,7 @@ function decodeCandidates(raw, partial) {
           text: new TextDecoder('utf-8', { fatal: true }).decode(
             Buffer.from(compact, 'hex')
           ),
+          layout: wrapLayout(raw),
         });
       } catch {
         /* Binary content. */
@@ -198,16 +270,30 @@ export function encodeRun(run, text) {
         : `&#${c.codePointAt(0)};`
     ).join('');
   } else {
-    encoded = bytes.toString(run.encoding);
+    encoded = wrap(bytes.toString(run.encoding), run.layout);
   }
   const decoded =
     run.encoding === 'json-content'
       ? { text: JSON.parse(`"${encoded}"`) }
       : decodeCandidates(encoded).find((c) => c.encoding === run.encoding);
-  if (!decoded || decoded.text !== text) {
-    throw failure('ERR_ENCODING');
+  // A short payload may re-encode below the length a decoder recognizes
+  // (hex needs 32 digits); callers then mask the encoded text as it stands.
+  return decoded?.text === text ? encoded : undefined;
+}
+
+function wrap(encoded, layout) {
+  if (!layout?.width || encoded.length <= layout.width) {
+    return encoded;
+  }
+  const lines = [];
+  for (let i = 0; i < encoded.length; i += layout.width) {
+    lines.push(encoded.slice(i, i + layout.width));
+  }
+  // Padding never starts a line of its own.
+  if (/^=+$/.test(lines.at(-1)) && lines.length > 1) {
+    lines[lines.length - 2] += lines.pop();
   }
-  return encoded;
+  return lines.join(layout.newline);
 }
 
 export function encodedValue(raw) {

package/src/engines.js

@@ -18,6 +18,7 @@ import { projectText } from './projection.js';
 import { decodedRuns } from './encoded.js';
 import { hasCustomTransforms } from './transforms.js';
 import { builtInEnabled } from './policy.js';
+import { exemptFindingsAsync } from './exempt.js';
 import {
   initializePlaceholders,
   placeholderKnown,
@@ -220,10 +221,7 @@ async function analyzeStructured(
   );
 }
 
-export function createSanitizer(options = {}) {
-  options = applyProfile(options);
-  validateOptions(options);
-  options = initializePlaceholders(options);
+function configuredEngines(options) {
   for (const detector of options.detectors ?? []) {
     if (!detector || typeof detector.detect !== 'function') {
       throw failure('ERR_CONFIG');
@@ -234,6 +232,14 @@ export function createSanitizer(options = {}) {
   if (!options.knownOnly) {
     engines.push(...(options.detectors ?? []));
   }
+  return engines;
+}
+
+export function createSanitizer(options = {}) {
+  options = applyProfile(options);
+  validateOptions(options);
+  options = initializePlaceholders(options);
+  const engines = configuredEngines(options);
   let prepared;
   async function analyze(
     text,
@@ -266,6 +272,7 @@ export function createSanitizer(options = {}) {
             ...options,
             structured: undefined,
             detectors: [],
+            exempt: undefined,
             findings,
           })
         : reviewFindings(text, [...nativeFindings, ...findings], options);
@@ -274,15 +281,31 @@ export function createSanitizer(options = {}) {
       : detected;
   }
 
+  // The caller's `exempt` hook screens the findings of the text it sees,
+  // including the verification passes over the published output.
+  async function screened(
+    text,
+    initial,
+    plain,
+    scopedOptions = options,
+    nativeFindings
+  ) {
+    return exemptFindingsAsync(
+      text,
+      await analyze(text, initial, plain, scopedOptions, nativeFindings),
+      scopedOptions.exempt
+    );
+  }
+
   const sanitizer = {
-    inspect: guarded(analyze),
+    inspect: guarded(screened),
     sanitize: guarded(sanitizeText, () => discardPlaceholderState(options)),
     sanitizeJsonl: (text) =>
       createSanitizer({ ...options, structured: 'jsonl' }).sanitize(text),
   };
   configurations.set(sanitizer, options);
   streamPreparers.set(sanitizer, async (text, nativeFindings) => {
-    const findings = await analyze(
+    const findings = await screened(
       text,
       nativeFindings === undefined ? (options.findings ?? []) : [],
       false,
@@ -305,7 +328,7 @@ export function createSanitizer(options = {}) {
     const findings =
       depth === 0 && prepared?.text === text
         ? prepared.findings
-        : await analyze(text, options.findings ?? [], plain, options);
+        : await screened(text, options.findings ?? [], plain, options);
     if (depth === 0) {
       prepared = undefined;
     }
@@ -329,7 +352,7 @@ export function createSanitizer(options = {}) {
           recursiveOptions
         )
     );
-    if (await customResidual(result.text, options, plain, analyze)) {
+    if (await customResidual(result.text, options, plain, screened)) {
       throw failure('ERR_RESIDUAL');
     }
     const sanitized = fullRedaction
@@ -351,7 +374,7 @@ export function createSanitizer(options = {}) {
         ).text;
     // Verification at the publication boundary runs every enabled engine.
     if (
-      (await analyze(sanitized, [], plain, options)).some((f) =>
+      (await screened(sanitized, [], plain, options)).some((f) =>
         actionable(f, options)
       )
     ) {
@@ -360,7 +383,7 @@ export function createSanitizer(options = {}) {
       );
     }
     verifyStructuredResult(result.text, options, plain);
-    if (await placeholderResidual(result.text, options, plain, analyze)) {
+    if (await placeholderResidual(result.text, options, plain, screened)) {
       throw failure('ERR_RESIDUAL');
     }
     return { ...result, findings: auditFaked(findings, options, result) };

package/src/exempt.js

@@ -0,0 +1,72 @@
+import { failure } from './detection.js';
+
+// `exempt(finding, text) => boolean` keeps findings the caller's policy
+// knows are not sensitive (a configuration flag, a counter, a value another
+// tool already masked). It runs after detection and before transformation.
+// The hook decides per span: verification of the published text consults it
+// again for each finding in the output, so the same value in another place
+// is still caught unless the hook keeps that span too.
+// Values the caller declared (`knownSecrets`, `knownPersonal`,
+// `confirmedPersonal`) and structured `JSON_VALUE` denials are never offered.
+const declared = new Set([
+  'known-secret',
+  'known-personal',
+  'confirmed-personal',
+]);
+const offered = (finding) =>
+  !declared.has(finding.rule) && finding.type !== 'JSON_VALUE';
+
+function view(text, finding) {
+  return Object.freeze({
+    ...finding,
+    value: text.slice(finding.start, finding.end),
+  });
+}
+
+export function validateExempt(exempt) {
+  if (exempt !== undefined && typeof exempt !== 'function') {
+    throw failure('ERR_CONFIG');
+  }
+}
+
+function decision(kept) {
+  if (typeof kept !== 'boolean') {
+    // `undefined` from a forgotten return must not silently keep a secret.
+    throw failure('ERR_CONFIG');
+  }
+  return kept;
+}
+
+export function exemptFindings(text, findings, exempt) {
+  if (!exempt) {
+    return findings;
+  }
+  return findings.filter((finding) => {
+    if (!offered(finding)) {
+      return true;
+    }
+    const kept = exempt(view(text, finding), text);
+    if (typeof kept?.then === 'function') {
+      // An async hook needs the async engine (`createSanitizer`).
+      kept.then(undefined, () => {});
+      throw failure('ERR_CONFIG');
+    }
+    return !decision(kept);
+  });
+}
+
+export async function exemptFindingsAsync(text, findings, exempt) {
+  if (!exempt) {
+    return findings;
+  }
+  const retained = [];
+  for (const finding of findings) {
+    if (
+      !offered(finding) ||
+      !decision(await exempt(view(text, finding), text))
+    ) {
+      retained.push(finding);
+    }
+  }
+  return retained;
+}

package/src/fake-memory.js

@@ -0,0 +1,32 @@
+import { failure } from './detection.js';
+
+// Values that `mode: 'fake'` generated, per transformation object, so that a
+// later pass recognizes them as fictional. Kept apart from fake.js so that the
+// credentials entry can read the (empty) memory without loading faker.
+const generated = new WeakMap();
+export function generatedValues(options) {
+  const transforms = [
+    options.transformation,
+    ...Object.values(options.transformations ?? {}),
+  ];
+  return transforms.flatMap((t) =>
+    t?.mode === 'fake'
+      ? [...(generated.get(t) ?? [])].map(([value, credential]) => ({
+          value,
+          credential,
+        }))
+      : []
+  );
+}
+export function remember(value, transform, credential) {
+  let values = generated.get(transform);
+  if (!values) {
+    values = new Map();
+    generated.set(transform, values);
+  }
+  if (values.size >= 100000 && !values.has(value)) {
+    throw failure('ERR_LIMIT');
+  }
+  values.set(value, credential);
+  return value;
+}

package/src/fake.js

@@ -4,35 +4,11 @@ import { parsePhoneNumberFromString } from 'libphonenumber-js/max';
 import { mrzCheck } from './identity.js';
 import { fakeName } from './fake-names.js';
 import * as checks from './national-checks.js';
-import { REDACTED, failure } from './detection.js';
+import { REDACTED } from './detection.js';
+import { remember } from './fake-memory.js';
+
+export { generatedValues } from './fake-memory.js';
 
-const generated = new WeakMap();
-export function generatedValues(options) {
-  const transforms = [
-    options.transformation,
-    ...Object.values(options.transformations ?? {}),
-  ];
-  return transforms.flatMap((t) =>
-    t?.mode === 'fake'
-      ? [...(generated.get(t) ?? [])].map(([value, credential]) => ({
-          value,
-          credential,
-        }))
-      : []
-  );
-}
-function remember(value, transform, credential) {
-  let values = generated.get(transform);
-  if (!values) {
-    values = new Map();
-    generated.set(transform, values);
-  }
-  if (values.size >= 100000 && !values.has(value)) {
-    throw failure('ERR_LIMIT');
-  }
-  values.set(value, credential);
-  return value;
-}
 function digest(value, key, purpose = 'value') {
   return createHmac('sha256', key).update(`${purpose}\0${value}`).digest();
 }