@mushi-mushi/core 1.22.4 → 1.22.5

package/dist/index.cjs

@@ -1648,38 +1648,40 @@ function createRateLimiter(config = {}) {
   return { tryConsume, reset, availableTokens };
 }
 
-// src/pii-scrubber.ts
-var ORDERED_PATTERNS = [
-  { key: "ssns", regex: /\b\d{3}-\d{2}-\d{4}\b/g, replacement: "[REDACTED_SSN]" },
-  { key: "creditCards", regex: /\b(?:\d[ -]*){12,18}\d\b/g, replacement: "[REDACTED_CC]" },
-  // Vendor secret tokens — mirrors packages/server/.../pii-scrubber.ts exactly.
-  { key: "secretTokens", regex: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g, replacement: "[REDACTED_AWS_KEY]" },
-  { key: "secretTokens", regex: /(?:aws_secret_access_key|secret_access_key)["'\s:=]+[A-Za-z0-9/+=]{40}\b/gi, replacement: "aws_secret_access_key=[REDACTED_AWS_SECRET]" },
-  { key: "secretTokens", regex: /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{24,}\b/g, replacement: "[REDACTED_STRIPE_KEY]" },
-  { key: "secretTokens", regex: /\bpk_(?:live|test)_[A-Za-z0-9]{24,}\b/g, replacement: "[REDACTED_STRIPE_PK]" },
-  { key: "secretTokens", regex: /\bxox[abpor]-[A-Za-z0-9-]{10,}\b/g, replacement: "[REDACTED_SLACK_TOKEN]" },
-  { key: "secretTokens", regex: /\bghp_[A-Za-z0-9]{36}\b/g, replacement: "[REDACTED_GITHUB_PAT]" },
-  { key: "secretTokens", regex: /\bgithub_pat_[A-Za-z0-9_]{80,}\b/g, replacement: "[REDACTED_GITHUB_PAT]" },
-  { key: "secretTokens", regex: /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g, replacement: "[REDACTED_OPENAI_KEY]" },
-  { key: "secretTokens", regex: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g, replacement: "[REDACTED_ANTHROPIC_KEY]" },
-  { key: "secretTokens", regex: /\bAIza[0-9A-Za-z_-]{35}\b/g, replacement: "[REDACTED_GOOGLE_KEY]" },
-  { key: "secretTokens", regex: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, replacement: "[REDACTED_JWT]" },
-  { key: "emails", regex: /\b[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}\b/g, replacement: "[REDACTED_EMAIL]" },
-  { key: "phones", regex: /(?:\+\d{1,3}[\s.-])?\(?\d{2,4}\)?[\s.-]\d{3,4}[\s.-]\d{3,4}\b/g, replacement: "[REDACTED_PHONE]" },
-  { key: "ipAddresses", regex: /\b(?:\d{1,3}\.){3}\d{1,3}\b/g, replacement: "[REDACTED_IP]" },
-  { key: "ipv6", regex: /\b(?:[A-Fa-f0-9]{1,4}:){2,7}[A-Fa-f0-9]{0,4}\b/g, replacement: "[REDACTED_IPV6]" }
-];
-var DEFAULT_CONFIG = {
-  emails: true,
-  phones: true,
-  creditCards: true,
-  ssns: true,
-  ipAddresses: false,
-  // Secret tokens default ON — if they leak into a bug report there's no
-  // good reason to ship them to our servers. Cheaper to scrub client-side.
-  secretTokens: true,
-  ipv6: false
+// src/pii-patterns.json
+var pii_patterns_default = {
+  patterns: [
+    { id: "ssn", configKey: "ssns", source: "\\b\\d{3}-\\d{2}-\\d{4}\\b", replacement: "[REDACTED_SSN]" },
+    { id: "creditCard", configKey: "creditCards", source: "\\b(?:\\d[ -]*){12,18}\\d\\b", replacement: "[REDACTED_CC]" },
+    { id: "awsAccessKey", configKey: "secretTokens", source: "\\b(?:AKIA|ASIA)[0-9A-Z]{16}\\b", replacement: "[REDACTED_AWS_KEY]" },
+    { id: "awsSecretKey", configKey: "secretTokens", source: `(?:aws_secret_access_key|secret_access_key)["'\\s:=]+[A-Za-z0-9/+=]{40}\\b`, caseInsensitive: true, replacement: "aws_secret_access_key=[REDACTED_AWS_SECRET]" },
+    { id: "stripeSecretKey", configKey: "secretTokens", source: "\\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{24,}\\b", replacement: "[REDACTED_STRIPE_KEY]" },
+    { id: "stripePublishableKey", configKey: "secretTokens", source: "\\bpk_(?:live|test)_[A-Za-z0-9]{24,}\\b", replacement: "[REDACTED_STRIPE_PK]" },
+    { id: "slackToken", configKey: "secretTokens", source: "\\bxox[abpor]-[A-Za-z0-9-]{10,}\\b", replacement: "[REDACTED_SLACK_TOKEN]" },
+    { id: "githubPatClassic", configKey: "secretTokens", source: "\\bghp_[A-Za-z0-9]{36}\\b", replacement: "[REDACTED_GITHUB_PAT]" },
+    { id: "githubPatFineGrained", configKey: "secretTokens", source: "\\bgithub_pat_[A-Za-z0-9_]{80,}\\b", replacement: "[REDACTED_GITHUB_PAT]" },
+    { id: "openaiKey", configKey: "secretTokens", source: "\\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\\b", replacement: "[REDACTED_OPENAI_KEY]" },
+    { id: "anthropicKey", configKey: "secretTokens", source: "\\bsk-ant-[A-Za-z0-9_-]{20,}\\b", replacement: "[REDACTED_ANTHROPIC_KEY]" },
+    { id: "googleKey", configKey: "secretTokens", source: "\\bAIza[0-9A-Za-z_-]{35}\\b", replacement: "[REDACTED_GOOGLE_KEY]" },
+    { id: "jwt", configKey: "secretTokens", source: "\\beyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\b", replacement: "[REDACTED_JWT]" },
+    { id: "email", configKey: "emails", source: "\\b[A-Za-z0-9._%+\\-]+@[A-Za-z0-9.\\-]+\\.[A-Za-z]{2,}\\b", replacement: "[REDACTED_EMAIL]" },
+    { id: "phone", configKey: "phones", source: "(?:\\+\\d{1,3}[\\s.-])?\\(?\\d{2,4}\\)?[\\s.-]\\d{3,4}[\\s.-]\\d{3,4}\\b", replacement: "[REDACTED_PHONE]" },
+    { id: "ipv4", configKey: "ipAddresses", source: "\\b(?:\\d{1,3}\\.){3}\\d{1,3}\\b", replacement: "[REDACTED_IP]", defaultOn: false },
+    { id: "ipv6", configKey: "ipv6", source: "\\b(?:[A-Fa-f0-9]{1,4}:){2,7}[A-Fa-f0-9]{0,4}\\b", replacement: "[REDACTED_IPV6]", defaultOn: false }
+  ]
 };
+
+// src/pii-scrubber.ts
+var RAW_PATTERNS = pii_patterns_default.patterns;
+var ORDERED_PATTERNS = RAW_PATTERNS.map((p) => ({
+  key: p.configKey,
+  regex: new RegExp(p.source, p.caseInsensitive ? "gi" : "g"),
+  replacement: p.replacement
+}));
+var DEFAULT_CONFIG = RAW_PATTERNS.reduce((acc, p) => {
+  acc[p.configKey] = p.defaultOn !== false;
+  return acc;
+}, {});
 function createPiiScrubber(config = {}) {
   const merged = { ...DEFAULT_CONFIG, ...config };
   const activePatterns = ORDERED_PATTERNS.filter((p) => merged[p.key]);