@procedures/privacy-scan 0.0.0-stage → 0.3.0

package/dist/procedures.js

@@ -0,0 +1,70 @@
+/**
+ * The procedures of `@procedures/privacy-scan`: `privacyScan.text` (pure) and
+ * `privacyScan.files` (it reads files). Both change nothing.
+ */
+import { createProcedure, zodAdapter } from "@procedures/client";
+import { z } from "zod";
+import { FINDING_KINDS, readTermList, scanFiles, scanText } from "./scan.js";
+const kindSchema = z.enum(FINDING_KINDS);
+const optionFields = {
+    terms: z.array(z.string()).optional().describe("The private terms (names, places, accounts). The match ignores case and finds only whole words."),
+    allow: z.array(z.string()).optional().describe("The values that are not private. The match ignores case."),
+    kinds: z.array(kindSchema).optional().describe("The kinds to find: term, email, phone, coordinate (default: all)"),
+    mask: z.boolean().optional().describe("Show only the first character of each match (default: false)"),
+};
+const findingFields = {
+    kind: kindSchema,
+    line: z.number().int(),
+    column: z.number().int(),
+    match: z.string(),
+};
+// privacyScan.text
+const TextInputSchema = z.object({
+    text: z.string().describe("The text to scan"),
+    ...optionFields,
+});
+const TextOutputSchema = z.object({ findings: z.array(z.object(findingFields)) });
+export const privacyScanTextProcedure = createProcedure()
+    .path(["privacyScan", "text"])
+    .input(zodAdapter(TextInputSchema))
+    .output(zodAdapter(TextOutputSchema))
+    .meta({
+    description: "Find private data in a text: terms of a list, email addresses, phone numbers, coordinates",
+    args: ["text"],
+    output: "json",
+    effects: { reads: [], writes: [] },
+})
+    .handler(async (input) => ({
+    findings: scanText(input.text, { terms: input.terms, allow: input.allow, kinds: input.kinds, mask: input.mask }),
+}))
+    .build();
+// privacyScan.files
+const FilesInputSchema = z.object({
+    paths: z.array(z.string().min(1)).min(1).describe("The files and folders to scan. A folder gives all its files."),
+    ...optionFields,
+    termsFile: z.string().min(1).optional().describe("A file with more terms, one on each line. A line that starts with # is a comment."),
+    allowFile: z.string().min(1).optional().describe("A file with more allowed values, in the format of termsFile"),
+});
+const FilesOutputSchema = z.object({
+    findings: z.array(z.object({ file: z.string(), ...findingFields })),
+    files: z.number().int(),
+    skipped: z.array(z.string()),
+});
+export const privacyScanFilesProcedure = createProcedure()
+    .path(["privacyScan", "files"])
+    .input(zodAdapter(FilesInputSchema))
+    .output(zodAdapter(FilesOutputSchema))
+    .meta({
+    description: "Find private data in files and folders: terms of a list, email addresses, phone numbers, coordinates",
+    args: ["paths"],
+    output: "json",
+    effects: { reads: ["fs"], writes: [] },
+})
+    .handler(async (input) => {
+    const terms = [...(input.terms ?? []), ...(input.termsFile === undefined ? [] : await readTermList(input.termsFile))];
+    const allow = [...(input.allow ?? []), ...(input.allowFile === undefined ? [] : await readTermList(input.allowFile))];
+    return scanFiles(input.paths, { terms, allow, kinds: input.kinds, mask: input.mask });
+})
+    .build();
+export const privacyScanProcedures = [privacyScanTextProcedure, privacyScanFilesProcedure];
+//# sourceMappingURL=procedures.js.map

package/dist/procedures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"procedures.js","sourceRoot":"","sources":["../src/procedures.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,eAAe,EAAE,UAAU,EAAqB,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAiD,MAAM,WAAW,CAAC;AAE5H,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,aAAgD,CAAC,CAAC;AAE5E,MAAM,YAAY,GAAG;IACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iGAAiG,CAAC;IACjJ,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0DAA0D,CAAC;IAC1G,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kEAAkE,CAAC;IAClH,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC;CACtG,CAAC;AAEF,MAAM,aAAa,GAAG;IACpB,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC;AAEF,mBAAmB;AAEnB,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAC7C,GAAG,YAAY;CAChB,CAAC,CAAC;AAOH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC;AAElF,MAAM,CAAC,MAAM,wBAAwB,GAAiB,eAAe,EAAE;KACpE,IAAI,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;KAC7B,KAAK,CAAC,UAAU,CAAY,eAAe,CAAC,CAAC;KAC7C,MAAM,CAAC,UAAU,CAAa,gBAAgB,CAAC,CAAC;KAChD,IAAI,CAAC;IACJ,WAAW,EAAE,2FAA2F;IACxG,IAAI,EAAE,CAAC,MAAM,CAAC;IACd,MAAM,EAAE,MAAM;IACd,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;CACnC,CAAC;KACD,OAAO,CAAC,KAAK,EAAE,KAAgB,EAAuB,EAAE,CAAC,CAAC;IACzD,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;CACjH,CAAC,CAAC;KACF,KAAK,EAAkB,CAAC;AAE3B,oBAAoB;AAEpB,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,8DAA8D,CAAC;IACjH,GAAG,YAAY;IACf,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mFAAmF,CAAC;IACrI,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6DAA6D,CAAC;CAChH,CAAC,CAAC;AAGH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,aAAa,EAAE,CAAC,CAAC;IACnE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACvB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAiB,eAAe,EAAE;KACrE,IAAI,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;KAC9B,KAAK,CAAC,UAAU,CAAa,gBAAgB,CAAC,CAAC;KAC/C,MAAM,CAAC,UAAU,CAAW,iBAAiB,CAAC,CAAC;KAC/C,IAAI,CAAC;IACJ,WAAW,EAAE,sGAAsG;IACnH,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,MAAM,EAAE,MAAM;IACd,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;CACvC,CAAC;KACD,OAAO,CAAC,KAAK,EAAE,KAAiB,EAAqB,EAAE;IACtD,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACtH,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACtH,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AACxF,CAAC,CAAC;KACD,KAAK,EAAkB,CAAC;AAE3B,MAAM,CAAC,MAAM,qBAAqB,GAAmB,CAAC,wBAAwB,EAAE,yBAAyB,CAAC,CAAC"}

package/dist/register.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Importing this file registers the procedures of @procedures/privacy-scan in the global registry:
+ * `import "@procedures/privacy-scan/register"`. The package root registers nothing.
+ */
+export * from "./module.js";
+//# sourceMappingURL=register.d.ts.map

package/dist/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../src/register.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,cAAc,aAAa,CAAC"}

package/dist/register.js

@@ -0,0 +1,8 @@
+/**
+ * Importing this file registers the procedures of @procedures/privacy-scan in the global registry:
+ * `import "@procedures/privacy-scan/register"`. The package root registers nothing.
+ */
+import { registerPrivacyScanProcedures } from "./module.js";
+export * from "./module.js";
+registerPrivacyScanProcedures();
+//# sourceMappingURL=register.js.map

package/dist/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../src/register.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAC;AAE5D,cAAc,aAAa,CAAC;AAE5B,6BAA6B,EAAE,CAAC"}

package/dist/scan.d.ts

@@ -0,0 +1,70 @@
+/**
+ * The scan for private data in text: email addresses, phone numbers, coordinate pairs and the
+ * terms of a list that the caller gives. Use it before a text or a file goes public.
+ */
+/** The kinds of private data that the scan finds. */
+export type FindingKind = "term" | "email" | "phone" | "coordinate";
+/** All the kinds, in the order of the findings on one position. */
+export declare const FINDING_KINDS: readonly FindingKind[];
+/** A place in a text that holds private data. */
+export interface Finding {
+    /** The kind of the data. */
+    readonly kind: FindingKind;
+    /** The line of the match. The first line is 1. */
+    readonly line: number;
+    /** The position of the first character of the match in its line. The first position is 1. */
+    readonly column: number;
+    /** The matched text. With the option `mask`, only its first character stays. */
+    readonly match: string;
+}
+/** A finding in a file. */
+export interface FileFinding extends Finding {
+    /** The path of the file. */
+    readonly file: string;
+}
+/** The options of the scan. */
+export interface ScanOptions {
+    /** The private terms: names, places, accounts. The match ignores case and finds only whole words. */
+    readonly terms?: readonly string[] | undefined;
+    /** The values that are not private. The scan does not report them, for each kind. The match ignores case. */
+    readonly allow?: readonly string[] | undefined;
+    /** The kinds to find (default: all). */
+    readonly kinds?: readonly FindingKind[] | undefined;
+    /** True: each match shows only its first character, and a `*` for each other character. */
+    readonly mask?: boolean | undefined;
+}
+/** The result of `scanFiles`. */
+export interface FileScan {
+    /** The findings, file by file. */
+    readonly findings: FileFinding[];
+    /** The number of text files that the scan examined. */
+    readonly files: number;
+    /** The binary files, which the scan does not examine. */
+    readonly skipped: string[];
+}
+/** An email address. Use it with `matchAll`, or make a copy: the `g` flag keeps a state. */
+export declare const EMAIL_PATTERN: RegExp;
+/** A phone number: `+` and 10 to 15 digits, or the North American form `(555) 555-0100`. */
+export declare const PHONE_PATTERN: RegExp;
+/** A pair of coordinates with 4 decimals or more: `12.3456, -65.4321`. */
+export declare const COORDINATE_PATTERN: RegExp;
+/** This function hides a match: it keeps the first character and puts a `*` for each other character. */
+export declare function maskMatch(text: string): string;
+/**
+ * This function finds the private data in a text: the terms of the list, email addresses that
+ * are not examples, phone numbers and coordinate pairs. The findings are in text order.
+ */
+export declare function scanText(text: string, options?: ScanOptions): Finding[];
+/**
+ * This function scans files for private data. A folder in `paths` gives all its files, without
+ * `node_modules`, `.git`, `dist`, `coverage` and links. A missing path is an error.
+ */
+export declare function scanFiles(paths: readonly string[], options?: ScanOptions): Promise<FileScan>;
+/**
+ * This function reads a list file: one entry on each line. A line that starts with `#` is a
+ * comment. With `optional`, a missing file gives an empty list.
+ */
+export declare function readTermList(file: string, options?: {
+    readonly optional?: boolean | undefined;
+}): Promise<string[]>;
+//# sourceMappingURL=scan.d.ts.map

package/dist/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,qDAAqD;AACrD,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,YAAY,CAAC;AAEpE,mEAAmE;AACnE,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EAA6C,CAAC;AAE9F,iDAAiD;AACjD,MAAM,WAAW,OAAO;IACtB,4BAA4B;IAC5B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,2BAA2B;AAC3B,MAAM,WAAW,WAAY,SAAQ,OAAO;IAC1C,4BAA4B;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,+BAA+B;AAC/B,MAAM,WAAW,WAAW;IAC1B,qGAAqG;IACrG,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC/C,6GAA6G;IAC7G,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC/C,wCAAwC;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,WAAW,EAAE,GAAG,SAAS,CAAC;IACpD,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACrC;AAED,iCAAiC;AACjC,MAAM,WAAW,QAAQ;IACvB,kCAAkC;IAClC,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;IACjC,uDAAuD;IACvD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,4FAA4F;AAC5F,eAAO,MAAM,aAAa,EAAE,MAA0D,CAAC;AAEvF,4FAA4F;AAC5F,eAAO,MAAM,aAAa,EAAE,MAA6D,CAAC;AAE1F,0EAA0E;AAC1E,eAAO,MAAM,kBAAkB,EAAE,MAAuD,CAAC;AAuBzF,yGAAyG;AACzG,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI9C;AA2CD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,EAAE,CAE3E;AAgBD;;;GAGG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0BtG;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;CAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAY7H"}

package/dist/scan.js

@@ -0,0 +1,151 @@
+/**
+ * The scan for private data in text: email addresses, phone numbers, coordinate pairs and the
+ * terms of a list that the caller gives. Use it before a text or a file goes public.
+ */
+import { readdir, readFile, stat } from "node:fs/promises";
+import { join, resolve } from "node:path";
+/** All the kinds, in the order of the findings on one position. */
+export const FINDING_KINDS = ["term", "email", "phone", "coordinate"];
+/** An email address. Use it with `matchAll`, or make a copy: the `g` flag keeps a state. */
+export const EMAIL_PATTERN = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
+/** A phone number: `+` and 10 to 15 digits, or the North American form `(555) 555-0100`. */
+export const PHONE_PATTERN = /\+\d{10,15}\b|\(?\b\d{3}\)?[ .-]\d{3}[ .-]\d{4}\b/g;
+/** A pair of coordinates with 4 decimals or more: `12.3456, -65.4321`. */
+export const COORDINATE_PATTERN = /-?\b\d{1,3}\.\d{4,}\s*,\s*-?\d{1,3}\.\d{4,}/g;
+/** An address of a domain for examples and tests (RFC 2606) is not private. */
+const EXAMPLE_EMAIL = /@(?:[a-z0-9-]+\.)*(?:example\.(?:com|org|net)|test|invalid|localhost)$/i;
+/** The folders that the scan of a folder does not enter. */
+const SKIPPED_FOLDERS = new Set(["node_modules", ".git", "dist", "coverage", ".turbo"]);
+/** The scan reads the first bytes of a file to find a binary file: a text file has no NUL byte. */
+const BINARY_PROBE_BYTES = 8192;
+const escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/**
+ * This function makes the pattern of a term. The match ignores case. A term that starts or ends
+ * with a letter or a digit matches only when no letter or digit is next to it.
+ */
+function termPattern(term) {
+    const before = /^[A-Za-z0-9]/.test(term) ? "(?<![A-Za-z0-9])" : "";
+    const after = /[A-Za-z0-9]$/.test(term) ? "(?![A-Za-z0-9])" : "";
+    return new RegExp(`${before}${escapeRegExp(term)}${after}`, "gi");
+}
+/** This function hides a match: it keeps the first character and puts a `*` for each other character. */
+export function maskMatch(text) {
+    const characters = Array.from(text);
+    if (characters.length <= 1)
+        return "*".repeat(characters.length);
+    return `${characters[0]}${"*".repeat(characters.length - 1)}`;
+}
+/** This function makes the scanner of the options. The scanner of a text gives its findings. */
+function createScanner(options) {
+    const allowed = new Set((options.allow ?? []).map((value) => value.trim().toLowerCase()));
+    const kinds = new Set(options.kinds ?? FINDING_KINDS);
+    const rules = [];
+    if (kinds.has("term")) {
+        const seen = new Set();
+        for (const raw of options.terms ?? []) {
+            const term = raw.trim();
+            const key = term.toLowerCase();
+            if (term.length === 0 || seen.has(key) || allowed.has(key))
+                continue;
+            seen.add(key);
+            rules.push({ kind: "term", pattern: termPattern(term) });
+        }
+    }
+    if (kinds.has("email"))
+        rules.push({ kind: "email", pattern: EMAIL_PATTERN, keep: (match) => !EXAMPLE_EMAIL.test(match) });
+    if (kinds.has("phone"))
+        rules.push({ kind: "phone", pattern: PHONE_PATTERN });
+    if (kinds.has("coordinate"))
+        rules.push({ kind: "coordinate", pattern: COORDINATE_PATTERN });
+    const order = (kind) => FINDING_KINDS.indexOf(kind);
+    return (text) => {
+        const findings = [];
+        text.split(/\r?\n/).forEach((content, index) => {
+            for (const rule of rules) {
+                for (const match of content.matchAll(rule.pattern)) {
+                    const value = match[0];
+                    if (allowed.has(value.toLowerCase()) || (rule.keep !== undefined && !rule.keep(value)))
+                        continue;
+                    findings.push({ kind: rule.kind, line: index + 1, column: match.index + 1, match: options.mask === true ? maskMatch(value) : value });
+                }
+            }
+        });
+        return findings.sort((a, b) => a.line - b.line || a.column - b.column || order(a.kind) - order(b.kind));
+    };
+}
+/**
+ * This function finds the private data in a text: the terms of the list, email addresses that
+ * are not examples, phone numbers and coordinate pairs. The findings are in text order.
+ */
+export function scanText(text, options = {}) {
+    return createScanner(options)(text);
+}
+/** This function gives the files of a folder and of its subfolders, in name order. It does not follow links. */
+async function filesIn(dir) {
+    const entries = await readdir(dir, { withFileTypes: true });
+    entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+    const files = [];
+    for (const entry of entries) {
+        if (SKIPPED_FOLDERS.has(entry.name) || entry.isSymbolicLink())
+            continue;
+        const path = join(dir, entry.name);
+        if (entry.isDirectory())
+            files.push(...(await filesIn(path)));
+        else if (entry.isFile())
+            files.push(path);
+    }
+    return files;
+}
+/**
+ * This function scans files for private data. A folder in `paths` gives all its files, without
+ * `node_modules`, `.git`, `dist`, `coverage` and links. A missing path is an error.
+ */
+export async function scanFiles(paths, options = {}) {
+    const scan = createScanner(options);
+    const files = [];
+    const seen = new Set();
+    for (const path of paths) {
+        const list = (await stat(path)).isDirectory() ? await filesIn(path) : [path];
+        for (const file of list) {
+            const key = resolve(file);
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            files.push(file);
+        }
+    }
+    const findings = [];
+    const skipped = [];
+    for (const file of files) {
+        const buffer = await readFile(file);
+        if (buffer.subarray(0, BINARY_PROBE_BYTES).includes(0)) {
+            skipped.push(file);
+            continue;
+        }
+        // A byte order mark is not a character of the first line
+        const text = buffer.toString("utf8").replace(/^/, "");
+        for (const finding of scan(text))
+            findings.push({ file, ...finding });
+    }
+    return { findings, files: files.length - skipped.length, skipped };
+}
+/**
+ * This function reads a list file: one entry on each line. A line that starts with `#` is a
+ * comment. With `optional`, a missing file gives an empty list.
+ */
+export async function readTermList(file, options = {}) {
+    let text;
+    try {
+        text = await readFile(file, "utf8");
+    }
+    catch (error) {
+        if (options.optional === true && error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+    return text
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0 && !line.startsWith("#"));
+}
+//# sourceMappingURL=scan.js.map

package/dist/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAK1C,mEAAmE;AACnE,MAAM,CAAC,MAAM,aAAa,GAA2B,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;AA0C9F,4FAA4F;AAC5F,MAAM,CAAC,MAAM,aAAa,GAAW,iDAAiD,CAAC;AAEvF,4FAA4F;AAC5F,MAAM,CAAC,MAAM,aAAa,GAAW,oDAAoD,CAAC;AAE1F,0EAA0E;AAC1E,MAAM,CAAC,MAAM,kBAAkB,GAAW,8CAA8C,CAAC;AAEzF,+EAA+E;AAC/E,MAAM,aAAa,GAAG,yEAAyE,CAAC;AAEhG,4DAA4D;AAC5D,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;AAExF,mGAAmG;AACnG,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,MAAM,YAAY,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAE7F;;;GAGG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,OAAO,IAAI,MAAM,CAAC,GAAG,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;AACpE,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACjE,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AAChE,CAAC;AAQD,gGAAgG;AAChG,SAAS,aAAa,CAAC,OAAoB;IACzC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;IACtD,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACrE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3H,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,CAAC,IAAiB,EAAU,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzE,OAAO,CAAC,IAAY,EAAa,EAAE;QACjC,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;YAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACnD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBACvB,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBAAE,SAAS;oBACjG,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBACxI,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1G,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,OAAO,GAAgB,EAAE;IAC9D,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,gHAAgH;AAChH,KAAK,UAAU,OAAO,CAAC,GAAW;IAChC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,cAAc,EAAE;YAAE,SAAS;QACxE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aACzD,IAAI,KAAK,CAAC,MAAM,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAwB,EAAE,OAAO,GAAgB,EAAE;IACjF,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7E,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,yDAAyD;QACzD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,OAAO,GAAgD,EAAE;IACxG,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAC/F,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,IAAI;SACR,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC"}

package/package.json

@@ -1,6 +1,80 @@
 {
+  "$schema": "https://json.schemastore.org/package",
   "name": "@procedures/privacy-scan",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.3.0",
+  "description": "Find private data in text before it goes public: email addresses, phone numbers, coordinates and the terms of your list.",
+  "keywords": [
+    "privacy",
+    "pii",
+    "scan",
+    "secrets",
+    "lint",
+    "procedures"
+  ],
+  "homepage": "https://mark1russell7.github.io/client/",
+  "bugs": {
+    "url": "https://github.com/mark1russell7/client/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mark1russell7/client.git",
+    "directory": "packages/privacy-scan"
+  },
+  "license": "MIT",
+  "author": "Mark Russell (https://github.com/mark1russell7)",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./module": {
+      "types": "./dist/module.d.ts",
+      "import": "./dist/module.js"
+    },
+    "./register": {
+      "types": "./dist/register.d.ts",
+      "import": "./dist/register.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src",
+    "!src/**/*.test.ts",
+    "!src/**/*.test.tsx",
+    "!src/**/__tests__",
+    "CHANGELOG.md"
+  ],
+  "sideEffects": [
+    "./dist/register.js"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "dependencies": {
+    "@procedures/client": "0.3.0",
+    "zod": "^4.6.5"
+  },
+  "devDependencies": {
+    "typescript": "^7.0.2",
+    "@types/node": "^22.0.0",
+    "@mark1russell7/cue": "^1.0.0",
+    "vitest": "^5.0.3"
+  },
+  "client": {
+    "procedures": "./dist/register.js"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist .tsbuildinfo",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  }
 }

package/src/index.ts

@@ -0,0 +1,4 @@
+// The root registers nothing: import "<package>/register", or give the module to createRegistry()
+export * from "./module.js";
+export * from "./procedures.js";
+export * from "./scan.js";

package/src/module.ts

@@ -0,0 +1,18 @@
+/**
+ * The procedures of @procedures/privacy-scan as data. Importing this file registers nothing.
+ */
+
+import { defineModule, registerModules, PROCEDURE_REGISTRY, type ProcedureModule, type ProcedureRegistry } from "@procedures/client";
+import { privacyScanProcedures } from "./procedures.js";
+
+export const privacyScanModule: ProcedureModule = defineModule("@procedures/privacy-scan", privacyScanProcedures);
+
+export default privacyScanModule;
+
+/**
+ * This function registers the procedures of @procedures/privacy-scan in a registry. The default is the
+ * global registry.
+ */
+export function registerPrivacyScanProcedures(registry: ProcedureRegistry = PROCEDURE_REGISTRY): void {
+  registerModules(registry, [privacyScanModule]);
+}

package/src/procedures.ts

@@ -0,0 +1,88 @@
+/**
+ * The procedures of `@procedures/privacy-scan`: `privacyScan.text` (pure) and
+ * `privacyScan.files` (it reads files). Both change nothing.
+ */
+
+import { createProcedure, zodAdapter, type AnyProcedure } from "@procedures/client";
+import { z } from "zod";
+import { FINDING_KINDS, readTermList, scanFiles, scanText, type Finding, type FileScan, type FindingKind } from "./scan.js";
+
+const kindSchema = z.enum(FINDING_KINDS as [FindingKind, ...FindingKind[]]);
+
+const optionFields = {
+  terms: z.array(z.string()).optional().describe("The private terms (names, places, accounts). The match ignores case and finds only whole words."),
+  allow: z.array(z.string()).optional().describe("The values that are not private. The match ignores case."),
+  kinds: z.array(kindSchema).optional().describe("The kinds to find: term, email, phone, coordinate (default: all)"),
+  mask: z.boolean().optional().describe("Show only the first character of each match (default: false)"),
+};
+
+const findingFields = {
+  kind: kindSchema,
+  line: z.number().int(),
+  column: z.number().int(),
+  match: z.string(),
+};
+
+// privacyScan.text
+
+const TextInputSchema = z.object({
+  text: z.string().describe("The text to scan"),
+  ...optionFields,
+});
+type TextInput = z.infer<typeof TextInputSchema>;
+
+interface TextOutput {
+  /** The findings, in text order. */
+  findings: Finding[];
+}
+const TextOutputSchema = z.object({ findings: z.array(z.object(findingFields)) });
+
+export const privacyScanTextProcedure: AnyProcedure = createProcedure()
+  .path(["privacyScan", "text"])
+  .input(zodAdapter<TextInput>(TextInputSchema))
+  .output(zodAdapter<TextOutput>(TextOutputSchema))
+  .meta({
+    description: "Find private data in a text: terms of a list, email addresses, phone numbers, coordinates",
+    args: ["text"],
+    output: "json",
+    effects: { reads: [], writes: [] },
+  })
+  .handler(async (input: TextInput): Promise<TextOutput> => ({
+    findings: scanText(input.text, { terms: input.terms, allow: input.allow, kinds: input.kinds, mask: input.mask }),
+  }))
+  .build() as AnyProcedure;
+
+// privacyScan.files
+
+const FilesInputSchema = z.object({
+  paths: z.array(z.string().min(1)).min(1).describe("The files and folders to scan. A folder gives all its files."),
+  ...optionFields,
+  termsFile: z.string().min(1).optional().describe("A file with more terms, one on each line. A line that starts with # is a comment."),
+  allowFile: z.string().min(1).optional().describe("A file with more allowed values, in the format of termsFile"),
+});
+type FilesInput = z.infer<typeof FilesInputSchema>;
+
+const FilesOutputSchema = z.object({
+  findings: z.array(z.object({ file: z.string(), ...findingFields })),
+  files: z.number().int(),
+  skipped: z.array(z.string()),
+});
+
+export const privacyScanFilesProcedure: AnyProcedure = createProcedure()
+  .path(["privacyScan", "files"])
+  .input(zodAdapter<FilesInput>(FilesInputSchema))
+  .output(zodAdapter<FileScan>(FilesOutputSchema))
+  .meta({
+    description: "Find private data in files and folders: terms of a list, email addresses, phone numbers, coordinates",
+    args: ["paths"],
+    output: "json",
+    effects: { reads: ["fs"], writes: [] },
+  })
+  .handler(async (input: FilesInput): Promise<FileScan> => {
+    const terms = [...(input.terms ?? []), ...(input.termsFile === undefined ? [] : await readTermList(input.termsFile))];
+    const allow = [...(input.allow ?? []), ...(input.allowFile === undefined ? [] : await readTermList(input.allowFile))];
+    return scanFiles(input.paths, { terms, allow, kinds: input.kinds, mask: input.mask });
+  })
+  .build() as AnyProcedure;
+
+export const privacyScanProcedures: AnyProcedure[] = [privacyScanTextProcedure, privacyScanFilesProcedure];

package/src/register.ts

@@ -0,0 +1,10 @@
+/**
+ * Importing this file registers the procedures of @procedures/privacy-scan in the global registry:
+ * `import "@procedures/privacy-scan/register"`. The package root registers nothing.
+ */
+
+import { registerPrivacyScanProcedures } from "./module.js";
+
+export * from "./module.js";
+
+registerPrivacyScanProcedures();