@tienne/gestalt 0.98.0 → 0.100.0

package/dist/src/research/pii-core.js

@@ -0,0 +1,345 @@
+/**
+ * 개인정보 탐지와 가짜 값 치환 코어.
+ *
+ * Node(이미지 경로의 OCR 결과 글자)와 브라우저(DOM 글자)가 같은 구현을 쓰도록 소스 문자열로
+ * 둔다. `Function.toString()`으로 뽑지 않는 건 번들러가 함수 안에 헬퍼를 끼워 넣어 브라우저에서
+ * 깨지기 때문이다. 이 문자열은 `node:vm`과 `page.evaluate` 양쪽에서 그대로 평가된다.
+ *
+ * 규칙
+ * - 실제 값과 가명의 대응표를 만들지 않는다. 가명은 `seed + 종류 + 정규화한 값`의 해시로
+ *   정해서, 같은 값이면 같은 가명이 나오지만 가명에서 실제 값을 되돌릴 수 없다.
+ * - 이 소스 안에서 백틱과 `${`를 쓰지 않는다. String.raw가 깨진다.
+ * - 못 잡는 것: 라벨 없는 이름, 성씨 목록 밖의 이름, 사진 속 글자가 아닌 정보. `pii: none`은
+ *   "탐지기가 돌았고 0건"이라는 뜻이지 개인정보가 없다는 보증이 아니다.
+ */
+export const PII_CORE_SOURCE = String.raw `(function () {
+  var SURNAMES = '김이박최정강조윤장임한오서신권황안송류전홍고문양손배백허유남심노하곽성차주우구민나진지엄채원천방공현함변염여추도소석선설마길연위표명기반왕금옥육인맹제모탁국어은편용';
+  var COMPOUND_SURNAMES = ['남궁', '선우', '독고', '황보', '제갈', '사공', '서문', '동방'];
+  var NOT_NAMES = ['고객', '선생', '손님', '구매', '이용', '기사', '주인', '입력', '필수', '선택', '확인', '정보', '변경', '등록', '수정', '삭제', '조회', '주문', '배송', '전체', '회원', '사용', '결제', '인증', '번호', '주소', '이름', '성명', '연락'];
+  var POOL = {
+    2: ['이솔', '김하', '박온', '최윤', '정서', '강율', '조안', '한결'],
+    3: ['홍길동', '김철수', '이영희', '박민수', '최지우', '정수민', '강다은', '조현우', '윤서연', '한지민'],
+    4: ['남궁민수', '선우지안', '독고서진', '황보라희', '제갈민준', '사공유나', '서문하늘', '동방지후']
+  };
+  var LABELS = {
+    name: '이름|성명|성함|수령인|받는\\s?분|보내는\\s?분|예금주|구매자|주문자|수취인|대표자|대표이사|대표(?=\\s*[:：])',
+    birth: '생년월일|생일',
+    address: '주소|배송지|배송\\s?주소|도로명',
+    account: '환불\\s?계좌|입금\\s?계좌|계좌\\s?번호|계좌',
+    order: '주문\\s?번호|예약\\s?번호|승인\\s?번호|운송장\\s?번호|거래\\s?번호',
+    biz: '사업자\\s?등록\\s?번호|사업자\\s?번호|법인\\s?등록\\s?번호|통신판매업\\s?신고(?:\\s?번호)?|통신판매업\\s?번호',
+    gift: '바코드(?:\\s?번호)?|PIN(?:\\s?번호)?|핀\\s?번호|쿠폰\\s?번호|교환\\s?번호|인증\\s?번호|시리얼(?:\\s?번호)?|상품권\\s?번호|기프티콘\\s?번호',
+    phone: '전화번호|휴대폰(?:\\s?번호)?|핸드폰(?:\\s?번호)?|연락처|전화',
+    email: '이메일|메일'
+  };
+  var LABEL_ONLY = {};
+  var LABEL_INLINE = {};
+  Object.keys(LABELS).forEach(function (kind) {
+    LABEL_ONLY[kind] = new RegExp('^(?:' + LABELS[kind] + ')\\s*[:：]?$');
+  });
+  var VALUE_PATTERNS = {
+    name: '[가-힣]{2,4}',
+    birth: '\\d{4}[.\\-/년 ]+\\d{1,2}[.\\-/월 ]+\\d{1,2}일?|\\d{8}|\\d{6}',
+    address: '[^\\n]{4,100}',
+    account: '\\d[\\d-]{7,24}\\d',
+    order: '[A-Za-z0-9-]{6,32}',
+    biz: '[0-9][0-9A-Za-z가-힣-]{5,28}',
+    gift: '[A-Za-z0-9][A-Za-z0-9 -]{4,30}[A-Za-z0-9]',
+    phone: '\\+?[\\d][\\d .-]{7,16}\\d',
+    email: '[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}'
+  };
+  Object.keys(LABELS).forEach(function (kind) {
+    LABEL_INLINE[kind] = new RegExp('(?:' + LABELS[kind] + ')(?:\\s*[:：]\\s*|\\s+)(' + VALUE_PATTERNS[kind] + ')(님)?', 'dg');
+  });
+
+  var NIM_NAME = /(?<![가-힣])([가-힣]{2,4})님/dg;
+  var MASKED_NIM_NAME = /(?<![가-힣])([가-힣]{1,3}[*＊○●]{1,2}[가-힣]{0,2})님/dg;
+  var EMAIL = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
+  var PHONE = /(?<!\d)(?:\+82[-. ]?)?0\d{1,2}[-. ]?\d{3,4}[-. ]?\d{4}(?!\d)/g;
+  var RRN = /(?<!\d)\d{6}[- ]?[1-8]\d{6}(?!\d)/g;
+  var CARD = /(?<!\d)(?:\d{4}[- ]){3}\d{4}(?!\d)|(?<!\d)\d{16}(?!\d)/g;
+  var LONG_CODE = /(?<!\d)\d{4}(?:[- ]?\d{4}){2,}(?!\d)/g;
+  var ROAD_ADDRESS = /[가-힣]{2,6}(?:특별시|광역시|특별자치시|특별자치도|도|시)\s[가-힣]{1,6}(?:시|군|구)\s[가-힣0-9]{1,12}(?:로|길)\s?\d{1,4}(?:-\d{1,4})?(?:\s?[0-9가-힣-]{1,12}(?:동|호|층))*/g;
+
+  function hashString(str, seedNum) {
+    var h1 = 0xdeadbeef ^ seedNum;
+    var h2 = 0x41c6ce57 ^ seedNum;
+    for (var i = 0; i < str.length; i++) {
+      var ch = str.charCodeAt(i);
+      h1 = Math.imul(h1 ^ ch, 2654435761);
+      h2 = Math.imul(h2 ^ ch, 1597334677);
+    }
+    h1 = Math.imul(h1 ^ (h1 >>> 16), 2246822507) ^ Math.imul(h2 ^ (h2 >>> 13), 3266489909);
+    h2 = Math.imul(h2 ^ (h2 >>> 16), 2246822507) ^ Math.imul(h1 ^ (h1 >>> 13), 3266489909);
+    return 4294967296 * (2097151 & h2) + (h1 >>> 0);
+  }
+
+  function pad(n, width) {
+    var s = String(n);
+    while (s.length < width) s = '0' + s;
+    return s;
+  }
+
+  function startsWithSurname(word) {
+    if (word.length >= 4 && COMPOUND_SURNAMES.indexOf(word.slice(0, 2)) >= 0) return true;
+    return SURNAMES.indexOf(word.charAt(0)) >= 0;
+  }
+
+  function plausibleName(word) {
+    if (!/^[가-힣]{2,4}$/.test(word)) return false;
+    if (NOT_NAMES.indexOf(word.slice(0, 2)) >= 0) return false;
+    return startsWithSurname(word);
+  }
+
+  function plausibleMaskedName(word) {
+    if (word.length > 4) return false;
+    if (NOT_NAMES.indexOf(word.slice(0, 2)) >= 0) return false;
+    return startsWithSurname(word);
+  }
+
+  function createPii(seed) {
+    var seedNum = hashString(String(seed), 7) % 2147483647;
+
+    function keyed(kind, value) {
+      return hashString(kind + '\u0000' + value, seedNum);
+    }
+    function tail4(kind, value) {
+      return pad(keyed(kind, value) % 10000, 4);
+    }
+    function digitsOf(text) {
+      return text.replace(/\D/g, '');
+    }
+
+    function fakePhone(value) {
+      var key = digitsOf(value);
+      var groups = value.split(/(\d+)/);
+      var numericIdx = [];
+      for (var i = 0; i < groups.length; i++) if (/^\d+$/.test(groups[i])) numericIdx.push(i);
+      var tail = tail4('phone', key);
+      if (numericIdx.length === 1) {
+        var only = groups[numericIdx[0]];
+        var head = only.length <= 10 && only.indexOf('02') === 0 ? 2 : 3;
+        groups[numericIdx[0]] = only.slice(0, head) + new Array(only.length - head - 3).join('0') + tail;
+        return groups.join('');
+      }
+      var keep = value.indexOf('+82') === 0 ? 2 : 1;
+      for (var j = keep; j < numericIdx.length; j++) {
+        var idx = numericIdx[j];
+        groups[idx] = j === numericIdx.length - 1 ? tail : new Array(groups[idx].length + 1).join('0');
+      }
+      return groups.join('');
+    }
+
+    function fakeEmail(value) {
+      var h = keyed('email', value.toLowerCase());
+      return 'user' + (100 + (h % 900)) + '@example.com';
+    }
+
+    function fakeName(word, suffix) {
+      var len = word.length;
+      var list = POOL[len] || POOL[3];
+      return list[keyed('name', word) % list.length] + (suffix || '');
+    }
+
+    function fakeDateParts(value) {
+      var h = keyed('date', digitsOf(value));
+      return { y: 1975 + (h % 30), m: 1 + (Math.floor(h / 30) % 12), d: 1 + (Math.floor(h / 360) % 28) };
+    }
+
+    function fakeBirth(value) {
+      var p = fakeDateParts(value);
+      var m = /^(\d{4})([.\-/년 ]+)(\d{1,2})([.\-/월 ]+)(\d{1,2})(일?)$/.exec(value);
+      if (m) {
+        var mm = m[3].length === 2 ? pad(p.m, 2) : String(p.m);
+        var dd = m[5].length === 2 ? pad(p.d, 2) : String(p.d);
+        return p.y + m[2] + mm + m[4] + dd + m[6];
+      }
+      if (/^\d{8}$/.test(value)) return p.y + pad(p.m, 2) + pad(p.d, 2);
+      if (/^\d{6}$/.test(value)) return pad(p.y % 100, 2) + pad(p.m, 2) + pad(p.d, 2);
+      return value.replace(/\d/g, '0');
+    }
+
+    function fakeRrn(value) {
+      var p = fakeDateParts(value);
+      var sep = /[- ]/.exec(value);
+      return pad(p.y % 100, 2) + pad(p.m, 2) + pad(p.d, 2) + (sep ? sep[0] : '') + '1000000';
+    }
+
+    function maskDigits(kind, value, keepLetters) {
+      var key = kind + ':' + value.replace(/[^A-Za-z0-9]/g, '');
+      var tail = tail4(kind, key);
+      var total = 0;
+      for (var i = 0; i < value.length; i++) if (/\d/.test(value.charAt(i))) total++;
+      var seen = 0;
+      var out = '';
+      for (var k = 0; k < value.length; k++) {
+        var c = value.charAt(k);
+        if (/\d/.test(c)) {
+          seen++;
+          out += total >= 4 && seen > total - 4 ? tail.charAt(seen - (total - 4) - 1) : '0';
+        } else if (/[A-Za-z]/.test(c)) {
+          out += keepLetters ? c : 'X';
+        } else {
+          out += c;
+        }
+      }
+      return out;
+    }
+
+    function fakeCard(value) {
+      return maskDigits('card', value, true);
+    }
+
+    function fakeAddress(value) {
+      var h = keyed('address', value.replace(/\s+/g, ''));
+      return '서울특별시 샘플구 예시로 ' + (10 + (h % 90));
+    }
+
+    function fakeDigits(value) {
+      return maskDigits('barcode', value, false);
+    }
+
+    function validAddressValue(value) {
+      return /[가-힣]/.test(value) && /\d/.test(value);
+    }
+
+    var REPLACERS = {
+      email: function (v) { return fakeEmail(v); },
+      phone: function (v) { return fakePhone(v); },
+      card: function (v) { return fakeCard(v); },
+      birth: function (v) { return fakeBirth(v); },
+      address: function (v) { return fakeAddress(v); },
+      account: function (v) { return maskDigits('account', v, true); },
+      order: function (v) { return maskDigits('order', v, true); },
+      biz: function (v) { return maskDigits('biz', v, true); },
+      gift: function (v) { return maskDigits('gift', v, false); }
+    };
+
+    /** 글 한 덩어리에서 개인정보 구간을 찾는다. ctxKind가 있으면 글 전체를 그 종류의 값으로 본다 */
+    function detect(text, ctxKind) {
+      var found = [];
+      function add(kind, start, end, replacement) {
+        if (replacement !== text.slice(start, end)) found.push({ kind: kind, start: start, end: end, replacement: replacement });
+      }
+
+      if (ctxKind) {
+        var lead = text.length - text.replace(/^\s+/, '').length;
+        var body = text.trim();
+        if (body) {
+          if (ctxKind === 'name') {
+            var suffix = /님$/.test(body) ? '님' : '';
+            var word = suffix ? body.slice(0, -1) : body;
+            if (plausibleName(word)) add('name', lead, lead + body.length, fakeName(word, suffix));
+          } else if (ctxKind === 'address') {
+            if (validAddressValue(body)) add('address', lead, lead + body.length, fakeAddress(body));
+          } else if (REPLACERS[ctxKind] && /\d|@/.test(body)) {
+            add(ctxKind, lead, lead + body.length, REPLACERS[ctxKind](body));
+          }
+        }
+      }
+
+      var m;
+      Object.keys(LABEL_INLINE).forEach(function (kind) {
+        var re = new RegExp(LABEL_INLINE[kind].source, 'dg');
+        while ((m = re.exec(text)) !== null) {
+          var value = m[1];
+          var span = m.indices[1];
+          if (kind === 'name') {
+            var nameSuffix = m[2] || '';
+            var nameWord = value;
+            if (!nameSuffix && value.length >= 3 && /님$/.test(value)) {
+              nameSuffix = '님';
+              nameWord = value.slice(0, -1);
+            }
+            if (plausibleName(nameWord)) add('name', span[0], span[1] + (m[2] ? 1 : 0), fakeName(nameWord, nameSuffix));
+          } else if (kind === 'address') {
+            if (validAddressValue(value)) add('address', span[0], span[1], fakeAddress(value));
+          } else if (kind === 'birth' || kind === 'phone' || kind === 'account' || kind === 'order' || kind === 'biz' || kind === 'gift' || kind === 'email') {
+            if (/\d|@/.test(value)) add(kind, span[0], span[1], REPLACERS[kind](value));
+          }
+          if (m[0].length === 0) re.lastIndex++;
+        }
+      });
+
+      var re2 = new RegExp(NIM_NAME.source, 'dg');
+      while ((m = re2.exec(text)) !== null) {
+        if (plausibleName(m[1])) add('name', m.indices[1][0], m.indices[0][1], fakeName(m[1], '님'));
+      }
+      var re3 = new RegExp(MASKED_NIM_NAME.source, 'dg');
+      while ((m = re3.exec(text)) !== null) {
+        if (plausibleMaskedName(m[1])) add('name', m.indices[1][0], m.indices[0][1], fakeName(m[1], '님'));
+      }
+      EMAIL.lastIndex = 0;
+      while ((m = EMAIL.exec(text)) !== null) {
+        if (!/@example\.com$/i.test(m[0])) add('email', m.index, m.index + m[0].length, fakeEmail(m[0]));
+      }
+      [[PHONE, 'phone', fakePhone], [RRN, 'rrn', fakeRrn], [CARD, 'card', fakeCard], [ROAD_ADDRESS, 'address', fakeAddress], [LONG_CODE, 'gift', function (v) { return maskDigits('gift', v, false); }]].forEach(function (entry) {
+        var re3 = new RegExp(entry[0].source, 'g');
+        while ((m = re3.exec(text)) !== null) {
+          add(entry[1], m.index, m.index + m[0].length, entry[2](m[0]));
+        }
+      });
+
+      found.sort(function (a, b) { return a.start - b.start || (b.end - b.start) - (a.end - a.start); });
+      var kept = [];
+      var lastEnd = -1;
+      found.forEach(function (f) {
+        if (f.start >= lastEnd) {
+          kept.push(f);
+          lastEnd = f.end;
+        }
+      });
+      return kept;
+    }
+
+    function apply(text, spans) {
+      var out = '';
+      var pos = 0;
+      spans.forEach(function (s) {
+        out += text.slice(pos, s.start) + s.replacement;
+        pos = s.end;
+      });
+      return out + text.slice(pos);
+    }
+
+    function redactText(text, ctxKind) {
+      var spans = detect(text, ctxKind);
+      return { text: spans.length ? apply(text, spans) : text, spans: spans };
+    }
+
+    function labelKindOf(text) {
+      var t = text.trim();
+      if (t.length === 0 || t.length > 14) return null;
+      var kinds = Object.keys(LABEL_ONLY);
+      for (var i = 0; i < kinds.length; i++) if (LABEL_ONLY[kinds[i]].test(t)) return kinds[i];
+      return null;
+    }
+
+    function kindFromHints(hints) {
+      var h = String(hints).toLowerCase();
+      if (/email|e-mail|이메일/.test(h)) return 'email';
+      if (/tel|phone|mobile|휴대폰|전화|연락처/.test(h)) return 'phone';
+      if (/bday|birth|생년|생일/.test(h)) return 'birth';
+      if (/street|address|addr|주소|배송지/.test(h)) return 'address';
+      if (/cc-number|card|카드/.test(h)) return 'card';
+      if (/account|계좌/.test(h)) return 'account';
+      if (/order|주문|예약/.test(h)) return 'order';
+      if (/business|사업자|법인|통신판매/.test(h)) return 'biz';
+      if (/pin|barcode|coupon|gift|바코드|쿠폰|핀|교환|인증번호/.test(h)) return 'gift';
+      if (/name|이름|성명|수령|받는|예금주|대표자|대표이사/.test(h)) return 'name';
+      return null;
+    }
+
+    return {
+      detect: detect,
+      redactText: redactText,
+      labelKindOf: labelKindOf,
+      kindFromHints: kindFromHints,
+      fakeDigits: fakeDigits,
+      hash: function (kind, value) { return keyed(kind, value); }
+    };
+  }
+
+  return createPii;
+})()`;
+//# sourceMappingURL=pii-core.js.map

package/dist/src/research/pii-core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-core.js","sourceRoot":"","sources":["../../../src/research/pii-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAyUpC,CAAC"}

package/dist/src/research/pii-dom.d.ts

@@ -0,0 +1,13 @@
+export interface DomRedactionOptions {
+    /** true면 이후 화면이 바뀔 때마다(무한 스크롤, 지연 로딩) 다시 치환한다 */
+    observe?: boolean;
+}
+/**
+ * 웹 화면을 캡처하기 전에 DOM의 개인정보를 가짜 값으로 바꾸는 스크립트를 만든다.
+ * 세션이 aside나 chrome-devtools의 evaluate로 실행한다. 반환값은 바꾼 개수뿐이고 값은 담지 않는다.
+ *
+ * 못 건드리는 곳: 닫힌 shadow root, 다른 출처의 iframe, canvas에 그려진 글자.
+ * 이런 영역이 화면에 있으면 `pii: none`으로 적지 말고 `unchecked`로 남긴다.
+ */
+export declare function buildDomRedactionScript(seed: string, options?: DomRedactionOptions): string;
+//# sourceMappingURL=pii-dom.d.ts.map

package/dist/src/research/pii-dom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-dom.d.ts","sourceRoot":"","sources":["../../../src/research/pii-dom.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,mBAAmB;IAClC,iDAAiD;IACjD,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB,GAAG,MAAM,CAgB/F"}

package/dist/src/research/pii-dom.js

@@ -0,0 +1,208 @@
+import { PII_CORE_SOURCE } from './pii-core.js';
+/**
+ * 웹 화면을 캡처하기 전에 DOM의 개인정보를 가짜 값으로 바꾸는 스크립트를 만든다.
+ * 세션이 aside나 chrome-devtools의 evaluate로 실행한다. 반환값은 바꾼 개수뿐이고 값은 담지 않는다.
+ *
+ * 못 건드리는 곳: 닫힌 shadow root, 다른 출처의 iframe, canvas에 그려진 글자.
+ * 이런 영역이 화면에 있으면 `pii: none`으로 적지 말고 `unchecked`로 남긴다.
+ */
+export function buildDomRedactionScript(seed, options = {}) {
+    const observe = options.observe === true;
+    return ('(function () {\n' +
+        'var createPii = ' +
+        PII_CORE_SOURCE +
+        ';\n' +
+        'var pii = createPii(' +
+        JSON.stringify(seed) +
+        ');\n' +
+        'var OBSERVE = ' +
+        (observe ? 'true' : 'false') +
+        ';\n' +
+        DOM_BODY +
+        '\n})()');
+}
+const DOM_BODY = String.raw `
+var AVATAR_RE = /avatar|profile|프로필|user-?photo|thumb-?user/i;
+var BARCODE_RE = /barcode|qr-?code|qrcode|바코드|큐알/i;
+var SKIP_TAGS = { SCRIPT: 1, STYLE: 1, NOSCRIPT: 1, TEXTAREA: 1 };
+var AVATAR_SVG = '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 96 96"><rect width="96" height="96" fill="#e5e7eb"/><circle cx="48" cy="38" r="16" fill="#9ca3af"/><path d="M16 88c0-18 14-30 32-30s32 12 32 30z" fill="#9ca3af"/></svg>';
+var AVATAR_URI = 'data:image/svg+xml;utf8,' + encodeURIComponent(AVATAR_SVG);
+
+function barcodeUri(width, height, key) {
+  var bars = '';
+  var x = 0;
+  var i = 0;
+  while (x < width) {
+    var h = pii.hash('bar', key + ':' + i);
+    var w = 1 + (h % 3);
+    if (i % 2 === 0) bars += '<rect x="' + x + '" y="0" width="' + w + '" height="' + height + '" fill="#111827"/>';
+    x += w;
+    i++;
+  }
+  var svg = '<svg xmlns="http://www.w3.org/2000/svg" width="' + width + '" height="' + height + '" viewBox="0 0 ' + width + ' ' + height + '"><rect width="' + width + '" height="' + height + '" fill="#fff"/>' + bars + '</svg>';
+  return 'data:image/svg+xml;utf8,' + encodeURIComponent(svg);
+}
+
+var counts = { text: 0, inputs: 0, attrs: 0, avatars: 0, barcodes: 0 };
+
+function hintsOf(el) {
+  return [el.getAttribute('type'), el.getAttribute('name'), el.id, el.getAttribute('autocomplete'), el.getAttribute('placeholder'), el.getAttribute('aria-label'), el.getAttribute('inputmode')].join(' ');
+}
+
+function redactTextNodes(root) {
+  var walker = document.createTreeWalker(root, NodeFilter.SHOW_TEXT, {
+    acceptNode: function (node) {
+      var p = node.parentElement;
+      if (p && SKIP_TAGS[p.tagName]) return NodeFilter.FILTER_REJECT;
+      return NodeFilter.FILTER_ACCEPT;
+    }
+  });
+  var pending = null;
+  var node;
+  while ((node = walker.nextNode())) {
+    var text = node.nodeValue || '';
+    if (!text.trim()) continue;
+    var label = pii.labelKindOf(text);
+    if (label) {
+      pending = label;
+      continue;
+    }
+    var r = pii.redactText(text, pending);
+    pending = null;
+    if (r.spans.length) {
+      node.nodeValue = r.text;
+      counts.text += r.spans.length;
+    }
+  }
+}
+
+function redactInputs(root) {
+  var fields = root.querySelectorAll('input, textarea');
+  for (var i = 0; i < fields.length; i++) {
+    var el = fields[i];
+    var type = (el.getAttribute('type') || 'text').toLowerCase();
+    if (type === 'password' || type === 'hidden' || type === 'checkbox' || type === 'radio' || type === 'button' || type === 'submit') continue;
+    var value = el.value || '';
+    if (!value) continue;
+    var kind = pii.kindFromHints(hintsOf(el));
+    var r = pii.redactText(value, kind);
+    if (r.spans.length) {
+      el.value = r.text;
+      el.setAttribute('value', r.text);
+      counts.inputs += r.spans.length;
+    }
+  }
+}
+
+function redactAttributes(root) {
+  var names = ['alt', 'title', 'placeholder', 'aria-label'];
+  var els = root.querySelectorAll('[alt], [title], [placeholder], [aria-label]');
+  for (var i = 0; i < els.length; i++) {
+    for (var j = 0; j < names.length; j++) {
+      var v = els[i].getAttribute(names[j]);
+      if (!v) continue;
+      var r = pii.redactText(v, null);
+      if (r.spans.length) {
+        els[i].setAttribute(names[j], r.text);
+        counts.attrs += r.spans.length;
+      }
+    }
+  }
+}
+
+function classText(el) {
+  var c = el.getAttribute('class') || '';
+  return c + ' ' + (el.id || '') + ' ' + (el.getAttribute('alt') || '');
+}
+
+function redactAvatars(root) {
+  var imgs = root.querySelectorAll('img');
+  for (var i = 0; i < imgs.length; i++) {
+    var img = imgs[i];
+    if (img.getAttribute('data-pii-done')) continue;
+    if (AVATAR_RE.test(classText(img)) || AVATAR_RE.test(img.getAttribute('src') || '')) {
+      img.removeAttribute('srcset');
+      img.setAttribute('src', AVATAR_URI);
+      if (img.hasAttribute('alt')) img.setAttribute('alt', '프로필 사진');
+      img.removeAttribute('title');
+      img.setAttribute('data-pii-done', '1');
+      counts.avatars++;
+    }
+  }
+  var all = root.querySelectorAll('[class*="avatar" i], [class*="profile" i], [class*="프로필"]');
+  for (var k = 0; k < all.length; k++) {
+    var el = all[k];
+    if (el.tagName === 'IMG' || el.getAttribute('data-pii-done')) continue;
+    var bg = getComputedStyle(el).backgroundImage;
+    if (bg && bg !== 'none') {
+      el.style.backgroundImage = 'url("' + AVATAR_URI + '")';
+      el.setAttribute('data-pii-done', '1');
+      counts.avatars++;
+    }
+  }
+}
+
+function redactBarcodes(root) {
+  var els = root.querySelectorAll('img, canvas, svg, div, span');
+  for (var i = 0; i < els.length; i++) {
+    var el = els[i];
+    if (el.getAttribute('data-pii-done')) continue;
+    if (!BARCODE_RE.test(classText(el)) && !(el.tagName === 'IMG' && BARCODE_RE.test(el.getAttribute('src') || ''))) continue;
+    if (el.tagName !== 'IMG' && el.querySelector && el.querySelector('img, canvas, svg')) continue;
+    var rect = el.getBoundingClientRect();
+    var w = Math.max(60, Math.round(rect.width));
+    var h = Math.max(24, Math.round(rect.height));
+    var uri = barcodeUri(w, h, w + 'x' + h);
+    if (el.tagName === 'IMG') {
+      el.removeAttribute('srcset');
+      el.setAttribute('src', uri);
+      el.setAttribute('data-pii-done', '1');
+    } else if (el.tagName === 'DIV' || el.tagName === 'SPAN') {
+      el.style.backgroundImage = 'url("' + uri + '")';
+      el.style.backgroundSize = '100% 100%';
+      el.setAttribute('data-pii-done', '1');
+    } else {
+      var repl = document.createElement('img');
+      repl.setAttribute('src', uri);
+      repl.setAttribute('data-pii-done', '1');
+      repl.style.width = w + 'px';
+      repl.style.height = h + 'px';
+      el.replaceWith(repl);
+    }
+    counts.barcodes++;
+  }
+}
+
+function runAll() {
+  redactTextNodes(document.body);
+  redactInputs(document);
+  redactAttributes(document);
+  redactAvatars(document);
+  redactBarcodes(document);
+}
+
+function start() {
+  runAll();
+  if (OBSERVE && typeof MutationObserver !== 'undefined' && !window.__piiObserver) {
+    var timer = null;
+    window.__piiObserver = new MutationObserver(function () {
+      if (timer) return;
+      timer = setTimeout(function () {
+        timer = null;
+        window.__piiObserver.disconnect();
+        try { runAll(); } finally {
+          window.__piiObserver.observe(document.body, { childList: true, subtree: true, characterData: true });
+        }
+      }, 150);
+    });
+    window.__piiObserver.observe(document.body, { childList: true, subtree: true, characterData: true });
+  }
+}
+
+// addInitScript로 심으면 body가 생기기 전에 실행된다. 그때는 DOM이 준비되길 기다린다
+if (document.body) start();
+else document.addEventListener('DOMContentLoaded', start);
+
+return counts;
+`;
+//# sourceMappingURL=pii-dom.js.map

package/dist/src/research/pii-dom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-dom.js","sourceRoot":"","sources":["../../../src/research/pii-dom.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAOhD;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,UAA+B,EAAE;IACrF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC;IACzC,OAAO,CACL,kBAAkB;QAClB,kBAAkB;QAClB,eAAe;QACf,KAAK;QACL,sBAAsB;QACtB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QACpB,MAAM;QACN,gBAAgB;QAChB,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5B,KAAK;QACL,QAAQ;QACR,QAAQ,CACT,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuL1B,CAAC"}

package/dist/src/research/pii-image.d.ts

@@ -0,0 +1,71 @@
+import type { PiiRedactor } from './pii.js';
+export interface VisionBox {
+    x: number;
+    y: number;
+    w: number;
+    h: number;
+}
+export interface OcrToken {
+    start: number;
+    end: number;
+    box: VisionBox;
+}
+export interface OcrLine {
+    text: string;
+    box: VisionBox;
+    confidence: number;
+    tokens: OcrToken[];
+}
+export interface OcrResult {
+    width: number;
+    height: number;
+    languages: string[];
+    lines: OcrLine[];
+    faces: VisionBox[];
+    barcodes: {
+        payload?: string | null;
+        symbology: string;
+        box: VisionBox;
+    }[];
+}
+export interface PaintItem {
+    type: 'text' | 'avatar' | 'barcode';
+    box: VisionBox;
+    text?: string;
+}
+export interface RedactionPlan {
+    items: PaintItem[];
+    counts: {
+        text: number;
+        avatars: number;
+        barcodes: number;
+    };
+}
+export type PiiState = 'replaced' | 'none' | 'unchecked';
+export interface ImageRedactionResult {
+    pii: PiiState;
+    outputPath: string;
+    counts: RedactionPlan['counts'];
+    warnings: string[];
+}
+/** OCR 결과에서 가려야 할 칸과 그 자리에 그릴 가짜 값을 정한다. 이미지는 건드리지 않는다 */
+export declare function planRedaction(ocr: OcrResult, pii: PiiRedactor): RedactionPlan;
+export type VisionRunner = (args: string[]) => Promise<string>;
+export declare function swiftRunner(scriptPath: string, timeoutMs?: number): VisionRunner;
+/** macOS이고 swift 도구체인이 있을 때만 Vision을 쓸 수 있다. 첫 호출 결과를 프로세스 동안 재사용한다 */
+export declare function isVisionAvailable(): Promise<boolean>;
+export declare function outputExtFor(inputPath: string, replaced: boolean): string;
+export interface RedactImageOptions {
+    inputPath: string;
+    /** 확장자를 뺀 출력 경로. 실제 확장자는 결과의 outputPath에 있다 */
+    outputBase: string;
+    pii: PiiRedactor;
+    run: VisionRunner | undefined;
+}
+/**
+ * 이미지 한 장의 개인정보를 가짜 값으로 바꿔 저장한다.
+ * - Vision을 못 쓰면 원본을 그대로 복사하고 `unchecked`로 남긴다
+ * - 탐지가 0건이면 원본을 복사하고 `none`이다. 라벨 없는 이름은 못 잡을 수 있어서 보증은 아니다
+ */
+export declare function redactImageFile(opts: RedactImageOptions): Promise<ImageRedactionResult>;
+//# sourceMappingURL=pii-image.d.ts.map

package/dist/src/research/pii-image.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-image.d.ts","sourceRoot":"","sources":["../../../src/research/pii-image.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAI5C,MAAM,WAAW,SAAS;IACxB,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;CACX;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,SAAS,CAAC;CAChB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,SAAS,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,QAAQ,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,QAAQ,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,SAAS,CAAA;KAAE,EAAE,CAAC;CAC5E;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IACpC,GAAG,EAAE,SAAS,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7D;AAED,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,WAAW,CAAC;AAEzD,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,QAAQ,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AA2DD,0DAA0D;AAC1D,wBAAgB,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,GAAG,aAAa,CAoC7E;AAED,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE/D,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,SAAU,GAAG,YAAY,CAQjF;AAID,uEAAuE;AACvE,wBAAgB,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CASpD;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,MAAM,CAIzE;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,WAAW,CAAC;IACjB,GAAG,EAAE,YAAY,GAAG,SAAS,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA0C7F"}