@treza/cli 1.1.0 → 1.2.0

package/dist/utils/redact-local.js

@@ -0,0 +1,160 @@
+/**
+ * In-process redaction for `--local` mode.
+ *
+ * Pipeline:
+ *   1. Deterministic regex/checksum recognizers (SSN, CC w/ Luhn, MRN, DOB cues)
+ *      — these match the in-enclave recognizers exactly via `redact-manifest.json`.
+ *   2. Lightweight regex-based NER fallback for emails, phones, URLs, and dates.
+ *
+ * Names and free-form addresses require the Privacy Filter token-classifier;
+ * that swap is gated on shipping an ONNX export through `@huggingface/transformers`.
+ * When wired in, replace `fallbackNer` with the transformers.js pipeline; the rest
+ * of this module (merge, placeholder assignment, manifest) stays the same.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { fileURLToPath } from 'url';
+const MANIFEST_PATH = path.join(path.dirname(fileURLToPath(import.meta.url)), 'redact-manifest.json');
+let cachedManifest = null;
+function loadManifest() {
+    if (cachedManifest)
+        return cachedManifest;
+    const raw = fs.readFileSync(MANIFEST_PATH, 'utf8');
+    cachedManifest = JSON.parse(raw);
+    return cachedManifest;
+}
+function luhnValid(digits) {
+    const trimmed = digits.replace(/[\s-]/g, '');
+    if (trimmed.length < 13 || trimmed.length > 19 || !/^\d+$/.test(trimmed))
+        return false;
+    let sum = 0;
+    let alt = false;
+    for (let i = trimmed.length - 1; i >= 0; i--) {
+        let d = trimmed.charCodeAt(i) - 48;
+        if (alt) {
+            d *= 2;
+            if (d > 9)
+                d -= 9;
+        }
+        sum += d;
+        alt = !alt;
+    }
+    return sum % 10 === 0;
+}
+function ssnValid(match) {
+    const [, a, b, c] = match;
+    if (a === '000' || a === '666' || a.startsWith('9'))
+        return false;
+    if (b === '00')
+        return false;
+    if (c === '0000')
+        return false;
+    return true;
+}
+function runRegexRecognizers(text, manifest) {
+    const spans = [];
+    for (const rec of manifest.regexRecognizers) {
+        const re = new RegExp(rec.pattern, 'g');
+        let match;
+        while ((match = re.exec(text)) !== null) {
+            if (rec.validator === 'ssn_format' && !ssnValid(match))
+                continue;
+            if (rec.validator === 'luhn' && !luhnValid(match[0]))
+                continue;
+            const captureIdx = rec.captureGroup ?? 0;
+            const captured = match[captureIdx] ?? match[0];
+            const offset = match[0].indexOf(captured);
+            const start = match.index + (offset >= 0 ? offset : 0);
+            const end = start + captured.length;
+            spans.push({ type: rec.type, start, end, original: captured });
+        }
+    }
+    return spans;
+}
+function isDobContext(text, start, manifest) {
+    const window = manifest.dobCueWindowChars;
+    const before = text.slice(Math.max(0, start - window), start).toLowerCase();
+    for (const cue of manifest.dobCueWords) {
+        if (before.includes(cue.toLowerCase()))
+            return true;
+    }
+    return false;
+}
+/**
+ * Best-effort NER fallback for the MVP local mode. Detects emails, phones,
+ * URLs, and simple dates with deterministic patterns. This is a stand-in
+ * until the Privacy Filter ONNX export is wired in (handled in a later
+ * task; the harness here makes that swap a one-line change).
+ */
+function fallbackNer(text) {
+    const found = [];
+    const patterns = [
+        ['private_email', /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi],
+        ['private_phone', /\b(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b/g],
+        ['private_url', /\bhttps?:\/\/[^\s)]+/g],
+        [
+            'private_date',
+            /\b(?:\d{1,2}[\/-]\d{1,2}[\/-]\d{2,4}|\d{4}-\d{2}-\d{2}|(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)[a-z]*\s+\d{1,2},?\s+\d{4})\b/g,
+        ],
+    ];
+    for (const [type, re] of patterns) {
+        let m;
+        while ((m = re.exec(text)) !== null) {
+            found.push({ type, start: m.index, end: m.index + m[0].length });
+        }
+    }
+    return found;
+}
+function mergeSpans(regex, ner) {
+    const out = [...regex];
+    for (const n of ner) {
+        const overlaps = regex.some((r) => !(n.end <= r.start || n.start >= r.end));
+        if (!overlaps) {
+            out.push({ type: n.type, start: n.start, end: n.end, original: '' });
+        }
+    }
+    out.sort((a, b) => a.start - b.start);
+    return out;
+}
+function assignPlaceholders(spans, text, manifest) {
+    const counters = {};
+    const entities = [];
+    let cursor = 0;
+    let redacted = '';
+    for (const span of spans) {
+        let label = span.type;
+        if (label === 'private_date' && isDobContext(text, span.start, manifest)) {
+            label = 'DOB';
+        }
+        const placeholderBase = manifest.placeholderMap[label] || label.toUpperCase();
+        counters[placeholderBase] = (counters[placeholderBase] || 0) + 1;
+        const placeholder = `[${placeholderBase}_${counters[placeholderBase]}]`;
+        redacted += text.slice(cursor, span.start);
+        const placeholderStart = redacted.length;
+        redacted += placeholder;
+        cursor = span.end;
+        entities.push({
+            type: placeholderBase,
+            placeholder,
+            start: placeholderStart,
+            end: placeholderStart + placeholder.length,
+        });
+    }
+    redacted += text.slice(cursor);
+    return { redacted, entities };
+}
+export async function redactTextLocal(text) {
+    const manifest = loadManifest();
+    const regexSpans = runRegexRecognizers(text, manifest);
+    const ner = fallbackNer(text);
+    const merged = mergeSpans(regexSpans, ner);
+    const { redacted, entities } = assignPlaceholders(merged, text, manifest);
+    return {
+        redacted,
+        entities,
+        requestId: `local-${Date.now().toString(36)}`,
+        modelVersion: 'local-fallback-ner-0.1',
+        recognizerVersion: manifest.recognizerVersion,
+    };
+}
+//# sourceMappingURL=redact-local.js.map

package/dist/utils/redact-local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-local.js","sourceRoot":"","sources":["../../src/utils/redact-local.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAkBpC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAC7B,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAC5C,sBAAsB,CACvB,CAAC;AAEF,IAAI,cAAc,GAA0B,IAAI,CAAC;AACjD,SAAS,YAAY;IACnB,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAC1C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACnD,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;IACnD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAS,SAAS,CAAC,MAAc;IAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACvF,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACnC,IAAI,GAAG,EAAE,CAAC;YACR,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,CAAC,GAAG,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,GAAG,IAAI,CAAC,CAAC;QACT,GAAG,GAAG,CAAC,GAAG,CAAC;IACb,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAsB;IACtC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IAC1B,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/B,OAAO,IAAI,CAAC;AACd,CAAC;AASD,SAAS,mBAAmB,CAAC,IAAY,EAAE,QAAwB;IACjE,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACxC,IAAI,KAA6B,CAAC;QAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,IAAI,GAAG,CAAC,SAAS,KAAK,YAAY,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,SAAS;YACjE,IAAI,GAAG,CAAC,SAAS,KAAK,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC/D,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvD,MAAM,GAAG,GAAG,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,KAAa,EAAE,QAAwB;IACzE,MAAM,MAAM,GAAG,QAAQ,CAAC,iBAAiB,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5E,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAQD;;;;;GAKG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,MAAM,QAAQ,GAA4B;QACxC,CAAC,eAAe,EAAE,6CAA6C,CAAC;QAChE,CAAC,eAAe,EAAE,0DAA0D,CAAC;QAC7E,CAAC,aAAa,EAAE,uBAAuB,CAAC;QACxC;YACE,cAAc;YACd,0IAA0I;SAC3I;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAgB,EAAE,GAAqB;IACzD,MAAM,GAAG,GAAc,CAAC,GAAG,KAAK,CAAC,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAgB,EAChB,IAAY,EACZ,QAAwB;IAExB,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,QAAQ,GAAG,EAAE,CAAC;IAElB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,KAAK,KAAK,cAAc,IAAI,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YACzE,KAAK,GAAG,KAAK,CAAC;QAChB,CAAC;QACD,MAAM,eAAe,GAAG,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9E,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,IAAI,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC;QAExE,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC;QACzC,QAAQ,IAAI,WAAW,CAAC;QACxB,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC;QAElB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,eAAe;YACrB,WAAW;YACX,KAAK,EAAE,gBAAgB;YACvB,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAAC,MAAM;SAC3C,CAAC,CAAC;IACL,CAAC;IACD,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY;IAChD,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC3C,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC1E,OAAO;QACL,QAAQ;QACR,QAAQ;QACR,SAAS,EAAE,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;QAC7C,YAAY,EAAE,wBAAwB;QACtC,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;KAC9C,CAAC;AACJ,CAAC"}

package/dist/utils/redact-manifest.json

@@ -0,0 +1,44 @@
+{
+  "recognizerVersion": "0.1.0",
+  "placeholderMap": {
+    "private_person": "NAME",
+    "private_address": "ADDRESS",
+    "private_email": "EMAIL",
+    "private_phone": "PHONE",
+    "private_url": "URL",
+    "private_date": "DATE",
+    "account_number": "ACCOUNT",
+    "secret": "SECRET",
+    "SSN": "SSN",
+    "CREDIT_CARD": "CC",
+    "MRN": "MRN",
+    "DOB": "DOB"
+  },
+  "regexRecognizers": [
+    {
+      "type": "SSN",
+      "pattern": "\\b(?!000|666|9\\d{2})(\\d{3})-(?!00)(\\d{2})-(?!0000)(\\d{4})\\b",
+      "validator": "ssn_format"
+    },
+    {
+      "type": "CREDIT_CARD",
+      "pattern": "\\b(?:\\d[ -]?){13,19}\\b",
+      "validator": "luhn"
+    },
+    {
+      "type": "MRN",
+      "pattern": "\\b(?:MRN|Medical Record(?: Number)?)[:#\\s]*([A-Z0-9-]{4,12})\\b",
+      "validator": "none",
+      "captureGroup": 1
+    }
+  ],
+  "dobCueWords": [
+    "dob",
+    "born",
+    "date of birth",
+    "patient",
+    "mrn",
+    "medical record"
+  ],
+  "dobCueWindowChars": 64
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treza/cli",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Command-line interface for the Treza platform - manage enclaves, KYC proofs, and more",
   "type": "module",
   "main": "dist/index.js",
@@ -8,7 +8,8 @@
     "treza": "./dist/index.js"
   },
   "scripts": {
-    "build": "tsc",
+    "build": "tsc && npm run build:assets",
+    "build:assets": "node -e \"const fs=require('fs');const path=require('path');fs.mkdirSync('dist/utils',{recursive:true});fs.copyFileSync('src/utils/redact-manifest.json','dist/utils/redact-manifest.json');\"",
     "dev": "tsc -w",
     "start": "node dist/index.js",
     "lint": "eslint src --ext .ts",