mask-privacy 3.5.0 → 4.0.0

package/dist/index.mjs

@@ -4,8 +4,8 @@ import * as path from 'path';
 import { join, normalize, sep, dirname } from 'path';
 import * as os from 'os';
 import { platform, release, homedir } from 'os';
-import * as cryptoNode from 'crypto';
-import cryptoNode__default, { createHmac, createHash, createPrivateKey, createPublicKey, sign } from 'crypto';
+import * as crypto2 from 'crypto';
+import crypto2__default, { createHmac, createHash, createPrivateKey, createPublicKey, sign } from 'crypto';
 import { Buffer as Buffer$1 } from 'buffer';
 import { Writable, Readable } from 'stream';
 import { Agent, request as request$1 } from 'https';
@@ -89,6 +89,16 @@ var init_config = __esm({
       get MASK_LOG_LEVEL() {
         return (process2.env.MASK_LOG_LEVEL || "info").toLowerCase();
       },
+      // --- COMPLIANCE & PRIVACY (Bijective) ---
+      get MASK_TENANT_ID() {
+        return process2.env.MASK_TENANT_ID || "global-default-tenant";
+      },
+      get MASK_SALT_ROTATION() {
+        return (process2.env.MASK_SALT_ROTATION || "NONE").toUpperCase();
+      },
+      get MASK_BIJECTIVE_MODE() {
+        return getEnvBool("MASK_BIJECTIVE_MODE", true);
+      },
       // --- SECURITY & CRYPTOGRAPHY ---
       get MASK_ENCRYPTION_KEY() {
         return process2.env.MASK_ENCRYPTION_KEY || null;
@@ -227,6 +237,216 @@ var init_exceptions = __esm({
   }
 });
 
+// src/core/synthesisLibrary.ts
+var FIRST_NAMES, CONNECTORS, SURNAME_ROOTS, SURNAME_SUFFIXES, SYLLABLES;
+var init_synthesisLibrary = __esm({
+  "src/core/synthesisLibrary.ts"() {
+    FIRST_NAMES = [
+      "James",
+      "Mary",
+      "Robert",
+      "Patricia",
+      "John",
+      "Jennifer",
+      "Michael",
+      "Linda",
+      "David",
+      "Elizabeth",
+      "William",
+      "Barbara",
+      "Richard",
+      "Susan",
+      "Joseph",
+      "Jessica"
+    ];
+    while (FIRST_NAMES.length < 2048) {
+      FIRST_NAMES.push(`NameEx_${FIRST_NAMES.length}`);
+    }
+    CONNECTORS = [
+      "of",
+      "from",
+      "van",
+      "del",
+      "di",
+      "von",
+      "le",
+      "la",
+      "de",
+      "el",
+      "the",
+      "near",
+      "at",
+      "by",
+      "under",
+      "over",
+      "across",
+      "beyond",
+      "within",
+      "without",
+      "and",
+      "with",
+      "aka",
+      "alias",
+      "formally",
+      "lately",
+      "born",
+      "styled",
+      "known",
+      "called",
+      "st",
+      "al",
+      "bin",
+      "ibn",
+      "abu",
+      "ben",
+      "bar",
+      "fitz",
+      "mac",
+      "mc",
+      "o",
+      "da",
+      "dos",
+      "das",
+      "do",
+      "du",
+      "della",
+      "degli",
+      "dei",
+      "delle",
+      "sur",
+      "ter",
+      "ten",
+      "zu",
+      "zum",
+      "zur",
+      "auf",
+      "an",
+      "der",
+      "die",
+      "das",
+      "pro",
+      "anti",
+      "ex",
+      "quasi"
+    ];
+    SURNAME_ROOTS = [
+      "Silver",
+      "Gold",
+      "Iron",
+      "Stone",
+      "Rock",
+      "Wood",
+      "Leaf",
+      "Rain",
+      "Snow",
+      "Wind",
+      "Storm",
+      "Cloud",
+      "Sun",
+      "Moon",
+      "Star",
+      "Sky",
+      "Sea",
+      "Lake",
+      "River",
+      "Brook",
+      "Hill",
+      "Mount",
+      "Vale",
+      "Glen",
+      "Dale",
+      "Field",
+      "Meadow",
+      "Forest",
+      "Grove",
+      "Wild"
+    ];
+    while (SURNAME_ROOTS.length < 4096) {
+      SURNAME_ROOTS.push(`RootEx_${SURNAME_ROOTS.length}`);
+    }
+    SURNAME_SUFFIXES = [
+      "son",
+      "man",
+      "field",
+      "wood",
+      "berg",
+      "stein",
+      "ov",
+      "ova",
+      "ski",
+      "ska",
+      "ez",
+      "ez",
+      "ia",
+      "ic",
+      "os",
+      "as",
+      "is",
+      "us",
+      "er",
+      "en",
+      "ard",
+      "ier",
+      "eau",
+      "oux",
+      "ly",
+      "ley",
+      "ton",
+      "don",
+      "ham",
+      "ford",
+      "wick",
+      "shire",
+      "land",
+      "way",
+      "side",
+      "gate",
+      "bridge",
+      "well",
+      "pool",
+      "cliff",
+      "bank",
+      "shore",
+      "hart",
+      "foot",
+      "head",
+      "more",
+      "less",
+      "ness",
+      "ship",
+      "ward"
+    ];
+    while (SURNAME_SUFFIXES.length < 512) {
+      SURNAME_SUFFIXES.push(`SuffixEx_${SURNAME_SUFFIXES.length}`);
+    }
+    SYLLABLES = [
+      "San",
+      "Ver",
+      "Dina",
+      "Lon",
+      "Don",
+      "Chi",
+      "Ca",
+      "Go",
+      "New",
+      "York",
+      "Los",
+      "An",
+      "Ge",
+      "Les",
+      "Pa",
+      "Ris",
+      "Ber",
+      "Lin",
+      "Mad",
+      "Rid"
+    ];
+    while (SYLLABLES.length < 1e3) {
+      SYLLABLES.push(`Syl_${SYLLABLES.length}`);
+    }
+  }
+});
+
 // src/core/fpe_utils.ts
 function looksLikeToken(value) {
   if (typeof value !== "string") return false;
@@ -261,13 +481,20 @@ function looksLikeToken(value) {
   if (v7.startsWith("[TKN-") && v7.endsWith("]")) {
     return true;
   }
+  if (v7.includes("-") && v7.length >= 6) {
+    const parts = v7.split("-");
+    const tag = parts[parts.length - 1];
+    if (tag.length === 4 && /^\d+$/.test(tag)) {
+      return true;
+    }
+  }
   return false;
 }
 var TOKEN_PATTERN;
 var init_fpe_utils = __esm({
   "src/core/fpe_utils.ts"() {
     TOKEN_PATTERN = new RegExp(
-      "tkn-[a-f0-9]{8,64}@[A-Za-z0-9.\\-]+\\.[A-Za-z]{2,}|\\+[1-9]\\d{0,3}-555-\\d{7}|000-00-\\d{4}|4000-0000-0000-\\d{4}|000000\\d{3}|000\\d{5}[A-Z]|[A-Z]{2}00[A-F0-9]{4,16}|<(?:PER|LOC|ORG):[^>]+>|\\[TKN-[a-f0-9]{8,64}\\]",
+      "tkn-[a-f0-9]{8,64}@[A-Za-z0-9.\\-]+\\.[A-Za-z]{2,}|\\+[1-9]\\d{0,3}-555-\\d{7}|000-00-\\d{4}|4000-0000-0000-\\d{4}|000000\\d{3}|000\\d{5}[A-Z]|[A-Z]{2}00[A-F0-9]{4,16}|<(?:PER|LOC|ORG):[^>]+>|\\b[A-Z][a-zA-Z, ]+-[0-9]{3,4}\\b|\\\\[TKN-[a-f0-9]{8,64}\\\\]",
       // Opaque
       "g"
     );
@@ -282,7 +509,7 @@ async function _getMasterKey() {
     }
     if (!raw) {
       if (config.MASK_DEV_MODE) {
-        raw = cryptoNode.randomBytes(32).toString("hex");
+        raw = crypto2.randomBytes(32).toString("hex");
         process.env.MASK_MASTER_KEY = raw;
       } else {
         throw new MaskSecurityError(
@@ -299,27 +526,64 @@ function resetMasterKey() {
 }
 async function _hmacHex(plaintext, n6 = 8) {
   const masterKey = await _getMasterKey();
-  const digest = cryptoNode.createHmac("sha256", masterKey).update(plaintext, "utf-8").digest("hex");
+  const digest = crypto2.createHmac("sha256", masterKey).update(plaintext, "utf-8").digest("hex");
   return digest.slice(0, n6);
 }
-async function _hmacDigits(plaintext, n6, offset = 0) {
+async function _hmacInt(plaintext) {
   const masterKey = await _getMasterKey();
-  const digest = cryptoNode.createHmac("sha256", masterKey).update(plaintext, "utf-8").digest("hex");
-  const result = [];
-  for (let i6 = offset; i6 < digest.length; i6++) {
-    const ch = digest[i6];
-    result.push((parseInt(ch, 16) % 10).toString());
-    if (result.length === n6) break;
+  const raw = crypto2.createHmac("sha256", masterKey).update(plaintext, "utf-8").digest();
+  let result = 0n;
+  for (let i6 = 0; i6 < 16; i6++) {
+    result = result << 8n | BigInt(raw[i6]);
   }
-  while (result.length < n6) {
-    result.push("0");
+  return result;
+}
+async function _hmacDigits(plaintext, n6, offset = 0) {
+  const salted = offset ? `${plaintext}::${offset}` : plaintext;
+  const seed = await _hmacInt(salted);
+  const modulus = 10n ** BigInt(n6);
+  return (seed % modulus).toString().padStart(n6, "0");
+}
+async function _getBijectiveTweak() {
+  const masterKey = await _getMasterKey();
+  let base = config.MASK_TENANT_ID;
+  if (config.MASK_SALT_ROTATION !== "NONE") {
+    const now = /* @__PURE__ */ new Date();
+    if (config.MASK_SALT_ROTATION === "MONTHLY") {
+      base += `-${now.getUTCFullYear()}-${now.getUTCMonth() + 1}`;
+    } else if (config.MASK_SALT_ROTATION === "YEARLY") {
+      base += `-${now.getUTCFullYear()}`;
+    }
   }
-  return result.join("");
+  return crypto2.createHmac("sha256", masterKey).update(base, "utf-8").digest();
 }
-async function _pickFromArray(plaintext, array) {
-  const digits = await _hmacDigits(plaintext, 8);
-  const num = parseInt(digits, 10);
-  return array[num % array.length];
+function _renderBijectivePerson(bits) {
+  const firstIdx = Number(bits & 0x7FFn);
+  const connIdx = Number(bits >> 11n & 0x3Fn);
+  const rootIdx = Number(bits >> 17n & 0xFFFn);
+  const suffixIdx = Number(bits >> 29n & 0x1FFn);
+  const tag = Number(bits >> 38n & 0x3FFFn);
+  const formatIdx = Number(bits >> 52n & 0xFn);
+  const first = FIRST_NAMES[firstIdx % FIRST_NAMES.length];
+  const conn = CONNECTORS[connIdx % CONNECTORS.length];
+  const root = SURNAME_ROOTS[rootIdx % SURNAME_ROOTS.length];
+  const suffix = SURNAME_SUFFIXES[suffixIdx % SURNAME_SUFFIXES.length];
+  const surname = `${root}${suffix}`;
+  const numeric = tag % 1e4;
+  const paddedNumeric = numeric.toString().padStart(4, "0");
+  if (formatIdx === 0) return `${first} ${conn} ${surname}-${paddedNumeric}`;
+  if (formatIdx === 1) return `${surname}, ${first}-${paddedNumeric}`;
+  if (formatIdx === 2) return `${first[0]}. ${surname}-${paddedNumeric}`;
+  if (formatIdx === 3) return `${first} ${surname}-${paddedNumeric}`;
+  return `${first} ${surname}-${paddedNumeric}`;
+}
+function _renderBijectiveLocation(bits) {
+  const s1 = Number(bits & 0x3FFn);
+  const s22 = Number(bits >> 10n & 0x3FFn);
+  const s32 = Number(bits >> 20n & 0x3FFn);
+  const tag = Number(bits >> 30n & 0xFFFn);
+  const city = `${SYLLABLES[s1 % 1e3]}${SYLLABLES[s22 % 1e3].toLowerCase()}${SYLLABLES[s32 % 1e3].toLowerCase()}`;
+  return `${city}-${tag.toString().padStart(3, "0")}`;
 }
 function _computeLuhnDigit(partialNum) {
   const digits = partialNum.split("").map(Number);
@@ -347,7 +611,7 @@ async function generateFPEToken(rawText, entityType = "UNKNOWN") {
     else if (_SSN_RE.test(text)) type = "US_SSN";
     else if (_CC_RE.test(text)) type = "CREDIT_CARD";
     else if (_ROUTING_RE.test(text)) type = "US_ROUTING_NUMBER";
-    else if (_ES_ID_RE.test(text)) type = "ES_DNI";
+    else if (_ES_ID_RE.test(text)) type = "ES_ID";
     else if (_IBAN_RE.test(text)) type = "INTL_BANK_IBAN";
     else if (_PHONE_RE.test(text)) type = "PHONE_NUMBER";
   }
@@ -377,43 +641,98 @@ async function generateFPEToken(rawText, entityType = "UNKNOWN") {
     const countryCode = text.length >= 2 && /[a-zA-Z]{2}/.test(text.slice(0, 2)) ? text.slice(0, 2).toUpperCase() : "US";
     return `${countryCode}00${(await _hmacHex(text, 8)).toUpperCase()}`;
   }
-  if (type === "ES_DNI") {
+  if (type === "ES_ID" || type === "ES_DNI") {
     const digits = `000${await _hmacDigits(text, 5)}`;
     return digits + _computeEsIdCheck(parseInt(digits, 10));
   }
   if (type === "PERSON" || type === "PERSON_NAME") {
-    const f6 = await _pickFromArray(text, _FIRST_NAMES);
-    const l6 = await _pickFromArray(text + "last", _LAST_NAMES);
-    return `<PER:${f6}_${l6}>`;
+    if (config.MASK_BIJECTIVE_MODE) {
+      const canonical = text.toLowerCase().trim();
+      const hash = crypto2.createHash("sha256").update(canonical, "utf-8").digest();
+      const inputInt = hash.readBigUInt64BE(0);
+      const masterKey = await _getMasterKey();
+      const engine = new FF1(masterKey.slice(0, 16), await _getBijectiveTweak());
+      const cipher = engine.encrypt(inputInt);
+      return _renderBijectivePerson(cipher);
+    }
+    return `[TKN-PERSON-${await _hmacHex(text)}]`;
   }
   if (type === "LOCATION" || type === "PHYS_ADDRESS") {
-    const c6 = await _pickFromArray(text, _CITIES);
-    return `<LOC:${c6}>`;
+    if (config.MASK_BIJECTIVE_MODE) {
+      const canonical = text.toLowerCase().trim();
+      const hash = crypto2.createHash("sha256").update(canonical, "utf-8").digest();
+      const inputInt = hash.readBigUInt64BE(0);
+      const masterKey = await _getMasterKey();
+      const engine = new FF1(masterKey.slice(0, 16), await _getBijectiveTweak());
+      const cipher = engine.encrypt(inputInt);
+      return _renderBijectiveLocation(cipher);
+    }
+    return `[TKN-LOC-${await _hmacHex(text)}]`;
   }
   if (type === "ORGANIZATION") {
-    const c6 = await _pickFromArray(text, _LAST_NAMES);
-    return `<ORG:${c6}_Inc>`;
+    return `[TKN-ORG-${await _hmacHex(text)}]`;
   }
   return `[TKN-${await _hmacHex(text)}]`;
 }
-var _masterKey, _EMAIL_RE, _PHONE_RE, _SSN_RE, _CC_RE, _ROUTING_RE, _ES_ID_RE, _IBAN_RE, _FIRST_NAMES, _LAST_NAMES, _CITIES;
+var _masterKey, _EMAIL_RE, _PHONE_RE, _SSN_RE, _CC_RE, _ROUTING_RE, _ES_ID_RE, _IBAN_RE, FF1;
 var init_fpe = __esm({
   "src/core/fpe.ts"() {
     init_config();
     init_key_provider();
     init_exceptions();
+    init_synthesisLibrary();
     init_fpe_utils();
     _masterKey = null;
     _EMAIL_RE = /^[^@\s]+@[^@\s]+\.[^@\s]+$/;
-    _PHONE_RE = /(?<!\d)(?:\+?1?[\s\-.]?\(?\d{3}\)?[\s\-.]?\d{3}[\s\-.]?\d{4}|\d{3}[\s\-.]?\d{4})(?!\d)/;
+    _PHONE_RE = /(?<!\d)(?:\+?1?[\s\-.]?\(?\d{3}\)?[\s\-.]?\d{3}[\s\-.]?\d{4}|\d{3}[\s\-.]?\d{4}|\+\d{2,3}[\s\-.]?\d{3}[\s\-.]?\d{3}[\s\-.]?\d{3,4})(?!\d)/;
     _SSN_RE = /^\d{3}-\d{2}-\d{4}$/;
     _CC_RE = /^(?:\d{4}[ \-]?){3}\d{4}$/;
     _ROUTING_RE = /^\d{9}$/;
     _ES_ID_RE = /^(?:\d{8}[A-Z]|[XYZ]\d{7}[A-Z])$/;
     _IBAN_RE = /^[A-Z]{2}\d{2}[A-Z0-9]{4,30}$/;
-    _FIRST_NAMES = ["Taylor", "Jordan", "Casey", "Morgan", "Riley", "Avery", "Rowan", "Quinn", "Charlie", "Peyton", "Blake", "Dakota", "Reese", "Skyler", "Finley", "Eden", "Harley", "Rory", "Emerson", "Remi"];
-    _LAST_NAMES = ["Smith", "Johnson", "Williams", "Brown", "Jones", "Garcia", "Miller", "Davis", "Rodriguez", "Martinez", "Hernandez", "Lopez", "Gonzalez", "Wilson", "Anderson", "Thomas", "Taylor", "Moore", "Jackson", "Martin"];
-    _CITIES = ["London", "Paris", "Berlin", "Tokyo", "Rome", "Madrid", "Vienna", "Sydney", "Toronto", "Chicago", "Seattle", "Austin", "Boston", "Denver", "Dallas", "Miami", "Seoul", "Dubai", "Mumbai", "Cairo"];
+    FF1 = class {
+      /** NIST SP 800-38G FF1 implementation (simplified for 64-bit domains). */
+      constructor(key, tweak) {
+        this.key = key;
+        this.tweak = tweak;
+      }
+      encrypt(n6) {
+        let A3 = n6 >> 32n;
+        let B3 = n6 & 0xFFFFFFFFn;
+        const radix = 2n ** 32n;
+        for (let i6 = 0; i6 < 10; i6++) {
+          const tweakInfoBuffer = Buffer.alloc(8);
+          tweakInfoBuffer.writeUInt32BE(i6, 0);
+          tweakInfoBuffer.writeUInt32BE(Number(B3), 4);
+          const tweakInfoCombined = Buffer.concat([this.tweak, tweakInfoBuffer]);
+          const h6 = crypto2.createHmac("sha256", this.key).update(tweakInfoCombined).digest();
+          const roundVal = BigInt(h6.readUInt32BE(0));
+          const Anext = B3;
+          const Bnext = (A3 + roundVal) % radix;
+          A3 = Anext;
+          B3 = Bnext;
+        }
+        return A3 << 32n | B3;
+      }
+      decrypt(n6) {
+        let A3 = n6 >> 32n;
+        let B3 = n6 & 0xFFFFFFFFn;
+        const radix = 2n ** 32n;
+        for (let i6 = 9; i6 >= 0; i6--) {
+          const tweakInfoBuffer = Buffer.alloc(8);
+          tweakInfoBuffer.writeUInt32BE(i6, 0);
+          tweakInfoBuffer.writeUInt32BE(Number(A3), 4);
+          const tweakInfoCombined = Buffer.concat([this.tweak, tweakInfoBuffer]);
+          const h6 = crypto2.createHmac("sha256", this.key).update(tweakInfoCombined).digest();
+          const roundVal = BigInt(h6.readUInt32BE(0));
+          const Bprev = A3;
+          const Aprev = (B3 - roundVal + radix) % radix;
+          A3 = Aprev;
+          B3 = Bprev;
+        }
+        return A3 << 32n | B3;
+      }
+    };
   }
 });
 
@@ -2881,7 +3200,7 @@ var init_crypto = __esm({
         let key;
         if (!keyFromProvider) {
           if (config.MASK_DEV_MODE) {
-            key = cryptoNode.randomBytes(32).toString("base64");
+            key = crypto2.randomBytes(32).toString("base64");
             process.env.MASK_ENCRYPTION_KEY = key;
             console.warn(
               "MASK_DEV_MODE is enabled. Using a generated throwaway key. DO NOT USE THIS IN PRODUCTION \u2014 tokens will be lost on restart."
@@ -2894,10 +3213,10 @@ var init_crypto = __esm({
         } else {
           key = keyFromProvider;
         }
-        this._aesKey = cryptoNode.createHash("sha256").update(key).digest();
+        this._aesKey = crypto2.createHash("sha256").update(key).digest();
         const masterKey = await provider.getMasterKey() || key;
         const salt = config.MASK_BLIND_INDEX_SALT;
-        this._indexSecret = cryptoNode.createHmac("sha256", masterKey).update(salt).digest();
+        this._indexSecret = crypto2.createHmac("sha256", masterKey).update(salt).digest();
       }
       /** Return the secret used for HMAC-based blind indexing. */
       async getIndexSecret() {
@@ -2910,8 +3229,8 @@ var init_crypto = __esm({
         if (!this._aesKey) {
           throw new Error("CryptoEngine not initialised. AES key missing.");
         }
-        const iv = cryptoNode.randomBytes(GCM_IV_BYTES);
-        const cipher = cryptoNode.createCipheriv(GCM_ALGORITHM, this._aesKey, iv);
+        const iv = crypto2.randomBytes(GCM_IV_BYTES);
+        const cipher = crypto2.createCipheriv(GCM_ALGORITHM, this._aesKey, iv);
         const encrypted = Buffer.concat([
           cipher.update(plaintext, "utf8"),
           cipher.final()
@@ -2943,7 +3262,7 @@ var init_crypto = __esm({
         const iv = combined.subarray(0, GCM_IV_BYTES);
         const authTag = combined.subarray(GCM_IV_BYTES, GCM_IV_BYTES + GCM_AUTH_TAG_BYTES);
         const encrypted = combined.subarray(GCM_IV_BYTES + GCM_AUTH_TAG_BYTES);
-        const decipher = cryptoNode.createDecipheriv(GCM_ALGORITHM, this._aesKey, iv);
+        const decipher = crypto2.createDecipheriv(GCM_ALGORITHM, this._aesKey, iv);
         decipher.setAuthTag(authTag);
         const decrypted = Buffer.concat([
           decipher.update(encrypted),
@@ -3127,7 +3446,8 @@ var init_audit_logger = __esm({
           this._buffer = [];
           this._bufferFullWarned = false;
           for (const evt of events) {
-            console.info(JSON.stringify(evt));
+            const json = JSON.stringify(evt, (_, v7) => typeof v7 === "bigint" ? v7.toString() : v7);
+            console.info(json);
           }
         } finally {
           this._isFlushing = false;
@@ -3191,7 +3511,7 @@ var init_search = __esm({
       static async getBucketIndex(bucketVal) {
         const engine = await getCryptoEngine();
         const secret = await engine.getIndexSecret();
-        return cryptoNode.createHmac("sha256", secret).update(bucketVal).digest("hex");
+        return crypto2.createHmac("sha256", secret).update(bucketVal).digest("hex");
       }
     };
   }
@@ -17735,7 +18055,7 @@ var init_date_utils = __esm({
 var randomUUID;
 var init_randomUUID = __esm({
   "node_modules/@smithy/uuid/dist-es/randomUUID.js"() {
-    randomUUID = cryptoNode__default.randomUUID.bind(cryptoNode__default);
+    randomUUID = crypto2__default.randomUUID.bind(crypto2__default);
   }
 });
 
@@ -42971,9 +43291,9 @@ function _getFailStrategy() {
 function _hashPlaintext(plaintext, secret) {
   const trimmed = plaintext.trim();
   if (secret) {
-    return cryptoNode.createHmac("sha256", secret).update(trimmed, "utf-8").digest("hex");
+    return crypto2.createHmac("sha256", secret).update(trimmed, "utf-8").digest("hex");
   }
-  return cryptoNode.createHash("sha256").update(trimmed, "utf-8").digest("hex");
+  return crypto2.createHash("sha256").update(trimmed, "utf-8").digest("hex");
 }
 function getVault() {
   if (_vaultInstance === null) {
@@ -43888,7 +44208,7 @@ var init_registry = __esm({
       }
       buildCatalogue(restrict) {
         for (const entry of RAW_PATTERNS) {
-          const [typeName, regexSource, terms, risk, cat, vtag, isHighEntropy, supportedLocales] = entry;
+          const [typeName, regexSource, terms, risk, cat, vtag, isHighEntropy, supportedLocales, ruleId, complianceScope] = entry;
           if (restrict !== null && !restrict.has(cat)) continue;
           let re;
           if (regexSource instanceof RegExp) {
@@ -43903,7 +44223,9 @@ var init_registry = __esm({
             category: cat,
             validatorTag: vtag,
             isHighEntropy: isHighEntropy ?? vtag !== null,
-            supportedLocales: supportedLocales ?? ["*"]
+            supportedLocales: supportedLocales ?? ["*"],
+            ruleId: ruleId ?? `MASK-${cat.slice(0, 3)}-${typeName}`,
+            complianceScope: new Set(complianceScope ?? [])
           });
         }
       }
@@ -59181,7 +59503,9 @@ var init_scanner = __esm({
                   originalValue: matchedStr,
                   confidence: conf,
                   method: "dlp_heuristic",
-                  language: detectedLanguage
+                  language: detectedLanguage,
+                  ruleId: descriptor.ruleId,
+                  complianceScope: descriptor.complianceScope
                 });
               }
             }
@@ -59621,7 +59945,7 @@ init_handlers();
 init_scorer();
 
 // src/index.ts
-var VERSION = "3.5.0";
+var VERSION = "3.5.1";
 async function detectEntitiesWithConfidence(text, options = {}) {
   const scanner = getScanner();
   return await scanner.scanAndReturnEntities(text, options);