mongo-data-anonymizer 0.2.1 → 0.3.0

package/dist/anonymization/rules.js

@@ -0,0 +1,193 @@
+/**
+ * Fields anonymized when --fieldList doesn't replace them. Patterns end in
+ * the personal word, so `orderEmail` matches `*email` but `emailTemplate`
+ * and `emailVerified` don't.
+ */
+export const DEFAULT_FIELDS = [
+    // Emails (any string value that is an email address is also caught by --scrubEmails).
+    '*email',
+    '*emails',
+    'recipient',
+    'recipients',
+    'sender',
+    // Names.
+    'name',
+    'firstname',
+    'lastname',
+    'middlename',
+    'fullname',
+    'surname',
+    'displayname',
+    'nickname',
+    'username',
+    // Phones.
+    '*phone',
+    '*phones',
+    '*phoneno',
+    '*phonenumber',
+    '*mobile',
+    'fax',
+    // Addresses and places.
+    '*address',
+    'street',
+    'city',
+    'country',
+    '*zip',
+    '*zipcode',
+    '*postcode',
+    '*postalcode',
+    // Dates of birth.
+    'birthdate',
+    'birthday',
+    'dateofbirth',
+    'dob',
+    // Free text that tends to contain personal details.
+    'description',
+    'comment',
+    'comments',
+    'note',
+    'notes',
+    // Identifiers and credentials.
+    'ip',
+    'ssn',
+    'iban',
+    'passport',
+    '*password',
+    'password*',
+    '*passwordhash',
+    '*token',
+    '*tokenhash',
+    '*secret',
+    '*secretkey',
+    '*apikey',
+    '*privatekey',
+    'salt',
+];
+/**
+ * How keys and rule fields are compared: case-insensitively and ignoring
+ * `_` and `-`, so `first_name`, `first-name` and `firstName` are the same key.
+ */
+export function normalizeKey(key) {
+    return key.toLowerCase().replace(/[_-]/g, '');
+}
+function toPattern(field) {
+    if (!field.includes('*'))
+        return null;
+    const source = field
+        .split('*')
+        .map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'))
+        .join('.*');
+    return new RegExp(`^${source}$`);
+}
+export function parseFieldRule(rule) {
+    const colon = rule.indexOf(':');
+    const spec = colon === -1 ? rule : rule.slice(0, colon);
+    const replacement = colon === -1 ? null : rule.slice(colon + 1);
+    const dot = spec.lastIndexOf('.');
+    const field = normalizeKey((dot === -1 ? spec : spec.slice(dot + 1)).trim());
+    if (!field) {
+        throw new Error(`Invalid field rule "${rule}": missing field name`);
+    }
+    return {
+        collection: dot === -1 ? null : spec.slice(0, dot),
+        field,
+        replacement,
+        pattern: toPattern(field),
+    };
+}
+/** The part of a rule that identifies it, i.e. without the replacement. */
+function ruleSpec(rule) {
+    const colon = rule.indexOf(':');
+    const spec = colon === -1 ? rule : rule.slice(0, colon);
+    const dot = spec.lastIndexOf('.');
+    return `${spec.slice(0, dot + 1)}${normalizeKey(spec.slice(dot + 1))}`;
+}
+/**
+ * Resolves the `--fieldList` option against the default fields.
+ *
+ * Every item may carry its own modifier:
+ *   - `field`  : explicit field; if any are given, they replace the defaults
+ *   - `+field` : added to the list
+ *   - `-field` : removed from the list
+ *
+ * So `+age,-*email` means "the defaults, plus age, minus *email". A removal
+ * must name an existing rule exactly; anything else is an error rather than
+ * a silent no-op.
+ */
+export function getFieldList(fieldListOption, defaultFields = DEFAULT_FIELDS) {
+    const items = (fieldListOption ?? '')
+        .split(',')
+        .map((item) => item.trim())
+        .filter(Boolean);
+    const explicit = items.filter((item) => !/^[+-]/.test(item));
+    const added = items
+        .filter((item) => item.startsWith('+'))
+        .map((item) => item.slice(1));
+    const removed = new Set(items
+        .filter((item) => item.startsWith('-'))
+        .map((item) => ruleSpec(item.slice(1))));
+    const base = explicit.length > 0 ? explicit : defaultFields;
+    const all = [...base, ...added];
+    const unknown = [...removed].filter((spec) => !all.some((item) => ruleSpec(item) === spec));
+    if (unknown.length > 0) {
+        throw new Error(`--fieldList removes rules that don't exist: ${unknown.map((spec) => `-${spec}`).join(', ')}. Removals must match a rule exactly, e.g. -*email for the default *email.`);
+    }
+    return [...new Set(all.filter((item) => !removed.has(ruleSpec(item))))];
+}
+class RuleTier {
+    exact = new Map();
+    patterns = [];
+    /** A later rule wins over an earlier one, so rules added to the defaults take precedence. */
+    add(rule) {
+        if (rule.pattern) {
+            this.patterns.unshift(rule);
+        }
+        else {
+            this.exact.set(rule.field, rule);
+        }
+    }
+    match(lower) {
+        return (this.exact.get(lower) ??
+            this.patterns.find(({ pattern }) => pattern?.test(lower)));
+    }
+}
+/**
+ * The rules that apply to one collection. Lookup order: the collection's own
+ * rules before global ones, and within each, an exact field name before a
+ * pattern. So `users.*name:REDACTED` overrides a global `name`.
+ */
+export class CollectionRules {
+    #scoped = new RuleTier();
+    #global = new RuleTier();
+    constructor(rules) {
+        for (const rule of rules) {
+            (rule.collection === null ? this.#global : this.#scoped).add(rule);
+        }
+    }
+    /** The rule for a document key, if any. */
+    match(key) {
+        const normalized = normalizeKey(key);
+        return this.#scoped.match(normalized) ?? this.#global.match(normalized);
+    }
+    /** Field names and patterns, for reports. */
+    get fields() {
+        return [
+            ...new Set([this.#scoped, this.#global].flatMap((tier) => [...tier.exact.values(), ...tier.patterns]
+                // Only rules that are in effect: not kept, and not shadowed by a
+                // collection rule (e.g. a global `name` under `images.name:keep`).
+                .filter((rule) => rule.replacement !== 'keep' && this.match(rule.field) === rule)
+                .map(({ field }) => field))),
+        ];
+    }
+}
+/**
+ * Rules that apply to a collection: its own rules, then the global ones, so
+ * a collection-scoped rule takes precedence over a global rule.
+ */
+export function rulesForCollection(rules, collectionName) {
+    return new CollectionRules([
+        ...rules.filter(({ collection }) => collection === collectionName),
+        ...rules.filter(({ collection }) => collection === null),
+    ]);
+}
+//# sourceMappingURL=rules.js.map

package/dist/anonymization/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/anonymization/rules.ts"],"names":[],"mappings":"AAkBA;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,sFAAsF;IACtF,QAAQ;IACR,SAAS;IACT,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,SAAS;IACT,MAAM;IACN,WAAW;IACX,UAAU;IACV,YAAY;IACZ,UAAU;IACV,SAAS;IACT,aAAa;IACb,UAAU;IACV,UAAU;IACV,UAAU;IACV,QAAQ;IACR,SAAS;IACT,UAAU;IACV,cAAc;IACd,SAAS;IACT,KAAK;IACL,wBAAwB;IACxB,UAAU;IACV,QAAQ;IACR,MAAM;IACN,SAAS;IACT,MAAM;IACN,UAAU;IACV,WAAW;IACX,aAAa;IACb,kBAAkB;IAClB,WAAW;IACX,UAAU;IACV,aAAa;IACb,KAAK;IACL,oDAAoD;IACpD,aAAa;IACb,SAAS;IACT,UAAU;IACV,MAAM;IACN,OAAO;IACP,+BAA+B;IAC/B,IAAI;IACJ,KAAK;IACL,MAAM;IACN,UAAU;IACV,WAAW;IACX,WAAW;IACX,eAAe;IACf,QAAQ;IACR,YAAY;IACZ,SAAS;IACT,YAAY;IACZ,SAAS;IACT,aAAa;IACb,MAAM;CACP,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,MAAM,GAAG,KAAK;SACjB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;SAC1D,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,IAAI,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAElC,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,uBAAuB,CAAC,CAAC;IACtE,CAAC;IAED,OAAO;QACL,UAAU,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QAClD,KAAK;QACL,WAAW;QACX,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAC1B,eAAmC,EACnC,gBAA0B,cAAc;IAExC,MAAM,KAAK,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;SAClC,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnB,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,KAAK;SAChB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,KAAK;SACF,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAC1C,CAAC;IAEF,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC;IAC5D,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CACjC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CACvD,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,+CAA+C,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,4EAA4E,CACxK,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,QAAQ;IACH,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IACrC,QAAQ,GAAgB,EAAE,CAAC;IAEpC,6FAA6F;IAC7F,GAAG,CAAC,IAAe;QACjB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAa;QACjB,OAAO,CACL,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAC1D,CAAC;IACJ,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,eAAe;IACjB,OAAO,GAAG,IAAI,QAAQ,EAAE,CAAC;IACzB,OAAO,GAAG,IAAI,QAAQ,EAAE,CAAC;IAElC,YAAY,KAAkB;QAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,KAAK,CAAC,GAAW;QACf,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1E,CAAC;IAED,6CAA6C;IAC7C,IAAI,MAAM;QACR,OAAO;YACL,GAAG,IAAI,GAAG,CACR,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAC5C,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;gBACxC,iEAAiE;gBACjE,mEAAmE;iBAClE,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,WAAW,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CACjE;iBACA,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAC7B,CACF;SACF,CAAC;IACJ,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAkB,EAClB,cAAsB;IAEtB,OAAO,IAAI,eAAe,CAAC;QACzB,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,KAAK,cAAc,CAAC;QAClE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACzD,CAAC,CAAC;AACL,CAAC"}

package/dist/cli.js

@@ -1,6 +1,13 @@
 #!/usr/bin/env node
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const main_1 = require("./main");
-(0, main_1.main)().catch((error) => { console.log(error.message); });
+import { hideBin } from 'yargs/helpers';
+import { parseArgs } from "./config.js";
+import { consoleLogger } from "./logger.js";
+import { run } from "./run.js";
+try {
+    await run(parseArgs(hideBin(process.argv)), consoleLogger);
+}
+catch (error) {
+    consoleLogger.error(error.message);
+    process.exitCode = 1;
+}
 //# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;;AACA,iCAA8B;AAE9B,IAAA,WAAI,GAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,GAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA,CAAA,CAAC,CAAC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,IAAI,CAAC;IACH,MAAM,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;AAC7D,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,aAAa,CAAC,KAAK,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,7 @@
+import type { RunConfig } from './run.ts';
+/**
+ * Parses command-line arguments. Every option can also be set through an
+ * environment variable prefixed with ANONYMIZER_ (e.g. ANONYMIZER_SOURCE_URI,
+ * ANONYMIZER_SECRET), which keeps credentials out of the shell history.
+ */
+export declare function parseArgs(args: string[], env?: NodeJS.ProcessEnv): RunConfig;

package/dist/config.js

@@ -0,0 +1,182 @@
+import { readFileSync } from 'node:fs';
+import yargs from 'yargs';
+import { DEFAULT_FIELDS, getFieldList } from "./anonymization/rules.js";
+const { version } = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+function parseCommitQuorum(value) {
+    if (/^\d+$/.test(value))
+        return Number(value);
+    if (value === 'majority' || value === 'votingMembers')
+        return value;
+    throw new Error(`--indexCommitQuorum must be a number of members, "majority" or "votingMembers", got "${value}"`);
+}
+function list(value) {
+    return (value ?? '')
+        .split(',')
+        .map((item) => item.trim())
+        .filter(Boolean);
+}
+const OPTIONS = [
+    'sourceUri',
+    'targetUri',
+    'fieldList',
+    'collectionList',
+    'ignoreCollections',
+    'copyNonAnonymized',
+    'dropTarget',
+    'dryRun',
+    'strict',
+    'assumeDifferentTarget',
+    'scrubEmails',
+    'sampleSize',
+    'indexCommitQuorum',
+    'indexTimeout',
+    'batchSize',
+    'secret',
+];
+/** `sourceUri` → `ANONYMIZER_SOURCE_URI`. */
+function envName(option) {
+    return `ANONYMIZER_${option.replace(/([A-Z])/g, '_$1').toUpperCase()}`;
+}
+const BOOLEAN_OPTIONS = new Set([
+    'copyNonAnonymized',
+    'dropTarget',
+    'dryRun',
+    'strict',
+    'assumeDifferentTarget',
+    'scrubEmails',
+]);
+function envBoolean(name, value) {
+    const normalized = value.trim().toLowerCase();
+    if (['1', 'true', 'yes', 'on'].includes(normalized))
+        return true;
+    if (['', '0', 'false', 'no', 'off'].includes(normalized))
+        return false;
+    throw new Error(`${name} must be true or false, got "${value}"`);
+}
+/**
+ * Options set through the environment, as arguments placed before the real
+ * ones (so the command line wins). Only known variables are read: an
+ * unrelated ANONYMIZER_* variable must not make the strict parser fail.
+ */
+function envArgs(env) {
+    return OPTIONS.flatMap((option) => {
+        const name = envName(option);
+        const value = env[name];
+        if (value === undefined)
+            return [];
+        if (BOOLEAN_OPTIONS.has(option)) {
+            return [envBoolean(name, value) ? `--${option}` : `--no-${option}`];
+        }
+        return [`--${option}=${value}`];
+    });
+}
+/**
+ * Parses command-line arguments. Every option can also be set through an
+ * environment variable prefixed with ANONYMIZER_ (e.g. ANONYMIZER_SOURCE_URI,
+ * ANONYMIZER_SECRET), which keeps credentials out of the shell history.
+ */
+export function parseArgs(args, env = process.env) {
+    const argv = yargs([...envArgs(env), ...args])
+        .scriptName('mongo-data-anonymizer')
+        .usage('$0 --sourceUri <uri> --targetUri <uri> [options]')
+        .parserConfiguration({ 'duplicate-arguments-array': false })
+        .option('sourceUri', {
+        type: 'string',
+        demandOption: true,
+        describe: 'Source MongoDB URI',
+    })
+        .option('targetUri', {
+        type: 'string',
+        demandOption: true,
+        describe: 'Target MongoDB URI',
+    })
+        .option('fieldList', {
+        type: 'string',
+        describe: `Fields to anonymize: [collection.]field[:replacement]. Prefix items with + or - to adjust the defaults (${DEFAULT_FIELDS.join(', ')})`,
+    })
+        .option('collectionList', {
+        type: 'string',
+        describe: 'Only anonymize these collections',
+    })
+        .option('ignoreCollections', {
+        type: 'string',
+        describe: 'Never anonymize these collections',
+    })
+        .option('copyNonAnonymized', {
+        type: 'boolean',
+        default: false,
+        describe: 'Copy collections that are not anonymized as-is instead of skipping them',
+    })
+        .option('dropTarget', {
+        type: 'boolean',
+        default: false,
+        describe: 'Drop target collections that already exist',
+    })
+        .option('dryRun', {
+        type: 'boolean',
+        default: false,
+        describe: 'Show what would be done without writing anything',
+    })
+        .option('strict', {
+        type: 'boolean',
+        default: false,
+        describe: 'Fail instead of warning when a matched value cannot be anonymized (ObjectId, Binary, Decimal128, ...)',
+    })
+        .option('assumeDifferentTarget', {
+        type: 'boolean',
+        default: false,
+        describe: 'Allow a target that shares collection UUIDs or hosts with the source (e.g. a restored copy of it); writes are still checked not to reach the source',
+    })
+        .option('scrubEmails', {
+        type: 'boolean',
+        default: true,
+        describe: 'Replace email addresses found in any string, including free text (--no-scrubEmails to turn off)',
+    })
+        .option('sampleSize', {
+        type: 'number',
+        default: 1000,
+        describe: 'Documents per collection a dry run checks for unmatched personal data (0 = all)',
+    })
+        .option('indexCommitQuorum', {
+        type: 'string',
+        default: '1',
+        describe: 'Commit quorum for index builds on a replica set target: a number of members, "majority" or "votingMembers"',
+    })
+        .option('indexTimeout', {
+        type: 'number',
+        default: 900,
+        describe: "Seconds to wait for a collection's indexes to build before skipping them with a warning (0 = no limit)",
+    })
+        .option('batchSize', {
+        type: 'number',
+        default: 1000,
+        describe: 'Documents per batch',
+    })
+        .option('secret', {
+        type: 'string',
+        describe: 'Secret for deterministic fake values (prefer ANONYMIZER_SECRET)',
+    })
+        .strict()
+        .help()
+        .version(version)
+        .parseSync();
+    return {
+        sourceUri: argv.sourceUri,
+        targetUri: argv.targetUri,
+        fieldList: getFieldList(argv.fieldList),
+        collectionList: list(argv.collectionList),
+        ignoreCollections: list(argv.ignoreCollections),
+        batchSize: argv.batchSize,
+        copyNonAnonymized: argv.copyNonAnonymized,
+        dropTarget: argv.dropTarget,
+        dryRun: argv.dryRun,
+        strict: argv.strict,
+        assumeDifferentTarget: argv.assumeDifferentTarget,
+        scrubEmails: argv.scrubEmails,
+        sampleSize: argv.sampleSize,
+        indexCommitQuorum: parseCommitQuorum(argv.indexCommitQuorum),
+        indexTimeoutSeconds: argv.indexTimeout,
+        ...(argv.secret ? { secret: argv.secret } : {}),
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAGxE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAC5B,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAC3C,CAAC;AAEzB,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,eAAe;QAAE,OAAO,KAAK,CAAC;IACpE,MAAM,IAAI,KAAK,CACb,wFAAwF,KAAK,GAAG,CACjG,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,KAAyB;IACrC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;SACjB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,OAAO,GAAG;IACd,WAAW;IACX,WAAW;IACX,WAAW;IACX,gBAAgB;IAChB,mBAAmB;IACnB,mBAAmB;IACnB,YAAY;IACZ,QAAQ;IACR,QAAQ;IACR,uBAAuB;IACvB,aAAa;IACb,YAAY;IACZ,mBAAmB;IACnB,cAAc;IACd,WAAW;IACX,QAAQ;CACT,CAAC;AAEF,6CAA6C;AAC7C,SAAS,OAAO,CAAC,MAAc;IAC7B,OAAO,cAAc,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,mBAAmB;IACnB,YAAY;IACZ,QAAQ;IACR,QAAQ;IACR,uBAAuB;IACvB,aAAa;CACd,CAAC,CAAC;AAEH,SAAS,UAAU,CAAC,IAAY,EAAE,KAAa;IAC7C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IACvE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,gCAAgC,KAAK,GAAG,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,SAAS,OAAO,CAAC,GAAsB;IACrC,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACnC,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,CAAC,KAAK,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,IAAc,EACd,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;SAC3C,UAAU,CAAC,uBAAuB,CAAC;SACnC,KAAK,CAAC,kDAAkD,CAAC;SACzD,mBAAmB,CAAC,EAAE,2BAA2B,EAAE,KAAK,EAAE,CAAC;SAC3D,MAAM,CAAC,WAAW,EAAE;QACnB,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,IAAI;QAClB,QAAQ,EAAE,oBAAoB;KAC/B,CAAC;SACD,MAAM,CAAC,WAAW,EAAE;QACnB,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,IAAI;QAClB,QAAQ,EAAE,oBAAoB;KAC/B,CAAC;SACD,MAAM,CAAC,WAAW,EAAE;QACnB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,2GAA2G,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;KAClJ,CAAC;SACD,MAAM,CAAC,gBAAgB,EAAE;QACxB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,kCAAkC;KAC7C,CAAC;SACD,MAAM,CAAC,mBAAmB,EAAE;QAC3B,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,mCAAmC;KAC9C,CAAC;SACD,MAAM,CAAC,mBAAmB,EAAE;QAC3B,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,KAAK;QACd,QAAQ,EACN,yEAAyE;KAC5E,CAAC;SACD,MAAM,CAAC,YAAY,EAAE;QACpB,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,4CAA4C;KACvD,CAAC;SACD,MAAM,CAAC,QAAQ,EAAE;QAChB,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,kDAAkD;KAC7D,CAAC;SACD,MAAM,CAAC,QAAQ,EAAE;QAChB,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,KAAK;QACd,QAAQ,EACN,uGAAuG;KAC1G,CAAC;SACD,MAAM,CAAC,uBAAuB,EAAE;QAC/B,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,KAAK;QACd,QAAQ,EACN,qJAAqJ;KACxJ,CAAC;SACD,MAAM,CAAC,aAAa,EAAE;QACrB,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,IAAI;QACb,QAAQ,EACN,iGAAiG;KACpG,CAAC;SACD,MAAM,CAAC,YAAY,EAAE;QACpB,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,IAAI;QACb,QAAQ,EACN,iFAAiF;KACpF,CAAC;SACD,MAAM,CAAC,mBAAmB,EAAE;QAC3B,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,GAAG;QACZ,QAAQ,EACN,4GAA4G;KAC/G,CAAC;SACD,MAAM,CAAC,cAAc,EAAE;QACtB,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,GAAG;QACZ,QAAQ,EACN,wGAAwG;KAC3G,CAAC;SACD,MAAM,CAAC,WAAW,EAAE;QACnB,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,qBAAqB;KAChC,CAAC;SACD,MAAM,CAAC,QAAQ,EAAE;QAChB,IAAI,EAAE,QAAQ;QACd,QAAQ,EACN,iEAAiE;KACpE,CAAC;SACD,MAAM,EAAE;SACR,IAAI,EAAE;SACN,OAAO,CAAC,OAAO,CAAC;SAChB,SAAS,EAAE,CAAC;IAEf,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC;QACvC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;QACzC,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAC/C,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,iBAAiB,EAAE,iBAAiB,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAC5D,mBAAmB,EAAE,IAAI,CAAC,YAAY;QACtC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { run, type RunConfig, type RunReport, type CollectionReport, } from './run.ts';
+export { Anonymizer, type AnonymizerOptions, } from './anonymization/anonymize.ts';
+export { CollectionRules, DEFAULT_FIELDS, getFieldList, parseFieldRule, rulesForCollection, type FieldRule, } from './anonymization/rules.ts';
+export { decideCollectionAction, type CollectionAction, } from './anonymization/collections.ts';
+export { consoleLogger, silentLogger, type Logger } from './logger.ts';

package/dist/index.js

@@ -0,0 +1,6 @@
+export { run, } from "./run.js";
+export { Anonymizer, } from "./anonymization/anonymize.js";
+export { CollectionRules, DEFAULT_FIELDS, getFieldList, parseFieldRule, rulesForCollection, } from "./anonymization/rules.js";
+export { decideCollectionAction, } from "./anonymization/collections.js";
+export { consoleLogger, silentLogger } from "./logger.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,GAAG,GAIJ,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,UAAU,GAEX,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,eAAe,EACf,cAAc,EACd,YAAY,EACZ,cAAc,EACd,kBAAkB,GAEnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,sBAAsB,GAEvB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAe,MAAM,aAAa,CAAC"}

package/dist/logger.d.ts

@@ -0,0 +1,7 @@
+export interface Logger {
+    info(message: string): void;
+    warn(message: string): void;
+    error(message: string): void;
+}
+export declare const consoleLogger: Logger;
+export declare const silentLogger: Logger;

package/dist/logger.js

@@ -0,0 +1,14 @@
+function write(level, message) {
+    process.stderr.write(`${new Date().toISOString()} ${level} ${message}\n`);
+}
+export const consoleLogger = {
+    info: (message) => write('INFO ', message),
+    warn: (message) => write('WARN ', message),
+    error: (message) => write('ERROR', message),
+};
+export const silentLogger = {
+    info: () => { },
+    warn: () => { },
+    error: () => { },
+};
+//# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAMA,SAAS,KAAK,CAAC,KAAa,EAAE,OAAe;IAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,KAAK,IAAI,OAAO,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAW;IACnC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1C,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1C,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC;CAC5C,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAW;IAClC,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;IACd,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;IACd,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;CAChB,CAAC"}

package/dist/progress.d.ts

@@ -0,0 +1,25 @@
+export interface ProgressOptions {
+    /** How often a long copy logs its progress. */
+    reportEveryMs: number;
+    /** Warn when nothing has completed for this long. */
+    stallAfterMs: number;
+}
+export declare const DEFAULT_PROGRESS: ProgressOptions;
+/**
+ * Tracks the operation in progress and warns when nothing completes for a
+ * while, so a stuck server call (e.g. an index build waiting for a replica
+ * set's commit quorum) shows up in the log instead of as silence.
+ */
+export declare class Progress {
+    #private;
+    constructor(options: ProgressOptions, warn: (message: string) => void);
+    start(): void;
+    stop(): void;
+    /** A new server call or step starts. */
+    operation(description: string): void;
+    /** Something completed (a batch was read or written). */
+    activity(): void;
+}
+/** `12,000/35,000 (34%), 9,800 docs/s, ETA 2s` */
+export declare function describeProgress(done: number, total: number, elapsedMs: number): string;
+export declare function formatDuration(ms: number): string;

package/dist/progress.js

@@ -0,0 +1,74 @@
+export const DEFAULT_PROGRESS = {
+    reportEveryMs: 5_000,
+    stallAfterMs: 30_000,
+};
+/**
+ * Tracks the operation in progress and warns when nothing completes for a
+ * while, so a stuck server call (e.g. an index build waiting for a replica
+ * set's commit quorum) shows up in the log instead of as silence.
+ */
+export class Progress {
+    #options;
+    #warn;
+    #timer;
+    #operation = 'starting';
+    #operationStarted = Date.now();
+    #lastActivity = Date.now();
+    #stallReported = false;
+    constructor(options, warn) {
+        this.#options = options;
+        this.#warn = warn;
+    }
+    start() {
+        const every = Math.max(100, Math.min(1_000, this.#options.stallAfterMs / 2));
+        this.#timer = setInterval(() => this.#check(), every);
+        this.#timer.unref();
+    }
+    stop() {
+        clearInterval(this.#timer);
+    }
+    /** A new server call or step starts. */
+    operation(description) {
+        this.#operation = description;
+        this.#operationStarted = Date.now();
+        this.activity();
+    }
+    /** Something completed (a batch was read or written). */
+    activity() {
+        this.#lastActivity = Date.now();
+        this.#stallReported = false;
+    }
+    #check() {
+        const now = Date.now();
+        const idle = now - this.#lastActivity;
+        if (this.#stallReported || idle < this.#options.stallAfterMs)
+            return;
+        this.#stallReported = true;
+        const running = Math.round((now - this.#operationStarted) / 1000);
+        const hint = this.#operation.startsWith('createIndexes')
+            ? ' On a replica set, index builds wait for the commit quorum; check db.currentOp() on the target and see --indexCommitQuorum.'
+            : '';
+        this.#warn(`No progress for ${Math.round(idle / 1000)}s: ${this.#operation} (running ${running}s).${hint}`);
+    }
+}
+/** `12,000/35,000 (34%), 9,800 docs/s, ETA 2s` */
+export function describeProgress(done, total, elapsedMs) {
+    const rate = elapsedMs > 0 ? (done * 1000) / elapsedMs : 0;
+    const format = (n) => Math.round(n).toLocaleString('en-US');
+    if (total <= 0 || done > total) {
+        return `${format(done)} documents, ${format(rate)} docs/s`;
+    }
+    const percent = Math.floor((done * 100) / total);
+    const eta = rate > 0 ? formatDuration(((total - done) * 1000) / rate) : '?';
+    return `${format(done)}/${format(total)} (${percent}%), ${format(rate)} docs/s, ETA ${eta}`;
+}
+export function formatDuration(ms) {
+    const seconds = Math.round(ms / 1000);
+    if (seconds < 60)
+        return `${seconds}s`;
+    const minutes = Math.floor(seconds / 60);
+    if (minutes < 60)
+        return `${minutes}m${String(seconds % 60).padStart(2, '0')}s`;
+    return `${Math.floor(minutes / 60)}h${String(minutes % 60).padStart(2, '0')}m`;
+}
+//# sourceMappingURL=progress.js.map

package/dist/progress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"progress.js","sourceRoot":"","sources":["../src/progress.ts"],"names":[],"mappings":"AAOA,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,aAAa,EAAE,KAAK;IACpB,YAAY,EAAE,MAAM;CACrB,CAAC;AAEF;;;;GAIG;AACH,MAAM,OAAO,QAAQ;IACV,QAAQ,CAAkB;IAC1B,KAAK,CAA4B;IAC1C,MAAM,CAA6B;IACnC,UAAU,GAAG,UAAU,CAAC;IACxB,iBAAiB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,cAAc,GAAG,KAAK,CAAC;IAEvB,YAAY,OAAwB,EAAE,IAA+B;QACnE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,KAAK;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,GAAG,EACH,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,GAAG,CAAC,CAAC,CAChD,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,IAAI;QACF,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,wCAAwC;IACxC,SAAS,CAAC,WAAmB;QAC3B,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC;QAC9B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;IAClB,CAAC;IAED,yDAAyD;IACzD,QAAQ;QACN,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;IAC9B,CAAC;IAED,MAAM;QACJ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC;QACtC,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY;YAAE,OAAO;QAErE,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,eAAe,CAAC;YACtD,CAAC,CAAC,6HAA6H;YAC/H,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,CAAC,KAAK,CACR,mBAAmB,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,aAAa,OAAO,MAAM,IAAI,EAAE,CAChG,CAAC;IACJ,CAAC;CACF;AAED,kDAAkD;AAClD,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,KAAa,EACb,SAAiB;IAEjB,MAAM,IAAI,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IACpE,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QAC/B,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;IAC7D,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5E,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,OAAO,OAAO,MAAM,CAAC,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IACtC,IAAI,OAAO,GAAG,EAAE;QAAE,OAAO,GAAG,OAAO,GAAG,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,EAAE;QACd,OAAO,GAAG,OAAO,IAAI,MAAM,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;IAChE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;AACjF,CAAC"}

package/dist/run.d.ts

@@ -0,0 +1,62 @@
+import { type CollectionAction } from './anonymization/collections.ts';
+import { type Logger } from './logger.ts';
+import { type ProgressOptions } from './progress.ts';
+export interface RunConfig {
+    sourceUri: string;
+    targetUri: string;
+    /** Field rules, `[collection.]field[:replacement]`. */
+    fieldList: string[];
+    collectionList: string[];
+    ignoreCollections: string[];
+    batchSize: number;
+    copyNonAnonymized: boolean;
+    /** Drop target collections that already exist instead of refusing to run. */
+    dropTarget: boolean;
+    /** Report what would happen without writing anything. */
+    dryRun: boolean;
+    /** Secret for deterministic anonymization; random per run when omitted. */
+    secret?: string;
+    /** Fail instead of warning when a matched value can't be anonymized. */
+    strict?: boolean;
+    /**
+     * Skip the read-only "looks like the same database" check (shared
+     * collection UUIDs or hosts), e.g. when the target is a restored copy of the
+     * source. The write probe that proves the target is not the source still runs.
+     */
+    assumeDifferentTarget?: boolean;
+    /** Replace email addresses found in any string (default true). */
+    scrubEmails?: boolean;
+    /**
+     * Documents per collection a dry run checks for personal-looking keys that
+     * no rule matches (default 1000; 0 checks every document).
+     */
+    sampleSize?: number;
+    /**
+     * Commit quorum for index builds when the target is a replica set
+     * (default 1: the primary's vote is enough, so an unavailable or stuck
+     * secondary can't hold the build up). Ignored on a standalone.
+     */
+    indexCommitQuorum?: number | string;
+    /** Give up on a collection's index build after this many seconds (default 900; 0 = no limit). */
+    indexTimeoutSeconds?: number;
+    /** Progress log and stall warning timings; mainly for tests. */
+    progress?: Partial<ProgressOptions>;
+}
+export interface CollectionReport {
+    name: string;
+    type: string;
+    action: CollectionAction;
+    documents: number;
+    anonymizedFields: string[];
+    /**
+     * Dry run only: keys in a sample of the collection that look like
+     * personal data but that no rule covers (and that will therefore be
+     * written unchanged).
+     */
+    unmatchedPersonalKeys?: string[];
+}
+export interface RunReport {
+    collections: CollectionReport[];
+    warnings: string[];
+}
+export declare function run(config: RunConfig, logger?: Logger): Promise<RunReport>;