plaud-notes-to-notion 1.0.0

package/dist/scrub.js

@@ -0,0 +1,124 @@
+import { NOTION_TEXT_CHUNK, NOTION_VERSION } from "./constants.js";
+import { redactSecrets } from "./redact.js";
+import { findCardDigits, redactCards } from "./card.js";
+import { findSsnDigits, redactDigits } from "./ssn.js";
+/** Consecutive plain-text runs with identical formatting and link; other runs stand alone. */
+function sameFormatGroups(rich) {
+    const key = (r) => (r.type === "text" ? JSON.stringify([r.annotations, r.text?.link ?? null]) : undefined);
+    const groups = [];
+    for (const r of rich) {
+        const last = groups[groups.length - 1];
+        if (last && key(r) !== undefined && key(r) === key(last[0])) {
+            last.push(r);
+        }
+        else {
+            groups.push([r]);
+        }
+    }
+    return groups;
+}
+export async function scrubSensitive(options) {
+    const f = options.fetchImpl || fetch;
+    const api = async (method, path, body) => {
+        const res = await f(`https://api.notion.com/v1${path}`, {
+            method,
+            headers: { Authorization: `Bearer ${options.token}`, "Notion-Version": NOTION_VERSION, "Content-Type": "application/json" },
+            body: body === undefined ? undefined : JSON.stringify(body)
+        });
+        const json = (await res.json().catch(() => ({})));
+        if (!res.ok) {
+            throw new Error(redactSecrets(`Notion HTTP ${res.status}: ${String(json.message || "")}`));
+        }
+        return json;
+    };
+    const pages = [];
+    let cursor;
+    do {
+        const j = await api("POST", `/data_sources/${options.dataSourceId}/query`, { page_size: 100, start_cursor: cursor });
+        pages.push(...(j.results || []));
+        cursor = j.has_more ? String(j.next_cursor) : undefined;
+    } while (cursor);
+    const blocksOf = async (id) => {
+        const out = [];
+        let c;
+        do {
+            const j = await api("GET", `/blocks/${id}/children?page_size=100${c ? `&start_cursor=${c}` : ""}`);
+            for (const b of (j.results || [])) {
+                const type = String(b.type);
+                const rich = (b[type]?.rich_text || []);
+                if (rich.length) {
+                    out.push({ id: String(b.id), type, rich });
+                }
+                if (b.has_children) {
+                    out.push(...(await blocksOf(String(b.id))));
+                }
+            }
+            c = j.has_more ? String(j.next_cursor) : undefined;
+        } while (c);
+        return out;
+    };
+    const groups = new Map();
+    for (const p of pages) {
+        const rec = p.properties?.Recorded?.date;
+        const key = rec?.start ? rec.start.slice(0, 16) : String(p.id);
+        groups.set(key, [...(groups.get(key) || []), p]);
+    }
+    const result = { rowsScanned: pages.length, rowsAffected: [], blocksUpdated: 0 };
+    for (const rows of groups.values()) {
+        const loaded = await Promise.all(rows.map(async (p) => ({ page: p, blocks: await blocksOf(String(p.id)) })));
+        const texts = loaded.map((l) => l.blocks.map((b) => b.rich.map((r) => r.plain_text).join("")).join("\n"));
+        const cardFound = findCardDigits(texts);
+        // SSN values are looked for after card details are gone, exactly like ingest.
+        const ssnFound = findSsnDigits(texts.map((t) => redactCards(t, cardFound).text));
+        for (const { page, blocks } of loaded) {
+            let ssn = 0;
+            let card = 0;
+            for (const block of blocks) {
+                let changed = false;
+                // Adjacent runs with the same formatting are redacted as one string, so a
+                // trigger and its number split across runs are still caught. The Zap wrote
+                // whole transcripts as one run of up to ~11k chars; the API only accepts
+                // ≤2000 per run on write, so rewritten runs are re-split (same formatting).
+                const rich = [];
+                for (const group of sameFormatGroups(block.rich)) {
+                    if (group[0].type !== "text") {
+                        rich.push(...group);
+                        continue;
+                    }
+                    const plain = group.map((r) => r.plain_text).join("");
+                    const c = redactCards(plain, cardFound);
+                    const n = redactDigits(c.text, ssnFound);
+                    if (!c.count && !n.count) {
+                        rich.push(...group);
+                        continue;
+                    }
+                    card += c.count;
+                    ssn += n.count;
+                    changed = true;
+                    for (let i = 0; i < n.text.length; i += NOTION_TEXT_CHUNK) {
+                        rich.push({
+                            type: "text",
+                            text: { content: n.text.slice(i, i + NOTION_TEXT_CHUNK), link: group[0].text?.link ?? null },
+                            annotations: group[0].annotations
+                        });
+                    }
+                }
+                if (changed) {
+                    result.blocksUpdated++;
+                    if (options.apply) {
+                        await api("PATCH", `/blocks/${block.id}`, { [block.type]: { rich_text: rich } });
+                    }
+                }
+            }
+            if (ssn || card) {
+                const props = page.properties;
+                const title = (props.Meeting?.title || []).map((t) => t.plain_text).join("");
+                const type = (props.Type?.multi_select || []).map((t) => t.name).join(",");
+                result.rowsAffected.push({ title, type, ssn, card });
+                options.log(`${options.apply ? "scrubbed" : "DRY RUN would scrub"} ${ssn} SSN + ${card} card mention(s) in ${type} "${title}"`);
+            }
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=scrub.js.map

package/dist/scrub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrub.js","sourceRoot":"","sources":["../src/scrub.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAuBvD,8FAA8F;AAC9F,SAAS,gBAAgB,CAAC,IAAuB;IAC/C,MAAM,GAAG,GAAG,CAAC,CAA4B,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtI,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACvC,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAMpC;IACC,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IACrC,MAAM,GAAG,GAAG,KAAK,EAAE,MAAc,EAAE,IAAY,EAAE,IAAc,EAAiB,EAAE;QAChF,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,4BAA4B,IAAI,EAAE,EAAE;YACtD,MAAM;YACN,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC3H,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC5D,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAS,CAAC;QAC1D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,eAAe,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,IAAI,MAA0B,CAAC;IAC/B,GAAG,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,iBAAiB,OAAO,CAAC,YAAY,QAAQ,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;QACrH,KAAK,CAAC,IAAI,CAAC,GAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAY,CAAC,CAAC;QAC7C,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC,QAAQ,MAAM,EAAE;IAEjB,MAAM,QAAQ,GAAG,KAAK,EAAE,EAAU,EAAwB,EAAE;QAC1D,MAAM,GAAG,GAAgB,EAAE,CAAC;QAC5B,IAAI,CAAqB,CAAC;QAC1B,GAAG,CAAC;YACF,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,0BAA0B,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnG,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAW,EAAE,CAAC;gBAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC5B,MAAM,IAAI,GAAG,CAAE,CAAC,CAAC,IAAI,CAAsB,EAAE,SAAS,IAAI,EAAE,CAAsB,CAAC;gBACnF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBAChB,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7C,CAAC;gBACD,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;oBACnB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9C,CAAC;YACH,CAAC;YACD,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrD,CAAC,QAAQ,CAAC,EAAE;QACZ,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,GAAG,GAAK,CAAC,CAAC,UAAmB,EAAE,QAA6B,EAAE,IAAsC,CAAC;QAC3G,MAAM,GAAG,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,MAAM,GAAgB,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;IAC9F,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7G,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1G,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACxC,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACjF,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;YACtC,IAAI,GAAG,GAAG,CAAC,CAAC;YACZ,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,0EAA0E;gBAC1E,2EAA2E;gBAC3E,yEAAyE;gBACzE,4EAA4E;gBAC5E,MAAM,IAAI,GAAW,EAAE,CAAC;gBACxB,KAAK,MAAM,KAAK,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjD,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;wBAC7B,IAAI,CAAC,IAAI,CAAC,GAAI,KAA2B,CAAC,CAAC;wBAC3C,SAAS;oBACX,CAAC;oBACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACtD,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;oBACxC,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;oBACzC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;wBACzB,IAAI,CAAC,IAAI,CAAC,GAAI,KAA2B,CAAC,CAAC;wBAC3C,SAAS;oBACX,CAAC;oBACD,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC;oBAChB,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC;oBACf,OAAO,GAAG,IAAI,CAAC;oBACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,iBAAiB,EAAE,CAAC;wBAC1D,IAAI,CAAC,IAAI,CAAC;4BACR,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE;4BAC5F,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW;yBAClC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBACD,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,CAAC,aAAa,EAAE,CAAC;oBACvB,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;wBAClB,MAAM,GAAG,CAAC,OAAO,EAAE,WAAW,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;oBACnF,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;gBAChB,MAAM,KAAK,GAAG,IAAI,CAAC,UAAkC,CAAC;gBACtD,MAAM,KAAK,GAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAmC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAChH,MAAM,IAAI,GAAI,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,IAAI,EAAE,CAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACxG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrD,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,IAAI,GAAG,UAAU,IAAI,uBAAuB,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC;YAClI,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/secrets.d.ts

@@ -0,0 +1,59 @@
+export type SecurityRunImpl = (bin: string, args: readonly string[], stdin?: string) => Promise<{
+    stdout: string;
+    stderr: string;
+}>;
+export declare const KEYCHAIN_WRITE_FAILED = "Keychain write failed. Run plaud-notes-to-notion from a logged-in GUI session on the Mini (SSH / non-GUI shells cannot write Keychain).";
+/** Quote for `security -i` so the secret is on stdin, not `ps` argv. */
+export declare function quoteSecurityArg(value: string): string;
+export declare function defaultSecurityRun(bin: string, args: readonly string[], stdin?: string): Promise<{
+    stdout: string;
+    stderr: string;
+}>;
+/**
+ * Mini: `security -i` with the password on stdin (not argv / `ps`).
+ * `-U` updates an existing item. GUI Terminal.app required — non-GUI write fails.
+ */
+export declare function writeKeychainPassword(options: {
+    service: string;
+    account: string;
+    value: string;
+    securityBin?: string;
+    securityRunImpl?: SecurityRunImpl;
+}): Promise<void>;
+export interface SecretStore {
+    describe(): string;
+    get(account: string): Promise<string | null>;
+    set(account: string, value: string): Promise<void>;
+    delete(account: string): Promise<void>;
+}
+export declare class MemorySecretStore implements SecretStore {
+    private readonly values;
+    describe(): string;
+    get(account: string): Promise<string | null>;
+    set(account: string, value: string): Promise<void>;
+    delete(account: string): Promise<void>;
+}
+/** File-backed store for tests (`PLAUD_NOTES_HOME`) and Linux fallback. Mini uses Keychain. */
+export declare class FileSecretStore implements SecretStore {
+    private readonly dir;
+    constructor(dir: string);
+    describe(): string;
+    private fileFor;
+    get(account: string): Promise<string | null>;
+    set(account: string, value: string): Promise<void>;
+    delete(account: string): Promise<void>;
+}
+export declare class KeychainSecretStore implements SecretStore {
+    private readonly service;
+    private readonly securityBin;
+    private readonly securityRunImpl;
+    constructor(service?: string, securityBin?: string, securityRunImpl?: SecurityRunImpl);
+    describe(): string;
+    get(account: string): Promise<string | null>;
+    set(account: string, value: string): Promise<void>;
+    delete(account: string): Promise<void>;
+}
+export declare function createSecretStore(options?: {
+    env?: NodeJS.ProcessEnv;
+    platform?: NodeJS.Platform;
+}): SecretStore;

package/dist/secrets.js

@@ -0,0 +1,220 @@
+import { spawn } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { KEYCHAIN_SERVICE } from "./constants.js";
+import { getStateDir } from "./paths.js";
+export const KEYCHAIN_WRITE_FAILED = "Keychain write failed. Run plaud-notes-to-notion from a logged-in GUI session on the Mini (SSH / non-GUI shells cannot write Keychain).";
+function stripSecurityPassword(stdout) {
+    return stdout.replace(/\n$/, "");
+}
+/** Quote for `security -i` so the secret is on stdin, not `ps` argv. */
+export function quoteSecurityArg(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+export async function defaultSecurityRun(bin, args, stdin) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(bin, [...args], { stdio: ["pipe", "pipe", "pipe"] });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (chunk) => {
+            stdout += String(chunk);
+        });
+        child.stderr.on("data", (chunk) => {
+            stderr += String(chunk);
+        });
+        child.on("error", reject);
+        child.on("close", (code) => {
+            if (code === 0) {
+                resolve({ stdout, stderr });
+                return;
+            }
+            reject(new Error(stderr.trim() || `security exited ${code}`));
+        });
+        if (!child.stdin) {
+            reject(new Error(KEYCHAIN_WRITE_FAILED));
+            return;
+        }
+        child.stdin.on("error", () => {
+            /* EPIPE: close/error settles the promise */
+        });
+        if (stdin !== undefined) {
+            child.stdin.write(stdin);
+        }
+        child.stdin.end();
+    });
+}
+/**
+ * Mini: `security -i` with the password on stdin (not argv / `ps`).
+ * `-U` updates an existing item. GUI Terminal.app required — non-GUI write fails.
+ */
+export async function writeKeychainPassword(options) {
+    if (options.value.includes("\n") || options.value.includes("\r")) {
+        throw new Error(KEYCHAIN_WRITE_FAILED);
+    }
+    const securityBin = options.securityBin || "/usr/bin/security";
+    const run = options.securityRunImpl || defaultSecurityRun;
+    const addLine = (update) => `add-generic-password${update ? " -U" : ""} -s ${quoteSecurityArg(options.service)} -a ${quoteSecurityArg(options.account)} -w ${quoteSecurityArg(options.value)}\n`;
+    try {
+        await run(securityBin, ["-i"], addLine(true));
+    }
+    catch {
+        try {
+            await run(securityBin, ["delete-generic-password", "-s", options.service, "-a", options.account]);
+        }
+        catch {
+            /* nothing to replace */
+        }
+        try {
+            await run(securityBin, ["-i"], addLine(false));
+        }
+        catch {
+            throw new Error(KEYCHAIN_WRITE_FAILED);
+        }
+    }
+    let readBack;
+    try {
+        const { stdout } = await run(securityBin, [
+            "find-generic-password",
+            "-s",
+            options.service,
+            "-a",
+            options.account,
+            "-w"
+        ]);
+        readBack = stripSecurityPassword(stdout);
+    }
+    catch {
+        throw new Error(KEYCHAIN_WRITE_FAILED);
+    }
+    if (readBack !== options.value) {
+        throw new Error(KEYCHAIN_WRITE_FAILED);
+    }
+}
+export class MemorySecretStore {
+    values = new Map();
+    describe() {
+        return "in-memory store";
+    }
+    async get(account) {
+        return this.values.get(account) ?? null;
+    }
+    async set(account, value) {
+        this.values.set(account, value);
+    }
+    async delete(account) {
+        this.values.delete(account);
+    }
+}
+/** File-backed store for tests (`PLAUD_NOTES_HOME`) and Linux fallback. Mini uses Keychain. */
+export class FileSecretStore {
+    dir;
+    constructor(dir) {
+        this.dir = dir;
+    }
+    describe() {
+        return `file store under ${path.join(this.dir, "secrets")}`;
+    }
+    fileFor(account) {
+        const safe = account.replace(/[^A-Za-z0-9._-]/g, "_");
+        return path.join(this.dir, "secrets", safe);
+    }
+    async get(account) {
+        try {
+            const raw = await fs.promises.readFile(this.fileFor(account), "utf8");
+            const trimmed = raw.trim();
+            return trimmed ? trimmed : null;
+        }
+        catch (err) {
+            if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
+                return null;
+            }
+            throw err;
+        }
+    }
+    async set(account, value) {
+        const file = this.fileFor(account);
+        await fs.promises.mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+        await fs.promises.writeFile(file, value, { encoding: "utf8", mode: 0o600 });
+        await fs.promises.chmod(file, 0o600);
+    }
+    async delete(account) {
+        try {
+            await fs.promises.rm(this.fileFor(account));
+        }
+        catch (err) {
+            if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
+                return;
+            }
+            throw err;
+        }
+    }
+}
+export class KeychainSecretStore {
+    service;
+    securityBin;
+    securityRunImpl;
+    constructor(service = KEYCHAIN_SERVICE, securityBin = "/usr/bin/security", securityRunImpl = defaultSecurityRun) {
+        this.service = service;
+        this.securityBin = securityBin;
+        this.securityRunImpl = securityRunImpl;
+    }
+    describe() {
+        return `macOS Keychain (service ${this.service})`;
+    }
+    async get(account) {
+        try {
+            const { stdout } = await this.securityRunImpl(this.securityBin, [
+                "find-generic-password",
+                "-s",
+                this.service,
+                "-a",
+                account,
+                "-w"
+            ]);
+            const value = stripSecurityPassword(stdout);
+            return value ? value : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    async set(account, value) {
+        await writeKeychainPassword({
+            service: this.service,
+            account,
+            value,
+            securityBin: this.securityBin,
+            securityRunImpl: this.securityRunImpl
+        });
+    }
+    async delete(account) {
+        try {
+            await this.securityRunImpl(this.securityBin, [
+                "delete-generic-password",
+                "-s",
+                this.service,
+                "-a",
+                account
+            ]);
+        }
+        catch {
+            /* already gone */
+        }
+    }
+}
+export function createSecretStore(options = {}) {
+    const env = options.env || process.env;
+    if (env.PLAUD_NOTES_SECRET_STORE === "memory") {
+        return new MemorySecretStore();
+    }
+    const platform = options.platform || process.platform;
+    const home = env.PLAUD_NOTES_HOME && env.PLAUD_NOTES_HOME.trim();
+    if (home) {
+        return new FileSecretStore(path.resolve(home));
+    }
+    if (platform === "darwin") {
+        return new KeychainSecretStore();
+    }
+    return new FileSecretStore(getStateDir(env));
+}
+//# sourceMappingURL=secrets.js.map

package/dist/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAQzC,MAAM,CAAC,MAAM,qBAAqB,GAChC,yIAAyI,CAAC;AAE5I,SAAS,qBAAqB,CAAC,MAAc;IAC3C,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAW,EACX,IAAuB,EACvB,KAAc;IAEd,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACzE,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAChC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAChC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAC3B,4CAA4C;QAC9C,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAM3C;IACC,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,mBAAmB,CAAC;IAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,eAAe,IAAI,kBAAkB,CAAC;IAC1D,MAAM,OAAO,GAAG,CAAC,MAAe,EAAU,EAAE,CAC1C,uBAAuB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;IACvK,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QACpG,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,WAAW,EAAE;YACxC,uBAAuB;YACvB,IAAI;YACJ,OAAO,CAAC,OAAO;YACf,IAAI;YACJ,OAAO,CAAC,OAAO;YACf,IAAI;SACL,CAAC,CAAC;QACH,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AASD,MAAM,OAAO,iBAAiB;IACX,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEpD,QAAQ;QACN,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAe;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAe,EAAE,KAAa;QACtC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe;QAC1B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;CACF;AAED,+FAA+F;AAC/F,MAAM,OAAO,eAAe;IACG;IAA7B,YAA6B,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;IAAG,CAAC;IAE5C,QAAQ;QACN,OAAO,oBAAoB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;IAC9D,CAAC;IAEO,OAAO,CAAC,OAAe;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAe;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YAC3B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAK,GAAyB,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACpG,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAe,EAAE,KAAa;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe;QAC1B,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAK,GAAyB,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACpG,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,mBAAmB;IAEX;IACA;IACA;IAHnB,YACmB,UAAkB,gBAAgB,EAClC,cAAsB,mBAAmB,EACzC,kBAAmC,kBAAkB;QAFrD,YAAO,GAAP,OAAO,CAA2B;QAClC,gBAAW,GAAX,WAAW,CAA8B;QACzC,oBAAe,GAAf,eAAe,CAAsC;IACrE,CAAC;IAEJ,QAAQ;QACN,OAAO,2BAA2B,IAAI,CAAC,OAAO,GAAG,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAe;QACvB,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE;gBAC9D,uBAAuB;gBACvB,IAAI;gBACJ,IAAI,CAAC,OAAO;gBACZ,IAAI;gBACJ,OAAO;gBACP,IAAI;aACL,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;YAC5C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAe,EAAE,KAAa;QACtC,MAAM,qBAAqB,CAAC;YAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO;YACP,KAAK;YACL,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE;gBAC3C,yBAAyB;gBACzB,IAAI;gBACJ,IAAI,CAAC,OAAO;gBACZ,IAAI;gBACJ,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,iBAAiB,CAAC,UAG9B,EAAE;IACJ,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,IAAI,GAAG,CAAC,wBAAwB,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,IAAI,iBAAiB,EAAE,CAAC;IACjC,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,IAAI,GAAG,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;IACjE,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,IAAI,mBAAmB,EAAE,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,eAAe,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/C,CAAC"}

package/dist/ssn.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Social Security number redaction for Plaud summaries and transcripts.
+ *
+ * Runs on raw Plaud text before anything leaves the Mini (OpenAI or Notion).
+ * Handles written digits ("4417", "523-81-4417") and spoken digits
+ * ("zero zero two three", "double oh two three"), including answers that land
+ * in the next speaker's utterance after "last four of your social?".
+ */
+export declare const SSN_REPLACEMENT = "[SSN redacted]";
+export declare const DIGIT_WORDS: Record<string, string>;
+export interface SsnRedaction {
+    text: string;
+    count: number;
+}
+export declare function spokenDigits(run: string): string;
+export declare function protectedRanges(text: string): Array<[number, number]>;
+export declare function looksLikeYear(digits: string): boolean;
+export declare function isYearInDate(text: string, run: {
+    start: number;
+    digits: string;
+}): boolean;
+/** Digits of every SSN-shaped value the triggers point at, across all given texts. */
+export declare function findSsnDigits(texts: string[]): Set<string>;
+/** Replace every number run whose digits match a found SSN value (or contain a full one). */
+export declare function redactDigits(text: string, ssnDigits: Set<string>): SsnRedaction;
+/**
+ * Redact SSNs across every text of one recording. Values found in one text
+ * (e.g. the transcript) are also removed from the others (e.g. the summary).
+ */
+export declare function redactSsnAcross<T extends Record<string, string>>(texts: T): {
+    texts: T;
+    count: number;
+};

package/dist/ssn.js

@@ -0,0 +1,170 @@
+/**
+ * Social Security number redaction for Plaud summaries and transcripts.
+ *
+ * Runs on raw Plaud text before anything leaves the Mini (OpenAI or Notion).
+ * Handles written digits ("4417", "523-81-4417") and spoken digits
+ * ("zero zero two three", "double oh two three"), including answers that land
+ * in the next speaker's utterance after "last four of your social?".
+ */
+export const SSN_REPLACEMENT = "[SSN redacted]";
+export const DIGIT_WORDS = {
+    zero: "0",
+    oh: "0",
+    one: "1",
+    two: "2",
+    three: "3",
+    four: "4",
+    five: "5",
+    six: "6",
+    seven: "7",
+    eight: "8",
+    nine: "9"
+};
+const WORD = "(?:zero|oh|one|two|three|four|five|six|seven|eight|nine)";
+const TOKEN = `(?:\\d+|(?:double|triple)[ -]${WORD}|${WORD})`;
+const SEP = "[ \\t,.\\-\\u2013\\u2014/]*";
+/** A run of written or spoken digits on one line. */
+const NUMBER_RUN = new RegExp(`(?<![\\w])${TOKEN}(?:${SEP}${TOKEN})*(?![\\w])`, "gi");
+/**
+ * Strong triggers name the SSN outright; weak triggers ("social", "last four")
+ * need a following 4- or 9-digit number and skip year-shaped values.
+ */
+const STRONG_TRIGGER = /\b(?:social[ -]security(?:[ -](?:number|no\.?|#))?|s\.?\s?s\.?\s?n\.?|last\s+(?:four|4)(?:\s+digits)?\s+of\s+(?:(?:my|your|his|her|the)\s+)?(?:social|ss|ssn))\b/gi;
+const WEAK_TRIGGER = /\b(?:social(?!\s+(?:media|work|worker|workers|club|event|events|network|networks|skills|life|anxiety|studies|circle|hour|security))|last\s+(?:four|4)(?![^.?!\n]{0,40}\bcard\b)(?:\s+digits)?)\b/gi;
+/** Lookahead window after a trigger, long enough to cross into the next utterance. */
+const WINDOW_CHARS = 320;
+/** Plaud transcript header lines (`Speaker 1 00:01:05`) and bare timestamps are never SSNs. */
+const PROTECTED = /^[^\n]*\b\d{1,2}:\d{2}:\d{2}[ \t]*$|\b\d{1,2}:\d{2}(?::\d{2})?\b/gm;
+export function spokenDigits(run) {
+    let out = "";
+    const re = new RegExp(`\\d+|(double|triple)[ -](${WORD})|${WORD}`, "gi");
+    let m;
+    while ((m = re.exec(run))) {
+        if (/^\d+$/.test(m[0])) {
+            out += m[0];
+        }
+        else if (m[1]) {
+            const d = DIGIT_WORDS[m[2].toLowerCase()];
+            out += m[1].toLowerCase() === "double" ? d.repeat(2) : d.repeat(3);
+        }
+        else {
+            out += DIGIT_WORDS[m[0].toLowerCase()];
+        }
+    }
+    return out;
+}
+export function protectedRanges(text) {
+    const ranges = [];
+    PROTECTED.lastIndex = 0;
+    let m;
+    while ((m = PROTECTED.exec(text))) {
+        ranges.push([m.index, m.index + m[0].length]);
+        if (m[0].length === 0) {
+            PROTECTED.lastIndex++;
+        }
+    }
+    return ranges;
+}
+function numberRuns(text) {
+    const guarded = protectedRanges(text);
+    const runs = [];
+    NUMBER_RUN.lastIndex = 0;
+    let m;
+    while ((m = NUMBER_RUN.exec(text))) {
+        const start = m.index;
+        const end = start + m[0].replace(/[ \t,.\-–—/]+$/, "").length;
+        if (guarded.some(([a, b]) => start < b && end > a)) {
+            continue;
+        }
+        const digits = spokenDigits(m[0]);
+        if (digits) {
+            runs.push({ start, end, digits });
+        }
+    }
+    return runs;
+}
+export function looksLikeYear(digits) {
+    return digits.length === 4 && /^(?:19|20)\d\d$/.test(digits);
+}
+const MONTH = "(?:jan(?:uary)?|feb(?:ruary)?|mar(?:ch)?|apr(?:il)?|may|june?|july?|aug(?:ust)?|sep(?:t(?:ember)?)?|oct(?:ober)?|nov(?:ember)?|dec(?:ember)?)";
+/** "January 1st, 1990", "August 10, 1984", "born in 1984", "10/08/1984" — a year inside a date, not an SSN. */
+const DATE_BEFORE = new RegExp(`(?:\\b${MONTH}\\.?\\s+\\w{1,9}(?:st|nd|rd|th)?,?\\s*|\\b(?:born|birth|birthday|year|dob)\\b[^.?!\\n]{0,30}|\\d{1,2}[/-]\\d{1,2}[/-])$`, "i");
+export function isYearInDate(text, run) {
+    return looksLikeYear(run.digits) && DATE_BEFORE.test(text.slice(Math.max(0, run.start - 40), run.start));
+}
+function triggerEnds(text, re) {
+    const ends = [];
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(text))) {
+        ends.push(m.index + m[0].length);
+    }
+    return ends;
+}
+/** Digits of every SSN-shaped value the triggers point at, across all given texts. */
+export function findSsnDigits(texts) {
+    const found = new Set();
+    for (const text of texts) {
+        const runs = numberRuns(text);
+        for (const m of text.matchAll(/\b\d{3}-\d{2}-\d{4}\b/g)) {
+            found.add(m[0].replace(/-/g, ""));
+        }
+        const scan = (ends, strong) => {
+            for (const end of ends) {
+                const hit = runs.find((r) => r.start >= end &&
+                    r.start <= end + WINDOW_CHARS &&
+                    (r.digits.length === 4 || r.digits.length === 9) &&
+                    !isYearInDate(text, r) &&
+                    (strong || !looksLikeYear(r.digits)));
+                if (hit) {
+                    found.add(hit.digits);
+                }
+            }
+        };
+        scan(triggerEnds(text, STRONG_TRIGGER), true);
+        scan(triggerEnds(text, WEAK_TRIGGER), false);
+    }
+    // A full SSN also exposes its last four.
+    for (const d of [...found]) {
+        if (d.length === 9) {
+            found.add(d.slice(5));
+        }
+    }
+    return found;
+}
+/** Replace every number run whose digits match a found SSN value (or contain a full one). */
+export function redactDigits(text, ssnDigits) {
+    if (ssnDigits.size === 0) {
+        return { text, count: 0 };
+    }
+    const runs = numberRuns(text).filter((r) => {
+        if (ssnDigits.has(r.digits)) {
+            return true;
+        }
+        return [...ssnDigits].some((d) => d.length === 9 && r.digits.includes(d));
+    });
+    let out = "";
+    let cursor = 0;
+    for (const r of runs) {
+        out += text.slice(cursor, r.start) + SSN_REPLACEMENT;
+        cursor = r.end;
+    }
+    out += text.slice(cursor);
+    return { text: out, count: runs.length };
+}
+/**
+ * Redact SSNs across every text of one recording. Values found in one text
+ * (e.g. the transcript) are also removed from the others (e.g. the summary).
+ */
+export function redactSsnAcross(texts) {
+    const found = findSsnDigits(Object.values(texts));
+    let count = 0;
+    const out = {};
+    for (const [key, value] of Object.entries(texts)) {
+        const r = redactDigits(value, found);
+        out[key] = r.text;
+        count += r.count;
+    }
+    return { texts: out, count };
+}
+//# sourceMappingURL=ssn.js.map

package/dist/ssn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssn.js","sourceRoot":"","sources":["../src/ssn.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAEhD,MAAM,CAAC,MAAM,WAAW,GAA2B;IACjD,IAAI,EAAE,GAAG;IACT,EAAE,EAAE,GAAG;IACP,GAAG,EAAE,GAAG;IACR,GAAG,EAAE,GAAG;IACR,KAAK,EAAE,GAAG;IACV,IAAI,EAAE,GAAG;IACT,IAAI,EAAE,GAAG;IACT,GAAG,EAAE,GAAG;IACR,KAAK,EAAE,GAAG;IACV,KAAK,EAAE,GAAG;IACV,IAAI,EAAE,GAAG;CACV,CAAC;AAEF,MAAM,IAAI,GAAG,0DAA0D,CAAC;AACxE,MAAM,KAAK,GAAG,gCAAgC,IAAI,IAAI,IAAI,GAAG,CAAC;AAC9D,MAAM,GAAG,GAAG,6BAA6B,CAAC;AAC1C,qDAAqD;AACrD,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,GAAG,GAAG,KAAK,aAAa,EAAE,IAAI,CAAC,CAAC;AAEtF;;;GAGG;AACH,MAAM,cAAc,GAAG,oKAAoK,CAAC;AAC5L,MAAM,YAAY,GAAG,oMAAoM,CAAC;AAE1N,sFAAsF;AACtF,MAAM,YAAY,GAAG,GAAG,CAAC;AAEzB,+FAA+F;AAC/F,MAAM,SAAS,GAAG,oEAAoE,CAAC;AAOvF,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,4BAA4B,IAAI,KAAK,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IACzE,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC1B,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvB,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;aAAM,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChB,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAC1C,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAQD,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC;IACxB,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,SAAS,CAAC,SAAS,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,IAAI,GAAU,EAAE,CAAC;IACvB,UAAU,CAAC,SAAS,GAAG,CAAC,CAAC;IACzB,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QACtB,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;QAC9D,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;YACnD,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,KAAK,GAAG,+IAA+I,CAAC;AAC9J,+GAA+G;AAC/G,MAAM,WAAW,GAAG,IAAI,MAAM,CAC5B,SAAS,KAAK,yHAAyH,EACvI,GAAG,CACJ,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,GAAsC;IAC/E,OAAO,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3G,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,EAAU;IAC3C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;IACjB,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAC,KAAe;IAC3C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;YACxD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,IAAc,EAAE,MAAe,EAAE,EAAE;YAC/C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CACnB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,KAAK,IAAI,GAAG;oBACd,CAAC,CAAC,KAAK,IAAI,GAAG,GAAG,YAAY;oBAC7B,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;oBAChD,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;oBACtB,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CACvC,CAAC;gBACF,IAAI,GAAG,EAAE,CAAC;oBACR,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IACD,yCAAyC;IACzC,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,SAAsB;IAC/D,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACzC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IACH,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC;QACrD,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC;IACjB,CAAC;IACD,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAmC,KAAQ;IACxE,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,GAAG,GAAG,EAA4B,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QAClB,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,GAAQ,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC"}