safeseed 0.2.0

package/dist/cli.js

@@ -0,0 +1,228 @@
+#!/usr/bin/env node
+/**
+ * SafeSeed CLI — the shell CI actually calls.
+ *
+ *   safeseed generate --fields email:email,phone:phone --rows 100 --seed 42 \
+ *                     --out data.csv --record record.json
+ *   safeseed verify   --in data.csv --record record.json     # exits non-zero on drift
+ *   safeseed verify   --in data.csv --record record.json --allow-added-columns
+ *                                                            # column-scoped: attest the
+ *                                                            # synthetic columns, report added ones
+ *   safeseed scan     --in legacy.csv --fields email:email,phone:phone
+ *   safeseed catalog                                          # print the reserved-range catalog
+ *
+ * No network, no config beyond the files you point it at. Exit codes: 0 clean,
+ * 1 drift/findings, 2 usage/IO error.
+ */
+import { readFileSync, writeFileSync } from "node:fs";
+import process from "node:process";
+import { generate, toCsv, makeRunRecord, verify, scan, exitCode, CATALOG, CATALOG_VERSION, SAFESEED_VERSION, } from "./index.js";
+function parseArgs(argv) {
+    const positional = [];
+    const flags = {};
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a.startsWith("--")) {
+            const eq = a.indexOf("=");
+            if (eq >= 0) {
+                flags[a.slice(2, eq)] = a.slice(eq + 1);
+            }
+            else {
+                const key = a.slice(2);
+                const next = argv[i + 1];
+                if (next !== undefined && !next.startsWith("--")) {
+                    flags[key] = next;
+                    i++;
+                }
+                else {
+                    flags[key] = true;
+                }
+            }
+        }
+        else {
+            positional.push(a);
+        }
+    }
+    return { _: positional, flags };
+}
+function fail(msg) {
+    process.stderr.write(`safeseed: ${msg}\n`);
+    process.exit(2);
+}
+function reqStr(p, key) {
+    const v = p.flags[key];
+    if (typeof v !== "string" || v === "")
+        fail(`missing required --${key}`);
+    return v;
+}
+const VALID_TYPES = new Set(CATALOG.map((e) => e.field));
+function parseFields(spec) {
+    return spec.split(",").map((pair) => {
+        const [name, type] = pair.split(":").map((s) => s.trim());
+        if (!name || !type)
+            fail(`bad --fields entry "${pair}" (expected name:type)`);
+        if (!VALID_TYPES.has(type))
+            fail(`unknown field type "${type}" (run: safeseed catalog)`);
+        return { name, type: type };
+    });
+}
+function cmdGenerate(p) {
+    let schema = [];
+    let rows = 0;
+    let seed = 0;
+    let formatValid = true;
+    if (typeof p.flags.config === "string") {
+        const cfg = JSON.parse(readFileSync(p.flags.config, "utf8"));
+        if (cfg.schema)
+            schema = cfg.schema;
+        if (typeof cfg.rows === "number")
+            rows = cfg.rows;
+        if (typeof cfg.seed === "number")
+            seed = cfg.seed;
+        if (typeof cfg.formatValid === "boolean")
+            formatValid = cfg.formatValid;
+    }
+    if (typeof p.flags.fields === "string")
+        schema = parseFields(p.flags.fields);
+    if (p.flags.rows !== undefined)
+        rows = Number(p.flags.rows);
+    if (p.flags.seed !== undefined)
+        seed = Number(p.flags.seed);
+    if (p.flags["format-valid"] !== undefined)
+        formatValid = p.flags["format-valid"] !== "false";
+    if (schema.length === 0)
+        fail("no schema (use --config <file> or --fields name:type,...)");
+    if (!Number.isInteger(rows) || rows <= 0)
+        fail("--rows must be a positive integer");
+    if (!Number.isFinite(seed))
+        fail("--seed must be a number");
+    const ds = generate({ schema, rows, seed, formatValid });
+    const csv = toCsv(ds.columns, ds.rows);
+    if (typeof p.flags.out === "string")
+        writeFileSync(p.flags.out, csv);
+    else
+        process.stdout.write(csv);
+    const recordWork = typeof p.flags.record === "string"
+        ? makeRunRecord(ds, csv, typeof p.flags.now === "string" ? { generatedAt: p.flags.now } : undefined).then((rec) => {
+            writeFileSync(p.flags.record, JSON.stringify(rec, null, 2) + "\n");
+        })
+        : Promise.resolve();
+    return recordWork.then(() => {
+        if (typeof p.flags.out === "string") {
+            process.stderr.write(`safeseed: wrote ${ds.rows.length} rows to ${p.flags.out}\n`);
+        }
+    });
+}
+function boolFlag(p, key) {
+    const v = p.flags[key];
+    return v === true || v === "true";
+}
+async function cmdVerify(p) {
+    const csv = readFileSync(reqStr(p, "in"), "utf8");
+    const record = JSON.parse(readFileSync(reqStr(p, "record"), "utf8"));
+    const allowAddedColumns = boolFlag(p, "allow-added-columns");
+    const result = await verify(csv, record, { allowAddedColumns });
+    const mode = allowAddedColumns ? " (column-scoped)" : "";
+    if (result.ok) {
+        process.stdout.write(`safeseed verify${mode}: OK — ${result.checked.rows} rows, ${result.checked.fields} fields in range\n`);
+    }
+    else {
+        process.stdout.write(`safeseed verify${mode}: FAIL — ${result.failures.length} issue(s)\n`);
+        for (const f of result.failures.slice(0, 50)) {
+            process.stdout.write(`  [${f.kind}] ${f.message}\n`);
+        }
+        if (result.failures.length > 50) {
+            process.stdout.write(`  ...and ${result.failures.length - 50} more\n`);
+        }
+    }
+    if (result.unattestedColumns.length > 0) {
+        process.stdout.write(`  unattested (added) columns, NOT vouched for — scan these: ${result.unattestedColumns.join(", ")}\n`);
+    }
+    for (const w of result.warnings) {
+        process.stdout.write(`  warning: ${w}\n`);
+    }
+    process.exit(exitCode(result));
+}
+function cmdScan(p) {
+    let columns = [];
+    if (typeof p.flags.config === "string") {
+        const cfg = JSON.parse(readFileSync(p.flags.config, "utf8"));
+        columns = cfg.columns ?? cfg.schema ?? [];
+    }
+    if (typeof p.flags.fields === "string")
+        columns = parseFields(p.flags.fields);
+    if (columns.length === 0)
+        fail("no columns (use --config <file> or --fields name:type,...)");
+    const csv = readFileSync(reqStr(p, "in"), "utf8");
+    const result = scan({ csv, columns });
+    if (result.ok) {
+        process.stdout.write(`safeseed scan: clean — ${result.scannedRows} rows, no candidate PII\n`);
+    }
+    else {
+        process.stdout.write(`safeseed scan: ${result.findings.length} candidate(s) across ${result.scannedRows} rows\n`);
+        for (const f of result.findings.slice(0, 50)) {
+            process.stdout.write(`  row ${f.row} ${f.field}: "${f.value}"\n`);
+        }
+        if (result.findings.length > 50) {
+            process.stdout.write(`  ...and ${result.findings.length - 50} more\n`);
+        }
+    }
+    process.exit(result.ok ? 0 : 1);
+}
+function cmdCatalog() {
+    process.stdout.write(JSON.stringify({ version: CATALOG_VERSION, entries: CATALOG }, null, 2) + "\n");
+}
+function printUsage() {
+    process.stdout.write([
+        `safeseed ${SAFESEED_VERSION} — confirmably-synthetic test data by construction`,
+        "",
+        "Usage:",
+        "  safeseed generate --fields <name:type,...> --rows N --seed S [--out f.csv] [--record r.json] [--format-valid true|false]",
+        "  safeseed generate --config gen.json [--out f.csv] [--record r.json]",
+        "  safeseed verify   --in f.csv --record r.json [--allow-added-columns]",
+        "  safeseed scan     --in f.csv --fields <name:type,...>",
+        "  safeseed catalog",
+        "  safeseed version",
+        "",
+        "Field types: " + [...VALID_TYPES].join(", "),
+        "Exit codes: 0 clean · 1 drift/findings · 2 usage/IO error",
+    ].join("\n") + "\n");
+}
+async function main() {
+    const p = parseArgs(process.argv.slice(2));
+    const cmd = p._[0];
+    switch (cmd) {
+        case "generate":
+            await cmdGenerate(p);
+            break;
+        case "verify":
+            await cmdVerify(p);
+            break;
+        case "scan":
+            cmdScan(p);
+            break;
+        case "catalog":
+            cmdCatalog();
+            break;
+        case "version":
+        case undefined:
+            if (cmd === "version") {
+                process.stdout.write(`safeseed ${SAFESEED_VERSION} (catalog ${CATALOG_VERSION})\n`);
+            }
+            else {
+                printUsage();
+            }
+            break;
+        case "help":
+            printUsage();
+            break;
+        default:
+            printUsage();
+            process.exit(2);
+    }
+}
+main().catch((e) => {
+    process.stderr.write(`safeseed: ${e instanceof Error ? e.message : String(e)}\n`);
+    process.exit(2);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EACL,QAAQ,EACR,KAAK,EACL,aAAa,EACb,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,OAAO,EACP,eAAe,EACf,gBAAgB,GAKjB,MAAM,YAAY,CAAC;AAOpB,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,KAAK,GAAqC,EAAE,CAAC;IACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBACZ,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACvB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACzB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjD,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;oBAClB,CAAC,EAAE,CAAC;gBACN,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;gBACpB,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,IAAI,CAAC,GAAW;IACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,MAAM,CAAC,CAAS,EAAE,GAAW;IACpC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE;QAAE,IAAI,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAC;IACzE,OAAO,CAAW,CAAC;AACrB,CAAC;AAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAEjE,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAClC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,CAAC,uBAAuB,IAAI,wBAAwB,CAAC,CAAC;QAC9E,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,uBAAuB,IAAI,2BAA2B,CAAC,CAAC;QACzF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAiB,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,MAAM,GAAkB,EAAE,CAAC;IAC/B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,WAAW,GAAG,IAAI,CAAC;IAEvB,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAKzD,CAAC;QACH,IAAI,GAAG,CAAC,MAAM;YAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACpC,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAClD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAClD,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,SAAS;YAAE,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7E,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,SAAS;QAAE,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,OAAO,CAAC;IAE7F,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,2DAA2D,CAAC,CAAC;IAC3F,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;QAAE,IAAI,CAAC,mCAAmC,CAAC,CAAC;IACpF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAE5D,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAEvC,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,KAAK,QAAQ;QAAE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE/B,MAAM,UAAU,GACd,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,CAAC,CAAC,aAAa,CACX,EAAE,EACF,GAAG,EACH,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAC3E,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,MAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/E,CAAC,CAAC;QACJ,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IAExB,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE;QAC1B,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;QACrF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,GAAW;IACtC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvB,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,MAAM,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,CAAS;IAChC,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAc,CAAC;IAClF,MAAM,iBAAiB,GAAG,QAAQ,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kBAAkB,IAAI,UAAU,MAAM,CAAC,OAAO,CAAC,IAAI,UAAU,MAAM,CAAC,OAAO,CAAC,MAAM,oBAAoB,CACvG,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,YAAY,MAAM,CAAC,QAAQ,CAAC,MAAM,aAAa,CAAC,CAAC;QAC5F,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,SAAS,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+DAA+D,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACvG,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,IAAI,OAAO,GAAiB,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAGzD,CAAC;QACH,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,4DAA4D,CAAC,CAAC;IAE7F,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,MAAM,CAAC,WAAW,2BAA2B,CAAC,CAAC;IAChG,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kBAAkB,MAAM,CAAC,QAAQ,CAAC,MAAM,wBAAwB,MAAM,CAAC,WAAW,SAAS,CAC5F,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,SAAS,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB;QACE,YAAY,gBAAgB,oDAAoD;QAChF,EAAE;QACF,QAAQ;QACR,4HAA4H;QAC5H,uEAAuE;QACvE,wEAAwE;QACxE,yDAAyD;QACzD,oBAAoB;QACpB,oBAAoB;QACpB,EAAE;QACF,eAAe,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC7C,2DAA2D;KAC5D,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CACpB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnB,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,UAAU;YACb,MAAM,WAAW,CAAC,CAAC,CAAC,CAAC;YACrB,MAAM;QACR,KAAK,QAAQ;YACX,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;YACnB,MAAM;QACR,KAAK,MAAM;YACT,OAAO,CAAC,CAAC,CAAC,CAAC;YACX,MAAM;QACR,KAAK,SAAS;YACZ,UAAU,EAAE,CAAC;YACb,MAAM;QACR,KAAK,SAAS,CAAC;QACf,KAAK,SAAS;YACZ,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,gBAAgB,aAAa,eAAe,KAAK,CAAC,CAAC;YACtF,CAAC;iBAAM,CAAC;gBACN,UAAU,EAAE,CAAC;YACf,CAAC;YACD,MAAM;QACR,KAAK,MAAM;YACT,UAAU,EAAE,CAAC;YACb,MAAM;QACR;YACE,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;IAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/csv.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Minimal, correct CSV (RFC 4180-ish) serializer and parser. Kept in-house so the
+ * core has no runtime dependency to audit — the whole pitch is "audit a few
+ * hundred cited lines once, trust every output."
+ */
+/** Serialize columns + rows to a CSV string with a trailing newline. */
+export declare function toCsv(columns: readonly string[], rows: readonly (readonly string[])[]): string;
+/**
+ * Canonical serialization of one column's cell values, used for the per-column
+ * hash in a run record. JSON encoding is unambiguous — a comma, quote, or newline
+ * inside a cell can't collide with the delimiter — so two columns hash equal iff
+ * their ordered values are identical. Generation and column-scoped verify both go
+ * through this one function, so they can never disagree on what a column "is".
+ */
+export declare function canonicalColumn(values: readonly string[]): string;
+/** Parse a CSV string into header columns and data rows. */
+export declare function parseCsv(text: string): {
+    columns: string[];
+    rows: string[][];
+};
+//# sourceMappingURL=csv.d.ts.map

package/dist/csv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csv.d.ts","sourceRoot":"","sources":["../src/csv.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,wEAAwE;AACxE,wBAAgB,KAAK,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,GAAG,MAAM,CAO9F;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAEjE;AAED,4DAA4D;AAC5D,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;CAAE,CAuD9E"}

package/dist/csv.js

@@ -0,0 +1,85 @@
+/**
+ * Minimal, correct CSV (RFC 4180-ish) serializer and parser. Kept in-house so the
+ * core has no runtime dependency to audit — the whole pitch is "audit a few
+ * hundred cited lines once, trust every output."
+ */
+/** Serialize columns + rows to a CSV string with a trailing newline. */
+export function toCsv(columns, rows) {
+    const escape = (v) => /[",\r\n]/.test(v) ? `"${v.replace(/"/g, '""')}"` : v;
+    const header = columns.map(escape).join(",");
+    if (rows.length === 0)
+        return `${header}\n`;
+    const body = rows.map((r) => r.map(escape).join(",")).join("\n");
+    return `${header}\n${body}\n`;
+}
+/**
+ * Canonical serialization of one column's cell values, used for the per-column
+ * hash in a run record. JSON encoding is unambiguous — a comma, quote, or newline
+ * inside a cell can't collide with the delimiter — so two columns hash equal iff
+ * their ordered values are identical. Generation and column-scoped verify both go
+ * through this one function, so they can never disagree on what a column "is".
+ */
+export function canonicalColumn(values) {
+    return JSON.stringify(values);
+}
+/** Parse a CSV string into header columns and data rows. */
+export function parseCsv(text) {
+    const records = [];
+    let field = "";
+    let record = [];
+    let inQuotes = false;
+    let started = false; // have we seen any content for the current record/field?
+    const pushField = () => {
+        record.push(field);
+        field = "";
+    };
+    const pushRecord = () => {
+        pushField();
+        records.push(record);
+        record = [];
+        started = false;
+    };
+    for (let i = 0; i < text.length; i++) {
+        const c = text[i];
+        if (inQuotes) {
+            if (c === '"') {
+                if (text[i + 1] === '"') {
+                    field += '"';
+                    i++;
+                }
+                else {
+                    inQuotes = false;
+                }
+            }
+            else {
+                field += c;
+            }
+            continue;
+        }
+        if (c === '"') {
+            inQuotes = true;
+            started = true;
+        }
+        else if (c === ",") {
+            pushField();
+            started = true;
+        }
+        else if (c === "\n") {
+            pushRecord();
+        }
+        else if (c === "\r") {
+            // swallow; newline handled on \n
+        }
+        else {
+            field += c;
+            started = true;
+        }
+    }
+    // Flush a final record only if the file did not end on a clean record break.
+    if (started || field.length > 0 || record.length > 0) {
+        pushRecord();
+    }
+    const columns = records.shift() ?? [];
+    return { columns, rows: records };
+}
+//# sourceMappingURL=csv.js.map

package/dist/csv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csv.js","sourceRoot":"","sources":["../src/csv.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,wEAAwE;AACxE,MAAM,UAAU,KAAK,CAAC,OAA0B,EAAE,IAAoC;IACpF,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CACnC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,MAAM,IAAI,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,OAAO,GAAG,MAAM,KAAK,IAAI,IAAI,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,MAAyB;IACvD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,MAAM,OAAO,GAAe,EAAE,CAAC;IAC/B,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,MAAM,GAAa,EAAE,CAAC;IAC1B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC,CAAC,yDAAyD;IAE9E,MAAM,SAAS,GAAG,GAAS,EAAE;QAC3B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,KAAK,GAAG,EAAE,CAAC;IACb,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,GAAS,EAAE;QAC5B,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,MAAM,GAAG,EAAE,CAAC;QACZ,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC,CAAC;IAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACd,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACxB,KAAK,IAAI,GAAG,CAAC;oBACb,CAAC,EAAE,CAAC;gBACN,CAAC;qBAAM,CAAC;oBACN,QAAQ,GAAG,KAAK,CAAC;gBACnB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,QAAQ,GAAG,IAAI,CAAC;YAChB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,SAAS,EAAE,CAAC;YACZ,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;aAAM,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACtB,UAAU,EAAE,CAAC;QACf,CAAC;aAAM,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACtB,iCAAiC;QACnC,CAAC;aAAM,CAAC;YACN,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,IAAI,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,UAAU,EAAE,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;IACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC"}

package/dist/generate.d.ts

@@ -0,0 +1,28 @@
+import type { FieldType } from "./types.js";
+export interface FieldSchema {
+    /** Output column name. */
+    name: string;
+    /** Catalog field type that governs the reserved range. */
+    type: FieldType;
+}
+export interface GenerateOptions {
+    schema: FieldSchema[];
+    rows: number;
+    /** Seed for deterministic output. Same seed + schema => identical dataset. */
+    seed: number;
+    /**
+     * Format-valid mode (default true): render values that pass common validators
+     * while staying in range (10-digit phones, NNN-NN-NNNN SSNs). When false,
+     * values are rendered in a looser, even-more-obviously-test form.
+     */
+    formatValid?: boolean;
+}
+export interface GeneratedDataset {
+    columns: string[];
+    rows: string[][];
+    schema: FieldSchema[];
+    seed: number;
+    catalogVersion: string;
+}
+export declare function generate(opts: GenerateOptions): GeneratedDataset;
+//# sourceMappingURL=generate.d.ts.map

package/dist/generate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../src/generate.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG5C,MAAM,WAAW,WAAW;IAC1B,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,IAAI,EAAE,SAAS,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;IACjB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;CACxB;AA2ED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,gBAAgB,CAmBhE"}

package/dist/generate.js

@@ -0,0 +1,101 @@
+/**
+ * Schema-driven, deterministic generation of safe-by-construction test data.
+ *
+ * Every PII-shaped value is drawn from the cited reserved ranges in `catalog.ts`;
+ * structurally-fake fields (names, addresses) are emitted as self-evidently fake
+ * tokens. Output is a function of (schema, seed), so a generated dataset is a
+ * committable, reviewable fixture.
+ */
+import { CATALOG_VERSION } from "./catalog.js";
+import { mulberry32, pick, intBetween } from "./rng.js";
+const EMAIL_DOMAINS = ["example.com", "example.net", "example.org"];
+const IPV4_BLOCKS = [
+    [192, 0, 2],
+    [198, 51, 100],
+    [203, 0, 113],
+];
+const SSN_INVALID_AREAS = ["900", "901", "902", "910", "987", "999", "000", "666"];
+const STREET_SUFFIX = ["Way", "St", "Ave", "Rd", "Blvd"];
+const CARD_TEST_NUMBERS = [
+    "4242424242424242",
+    "4111111111111111",
+    "4000056655665556",
+    "5555555555554444",
+    "5105105105105100",
+    "2223003122003222",
+    "378282246310005",
+    "371449635398431",
+    "6011111111111117",
+    "3530111333300000",
+];
+function pad(n, width) {
+    return String(n).padStart(width, "0");
+}
+function generateValue(type, rng, row, formatValid) {
+    switch (type) {
+        case "email":
+            return formatValid
+                ? `user${row}@${pick(rng, EMAIL_DOMAINS)}`
+                : `test_${pad(row, 6)}@example.invalid`;
+        case "domain":
+            return `host${row}.invalid`;
+        case "ipv4": {
+            const block = pick(rng, IPV4_BLOCKS);
+            return `${block[0]}.${block[1]}.${block[2]}.${intBetween(rng, 1, 254)}`;
+        }
+        case "ipv6": {
+            // Split the counter across two hextets so it never overflows a single hextet
+            // (>0xffff) and always stays inside the RFC 3849 2001:db8::/32 documentation prefix.
+            const hi = (row >>> 16) & 0xffff;
+            const lo = row & 0xffff;
+            return hi ? `2001:db8::${hi.toString(16)}:${lo.toString(16)}` : `2001:db8::${lo.toString(16)}`;
+        }
+        case "phone": {
+            const line = pad(intBetween(rng, 100, 199), 4);
+            if (formatValid) {
+                const npa = intBetween(rng, 200, 989);
+                return `(${npa}) 555-${line}`;
+            }
+            return `555-${line}`;
+        }
+        case "ssn": {
+            const area = pick(rng, SSN_INVALID_AREAS);
+            const group = pad(intBetween(rng, 1, 99), 2);
+            const serial = pad(intBetween(rng, 1, 9999), 4);
+            return `${area}-${group}-${serial}`;
+        }
+        case "creditCard":
+            return pick(rng, CARD_TEST_NUMBERS);
+        case "firstName":
+            return `TEST_Firstname_${pad(row, 6)}`;
+        case "lastName":
+            return `TEST_Lastname_${pad(row, 6)}`;
+        case "fullName":
+            return `TEST_Person_${pad(row, 6)}`;
+        case "streetAddress":
+            return `${row} Example ${pick(rng, STREET_SUFFIX)}`;
+        case "freeText":
+            return `TEST_Text_${pad(row, 6)}`;
+    }
+}
+export function generate(opts) {
+    const formatValid = opts.formatValid ?? true;
+    const rng = mulberry32(opts.seed);
+    const columns = opts.schema.map((f) => f.name);
+    const rows = [];
+    for (let i = 0; i < opts.rows; i++) {
+        const row = [];
+        for (const field of opts.schema) {
+            row.push(generateValue(field.type, rng, i + 1, formatValid));
+        }
+        rows.push(row);
+    }
+    return {
+        columns,
+        rows,
+        schema: opts.schema,
+        seed: opts.seed,
+        catalogVersion: CATALOG_VERSION,
+    };
+}
+//# sourceMappingURL=generate.js.map

package/dist/generate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate.js","sourceRoot":"","sources":["../src/generate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AA8BxD,MAAM,aAAa,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,aAAa,CAAU,CAAC;AAC7E,MAAM,WAAW,GAAG;IAClB,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC;IACd,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC;CACL,CAAC;AACX,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AAC5F,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAU,CAAC;AAClE,MAAM,iBAAiB,GAAG;IACxB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,iBAAiB;IACjB,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;CACV,CAAC;AAEX,SAAS,GAAG,CAAC,CAAS,EAAE,KAAa;IACnC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,aAAa,CAAC,IAAe,EAAE,GAAiB,EAAE,GAAW,EAAE,WAAoB;IAC1F,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,OAAO;YACV,OAAO,WAAW;gBAChB,CAAC,CAAC,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE;gBAC1C,CAAC,CAAC,QAAQ,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,kBAAkB,CAAC;QAC5C,KAAK,QAAQ;YACX,OAAO,OAAO,GAAG,UAAU,CAAC;QAC9B,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YACrC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAC1E,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,6EAA6E;YAC7E,qFAAqF;YACrF,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC;YACjC,MAAM,EAAE,GAAG,GAAG,GAAG,MAAM,CAAC;YACxB,OAAO,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QACjG,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/C,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;gBACtC,OAAO,IAAI,GAAG,SAAS,IAAI,EAAE,CAAC;YAChC,CAAC;YACD,OAAO,OAAO,IAAI,EAAE,CAAC;QACvB,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAChD,OAAO,GAAG,IAAI,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;QACtC,CAAC;QACD,KAAK,YAAY;YACf,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACtC,KAAK,WAAW;YACd,OAAO,kBAAkB,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;QACzC,KAAK,UAAU;YACb,OAAO,iBAAiB,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;QACxC,KAAK,UAAU;YACb,OAAO,eAAe,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;QACtC,KAAK,eAAe;YAClB,OAAO,GAAG,GAAG,YAAY,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,CAAC;QACtD,KAAK,UAAU;YACb,OAAO,aAAa,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACtC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAqB;IAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;IAC7C,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,OAAO;QACL,OAAO;QACP,IAAI;QACJ,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,cAAc,EAAE,eAAe;KAChC,CAAC;AACJ,CAAC"}

package/dist/hash.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Isomorphic SHA-256 over the Web Crypto API.
+ *
+ * `crypto.subtle` is provided by the platform in both modern Node (>=18) and
+ * browsers, so SafeSeed needs no hashing dependency to bundle or audit. The hash
+ * is used for the *tamper-evident run record* — it proves a file is byte-for-byte
+ * the one that was generated, not that the file is free of personal data.
+ */
+export declare function sha256Hex(input: string): Promise<string>;
+//# sourceMappingURL=hash.d.ts.map

package/dist/hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../src/hash.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM9D"}

package/dist/hash.js

@@ -0,0 +1,16 @@
+/**
+ * Isomorphic SHA-256 over the Web Crypto API.
+ *
+ * `crypto.subtle` is provided by the platform in both modern Node (>=18) and
+ * browsers, so SafeSeed needs no hashing dependency to bundle or audit. The hash
+ * is used for the *tamper-evident run record* — it proves a file is byte-for-byte
+ * the one that was generated, not that the file is free of personal data.
+ */
+export async function sha256Hex(input) {
+    const bytes = new TextEncoder().encode(input);
+    const digest = await crypto.subtle.digest("SHA-256", bytes);
+    return Array.from(new Uint8Array(digest))
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("");
+}
+//# sourceMappingURL=hash.js.map

package/dist/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../src/hash.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa;IAC3C,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * SafeSeed — confirmably-synthetic test data by construction.
+ *
+ * Generate safe-by-construction test data from standards-reserved ranges, bind a
+ * tamper-evident run record to it, verify a file stays in range, and scan existing
+ * data for leaked real PII. Pure TypeScript, zero runtime dependencies, isomorphic
+ * (Node >=18 and browsers).
+ */
+export type { Tier, FieldType } from "./types.js";
+export { CATALOG, CATALOG_VERSION, getEntry, isReserved, isSelfEvidentlyFake, type CatalogEntry, type ReservedSpec, } from "./catalog.js";
+export { generate, type FieldSchema, type GenerateOptions, type GeneratedDataset, } from "./generate.js";
+export { makeRunRecord, ATTESTATION, SAFESEED_VERSION, type RunRecord, type FieldRecord, } from "./record.js";
+export { verify, exitCode, type VerifyResult, type VerifyFailure, type VerifyFailureKind, type VerifyOptions, } from "./verify.js";
+export { scan, type ScanColumn, type ScanOptions, type ScanResult, type ScanFinding, } from "./scan.js";
+export { toCsv, parseCsv, canonicalColumn } from "./csv.js";
+export { sha256Hex } from "./hash.js";
+export { luhnValid } from "./luhn.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAElD,OAAO,EACL,OAAO,EACP,eAAe,EACf,QAAQ,EACR,UAAU,EACV,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,YAAY,GAClB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,QAAQ,EACR,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,MAAM,EACN,QAAQ,EACR,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,IAAI,EACJ,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,WAAW,GACjB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -0,0 +1,9 @@
+export { CATALOG, CATALOG_VERSION, getEntry, isReserved, isSelfEvidentlyFake, } from "./catalog.js";
+export { generate, } from "./generate.js";
+export { makeRunRecord, ATTESTATION, SAFESEED_VERSION, } from "./record.js";
+export { verify, exitCode, } from "./verify.js";
+export { scan, } from "./scan.js";
+export { toCsv, parseCsv, canonicalColumn } from "./csv.js";
+export { sha256Hex } from "./hash.js";
+export { luhnValid } from "./luhn.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,OAAO,EACP,eAAe,EACf,QAAQ,EACR,UAAU,EACV,mBAAmB,GAGpB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,QAAQ,GAIT,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,aAAa,EACb,WAAW,EACX,gBAAgB,GAGjB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,MAAM,EACN,QAAQ,GAKT,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,IAAI,GAKL,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC"}

package/dist/luhn.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Luhn checksum. Used only to confirm that designated card *test* numbers pass
+ * the same validation a real card would — which is exactly why they sit in the
+ * `designated-test-only` tier and not `provably-non-real`: passing Luhn is the
+ * point, so the value is valid-looking, not impossible.
+ */
+export declare function luhnValid(digits: string): boolean;
+//# sourceMappingURL=luhn.d.ts.map

package/dist/luhn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"luhn.d.ts","sourceRoot":"","sources":["../src/luhn.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAcjD"}

package/dist/luhn.js

@@ -0,0 +1,24 @@
+/**
+ * Luhn checksum. Used only to confirm that designated card *test* numbers pass
+ * the same validation a real card would — which is exactly why they sit in the
+ * `designated-test-only` tier and not `provably-non-real`: passing Luhn is the
+ * point, so the value is valid-looking, not impossible.
+ */
+export function luhnValid(digits) {
+    if (!/^\d+$/.test(digits))
+        return false;
+    let sum = 0;
+    let double = false;
+    for (let i = digits.length - 1; i >= 0; i--) {
+        let d = digits.charCodeAt(i) - 48;
+        if (double) {
+            d *= 2;
+            if (d > 9)
+                d -= 9;
+        }
+        sum += d;
+        double = !double;
+    }
+    return sum % 10 === 0;
+}
+//# sourceMappingURL=luhn.js.map

package/dist/luhn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"luhn.js","sourceRoot":"","sources":["../src/luhn.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAClC,IAAI,MAAM,EAAE,CAAC;YACX,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,CAAC,GAAG,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,GAAG,IAAI,CAAC,CAAC;QACT,MAAM,GAAG,CAAC,MAAM,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AACxB,CAAC"}

package/dist/net.d.ts

@@ -0,0 +1,16 @@
+/**
+ * IP address membership helpers, so the catalog can say "this value is inside a
+ * standards-reserved block" precisely rather than by string prefix.
+ */
+/** Parse a dotted-quad IPv4 string to an unsigned 32-bit int, or null if invalid. */
+export declare function ipv4ToInt(ip: string): number | null;
+/** True if `ip` falls inside the given IPv4 CIDR block (e.g. "192.0.2.0/24"). */
+export declare function ipv4InCidr(ip: string, cidr: string): boolean;
+/**
+ * Expand an IPv6 string to its 8 hextets (numbers), handling a single "::"
+ * abbreviation and an optional zone id. Returns null if malformed.
+ */
+export declare function expandIpv6(ip: string): number[] | null;
+/** True if `ip` falls inside the given IPv6 prefix (e.g. "2001:db8::/32"). */
+export declare function ipv6InPrefix(ip: string, prefixCidr: string): boolean;
+//# sourceMappingURL=net.d.ts.map

package/dist/net.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"net.d.ts","sourceRoot":"","sources":["../src/net.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,qFAAqF;AACrF,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWnD;AAED,iFAAiF;AACjF,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAS5D;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAgCtD;AAED,8EAA8E;AAC9E,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAepE"}