text-sanctifier 1.3.8 → 1.3.10

package/bin/text-sanctifier.js

@@ -14,10 +14,13 @@ import { readFileSync, writeFileSync, statSync, readdirSync, existsSync } from '
 import { resolve, join, sep, relative } from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { pathToFileURL } from 'node:url';
+import { createHash } from 'node:crypto';
 import { inspectTextDetailed, summonSanctifier, revealInvisible } from '../src/index.js';
 import { getNewlineStats } from '../src/inspectText.js';
 import { SPACE_LOOKALIKES_REGEX } from '../src/sanctifyText.js';
-import { findHiddenRuns } from '../src/hiddenText.js';
+import { scanHiddenSpans } from '../src/hiddenScan.js';
+import { inspectTextInContext } from '../src/context.js';
+import { classifyCodeUnit, classifyAstral } from '../src/categories.generated.js';
 
 const VERSION = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
 
@@ -46,6 +49,7 @@ fix options:
   --normalize-spaces   replace look-alike spaces (NBSP, narrow NBSP, typographic
                        spaces) with an ordinary space instead of removing them
   --purge-invisible    remove zero-width, non-breaking space, bidi and BOM characters
+  --keep-benign        keep contextually legitimate joiners and selectors when purging
   --nuke-controls      remove C0/C1 control characters and bidi controls
   --normalize-newlines convert CRLF and CR to LF
   --strip-bom          also remove a BOM at the start of a file (kept by default)
@@ -86,11 +90,12 @@ const BOOLEAN_FLAGS = {
     '--strip-bom': 'stripBom',
     '--normalize-spaces': 'normalizeSpaces',
     '--purge-invisible': 'purgeInvisible',
+    '--keep-benign': 'keepBenign',
     '--nuke-controls': 'nukeControls',
     '--normalize-newlines': 'normalizeNewlines',
     '--dry-run': 'dryRun',
 };
-const FIX_ONLY_FLAGS = new Set(['normalizeSpaces', 'purgeInvisible', 'nukeControls', 'normalizeNewlines', 'dryRun']);
+const FIX_ONLY_FLAGS = new Set(['normalizeSpaces', 'purgeInvisible', 'keepBenign', 'nukeControls', 'normalizeNewlines', 'dryRun']);
 const CHECK_ONLY_FLAGS = new Set(['aiConfig']);
 const FORMATS = new Set(['text', 'json', 'sarif']);
 
@@ -106,6 +111,7 @@ function parseArgs(argv) {
         stripBom: false,
         normalizeSpaces: false,
         purgeInvisible: false,
+        keepBenign: false,
         nukeControls: false,
         normalizeNewlines: false,
         dryRun: false,
@@ -378,18 +384,22 @@ function collectInputs(args, cwd, warn, aiConfig = false) {
 // --- Reading ---
 
 const utf8 = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+const utf8Lenient = new TextDecoder('utf-8', { ignoreBOM: true });
 
 /**
- * Decodes UTF-8, keeping a leading BOM. Returns null for binary or non-UTF-8 data.
+ * Decodes UTF-8, keeping a leading BOM. With `sniff`, data with a NUL in its first
+ * BINARY_SNIFF_BYTES is binary and not decoded. Bytes that are not UTF-8 become U+FFFD
+ * and set `lossy`, so one bad byte cannot hide the rest of a file from `check`.
  * @param {Uint8Array} bytes
- * @returns {{ text: string|null, reason?: string }}
+ * @param {boolean} sniff
+ * @returns {{ text: string|null, reason?: string, lossy?: boolean }}
  */
-function decode(bytes) {
-    if (bytes.subarray(0, BINARY_SNIFF_BYTES).includes(0)) return { text: null, reason: 'binary' };
+function decode(bytes, sniff) {
+    if (sniff && bytes.subarray(0, BINARY_SNIFF_BYTES).includes(0)) return { text: null, reason: 'binary' };
     try {
         return { text: utf8.decode(bytes) };
     } catch {
-        return { text: null, reason: 'not UTF-8' };
+        return { text: utf8Lenient.decode(bytes), lossy: true };
     }
 }
 
@@ -454,46 +464,56 @@ const RUN_NOUNS = { tag: 'tag character', variation_selector: 'variation selecto
  * @param {boolean} stripBom
  */
 function inspectAiConfig(text, maxFindings, stripBom) {
-    const full = inspect(text, Infinity, stripBom);
-    const { runs, benign } = findHiddenRuns(text);
-
-    const kept = [];
-    let b = 0;
-    for (const f of full.findings) {
-        while (b < benign.length && benign[b][1] <= f.offset) b++;
-        if (b < benign.length && benign[b][0] <= f.offset) { full.counts[f.category]--; continue; }
-        kept.push(f);
-    }
-
-    // Every run character is a finding, so each run starts at a kept finding
-    const hiddenRuns = [];
+    const full = inspect(text, 0, stripBom);
+    const findings = [];
     const loose = [];
-    let r = 0;
-    for (const f of kept) {
-        while (r < runs.length && runs[r].end <= f.offset) r++;
-        const run = runs[r];
-        if (!run || f.offset < run.offset) { loose.push(f); continue; }
-        if (f.offset !== run.offset) continue;
-        const entry = { kind: run.kind, offset: run.offset, line: f.line, column: f.column, codePoint: f.codePoint, count: run.count };
+    let looseCount = 0;
+    let position = 0, line = 1, lineStart = 0;
+    const scan = (end, inRun, benign) => {
+        while (position < end) {
+            const offset = position;
+            const codePoint = text.codePointAt(position);
+            position += codePoint > 0xFFFF ? 2 : 1;
+            if (codePoint === 10 || (codePoint === 13 && text.charCodeAt(position) !== 10)) {
+                line++; lineStart = position; continue;
+            }
+            const category = codePoint > 0xFFFF ? classifyAstral(codePoint) : classifyCodeUnit(codePoint);
+            if (!category || (offset === 0 && codePoint === BOM && !stripBom)) continue;
+            if (benign) { full.counts[category]--; full.total--; continue; }
+            if (findings.length < maxFindings || (!inRun && loose.length < maxFindings)) {
+                const f = { offset, line, column: offset - lineStart + 1, codePoint, category };
+                if (category === 'bom') f.atStart = offset === 0;
+                if (findings.length < maxFindings) findings.push(f);
+                if (!inRun && loose.length < maxFindings) loose.push(f);
+            }
+            if (!inRun) looseCount++;
+        }
+    };
+    // Decode beyond the cut point by one marker so slicing matches the original output.
+    const hidden = scanHiddenSpans(text, { maxRuns: maxFindings, maxDecodedLength: MAX_DECODED + 10 }, (span) => {
+        scan(span.offset, false, false);
+        scan(span.end, !span.benign, span.benign);
+    });
+    scan(text.length, false, false);
+    const hiddenRuns = hidden.runs.map((run) => {
+        const entry = { kind: run.kind, offset: run.offset, line: run.line, column: run.column, codePoint: text.codePointAt(run.offset), count: run.count };
         if (run.decoded !== undefined) {
             entry.decoded = run.decoded.slice(0, MAX_DECODED);
-            entry.decodedTruncated = run.decoded.length > MAX_DECODED;
+            entry.decodedTruncated = run.decodedTruncated || run.decoded.length > MAX_DECODED;
         }
-        hiddenRuns.push(entry);
-    }
-
-    const findings = kept.slice(0, maxFindings);
+        return entry;
+    });
     return {
         report: {
             ...full,
             findings,
-            total: kept.length,
-            truncated: kept.length > findings.length,
-            hiddenRuns: hiddenRuns.slice(0, maxFindings),
-            hiddenRunCount: hiddenRuns.length,
+            truncated: full.total > findings.length,
+            hiddenRuns,
+            hiddenRunCount: hidden.total,
         },
         hiddenRuns,
         loose,
+        entryCount: hidden.total + looseCount,
     };
 }
 
@@ -526,6 +546,30 @@ const CATEGORY_RULES = {
 const SARIF_SCHEMA = 'https://json.schemastore.org/sarif-2.1.0.json';
 const INFORMATION_URI = 'https://github.com/iWhatty/text-sanctifier';
 const ABSOLUTE_PATH = /^(?:[a-zA-Z]:)?[\\/]/;
+const fingerprints = new WeakMap();
+
+function fingerprintFindings(label, text, findings, cwd) {
+    const path = label === STDIN_LABEL ? 'stdin' : toSlash(relative(cwd, resolve(cwd, label)));
+    let previousLine = 0, start = 0, end = 0;
+    let occurrences = new Map();
+    const hashOccurrences = new Map();
+    for (const finding of findings) {
+        if (finding.line !== previousLine) {
+            start = finding.offset - finding.column + 1;
+            end = start;
+            while (end < text.length && text.charCodeAt(end) !== 10 && text.charCodeAt(end) !== 13) end++;
+            occurrences = new Map();
+            previousLine = finding.line;
+        }
+        const index = occurrences.get(finding.category) || 0;
+        occurrences.set(finding.category, index + 1);
+        const hash = createHash('sha256').update(JSON.stringify([finding.category, path, text.slice(start, end), index])).digest('hex');
+        const count = (hashOccurrences.get(hash) || 0) + 1;
+        hashOccurrences.set(hash, count);
+        fingerprints.set(finding, count === 1 ? hash :
+            createHash('sha256').update(JSON.stringify([hash, count])).digest('hex'));
+    }
+}
 
 /** @param {string} label */
 function sarifArtifact(label) {
@@ -555,6 +599,7 @@ function sarifLog(files, { cwd, total, filesScanned, skipped, succeeded }) {
             const run = runAt.get(x.offset);
             results.push({
                 ruleId: x.category,
+                partialFingerprints: { 'textSanctifier/v1': fingerprints.get(x) },
                 ruleIndex: ruleIds.indexOf(x.category),
                 level: CATEGORY_RULES[x.category][0],
                 message: { text: `${hex(x.codePoint)} ${x.category}${run ? `, start of a ${describeRun(run)}` : ''}` },
@@ -612,6 +657,8 @@ async function main(argv) {
 
     const cwd = process.cwd();
     let paths = opts.paths;
+    // --ai-config with no paths searches the current directory even when stdin is not a
+    // terminal, so a CI job with no stdin still scans the repository; `-` reads stdin.
     if (paths.length === 0 && opts.aiConfig) {
         paths = ['.'];
     } else if (paths.length === 0) {
@@ -627,6 +674,8 @@ async function main(argv) {
     let errors = pathErrors;
     /** @type {Array<{ path: string, reason: string }>} */
     const skipped = [];
+    /** @type {string[]} */
+    const notUtf8 = [];
 
     /**
      * Reads every input in order, calling `visit(label, text, input)` for each decodable one.
@@ -643,12 +692,24 @@ async function main(argv) {
                 errors++;
                 continue;
             }
-            const { text, reason } = decode(bytes);
+            // Files that look binary are skipped. Stdin and AI configuration files are text
+            // by intent, so a NUL in one is a finding, not a reason to skip it.
+            const { text, reason, lossy } = decode(bytes, input.path !== STDIN && !opts.aiConfig);
             if (text === null) {
                 skipped.push({ path: label, reason });
                 if (input.explicit) warn(`${label}: skipped (${reason})`);
                 continue;
             }
+            if (lossy) {
+                // fix never rewrites bytes it could not decode
+                if (opts.command === 'fix') {
+                    skipped.push({ path: label, reason: 'not UTF-8' });
+                    warn(`${label}: skipped (not UTF-8)`);
+                    continue;
+                }
+                notUtf8.push(label);
+                warn(`${label}: not valid UTF-8; checked with invalid bytes read as U+FFFD`);
+            }
             visit(label, text, input);
         }
     };
@@ -669,16 +730,18 @@ async function main(argv) {
                 const report = inspect(text, opts.maxFindings, opts.stripBom);
                 total += report.total;
                 if (report.total === 0) return;
+                if (opts.format === 'sarif') fingerprintFindings(label, text, report.findings, cwd);
                 files.push({ path: label, ...report });
                 for (const x of report.findings) lines.push(findingLine(label, x));
                 if (report.truncated) lines.push(`${label}: ${report.total - report.findings.length} more not listed (--max-findings)`);
                 return;
             }
 
-            const { report, hiddenRuns, loose } = inspectAiConfig(text, opts.maxFindings, opts.stripBom);
+            const { report, hiddenRuns, loose, entryCount } = inspectAiConfig(text, opts.maxFindings, opts.stripBom);
             total += report.total;
             hiddenRunCount += report.hiddenRunCount;
             if (report.total === 0) return;
+            if (opts.format === 'sarif') fingerprintFindings(label, text, report.findings, cwd);
             files.push({ path: label, ...report });
             // Text output lists each run once, in place of its characters
             const entries = [
@@ -686,19 +749,22 @@ async function main(argv) {
                 ...loose.map((x) => ({ offset: x.offset, text: findingLine(label, x) })),
             ].sort((a, b) => a.offset - b.offset);
             for (const e of entries.slice(0, opts.maxFindings)) lines.push(e.text);
-            if (entries.length > opts.maxFindings) lines.push(`${label}: ${entries.length - opts.maxFindings} more not listed (--max-findings)`);
+            if (entryCount > opts.maxFindings) lines.push(`${label}: ${entryCount - opts.maxFindings} more not listed (--max-findings)`);
         });
 
         const kind = opts.aiConfig ? 'AI configuration file' : 'file';
         if (opts.format === 'json') {
-            const summary = { files, total, filesScanned: scanned, filesWithFindings: files.length, skipped };
+            const summary = { files, total, filesScanned: scanned, filesWithFindings: files.length, skipped, notUtf8 };
             if (opts.aiConfig) summary.hiddenRunCount = hiddenRunCount;
             out(JSON.stringify(summary, null, 2));
         } else if (opts.format === 'sarif') {
             out(JSON.stringify(sarifLog(files, { cwd, total, filesScanned: scanned, skipped, succeeded: errors === 0 }), null, 2));
         } else {
             for (const line of lines) out(line);
-            if (opts.aiConfig && scanned === 0 && skipped.length === 0) out('No AI configuration files found.');
+            if (opts.aiConfig && scanned === 0 && skipped.length === 0) {
+                out('No AI configuration files found.');
+                if (opts.paths.length === 0 && !process.stdin.isTTY) out('To check piped text, pass "-": text-sanctifier check --ai-config -');
+            }
             else if (total === 0) out(`No ${opts.aiConfig ? 'hidden text, ' : ''}invisible or control characters in ${plural(scanned, kind)}.`);
             else out(`${plural(total, 'finding')}${opts.aiConfig ? ` (${plural(hiddenRunCount, 'hidden run')})` : ''} in ${files.length} of ${plural(scanned, kind)}.`);
         }
@@ -734,7 +800,21 @@ async function main(argv) {
         scanned++;
         // The BOM at offset 0 is set aside so purgeInvisibleChars cannot take it
         const leadingBom = text.charCodeAt(0) === BOM;
-        let cleaned = clean(leadingBom ? text.slice(1) : text);
+        const body = leadingBom ? text.slice(1) : text;
+        let cleaned;
+        if (opts.keepBenign && opts.purgeInvisible) {
+            const benign = inspectTextInContext(body, { maxFindings: Infinity }).findings.filter((f) => f.benign);
+            let start = 0;
+            const parts = [];
+            for (const f of benign) {
+                parts.push(clean(body.slice(start, f.offset)));
+                const end = f.offset + (f.codePoint > 0xFFFF ? 2 : 1);
+                parts.push(body.slice(f.offset, end));
+                start = end;
+            }
+            parts.push(clean(body.slice(start)));
+            cleaned = parts.join('');
+        } else cleaned = clean(body);
         if (leadingBom && !opts.stripBom) cleaned = String.fromCharCode(BOM) + cleaned;
 
         if (input.path === STDIN && !opts.dryRun) process.stdout.write(cleaned);

package/dist/text-sanctifier.min.js

@@ -3,4 +3,4 @@ var y=/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F\u061C\u200E\u200F\u2
 `){return e.replace(Q,r)}var re=/[ \t]*(\n+)[ \t]*/g;function ne(e){return e.replace(re,"$1")}var te=/\n{2,}/g,ie=/\n{3,}/g;function oe(e,r){return r?e.replace(ie,`
 
 `):e.replace(te,`
-`)}var ue=/ {2,}/g;function se(e){return e.replace(ue," ")}function le(e){return e.replace(y,"")}function ae(e,r={}){if(typeof e!="string")throw new TypeError("revealInvisible expects a string input.");let n=r&&typeof r.format=="function"?r.format:i=>"<U+"+i.toString(16).toUpperCase().padStart(4,"0")+">",u="",o=0;for(let i of C(e,{maxFindings:1/0}).findings)u+=e.slice(o,i.offset)+n(i.codePoint,i.category),o=i.offset+(i.codePoint>65535?2:1);return u+e.slice(o)}var fe="1.3.8";export{fe as VERSION,b as getNewlineStats,K as getRecommendedSanctifierOptions,j as inspectText,C as inspectTextDetailed,ae as revealInvisible,T as sanctifyKeyboardOnly,N as sanctifyKeyboardOnlyEmoji,w as sanctifyLoose,L as sanctifyPasted,R as sanctifyStrict,W as summonSanctifier};
+`)}var ue=/ {2,}/g;function se(e){return e.replace(ue," ")}function le(e){return e.replace(y,"")}function ae(e,r={}){if(typeof e!="string")throw new TypeError("revealInvisible expects a string input.");let n=r&&typeof r.format=="function"?r.format:i=>"<U+"+i.toString(16).toUpperCase().padStart(4,"0")+">",u="",o=0;for(let i of C(e,{maxFindings:1/0}).findings)u+=e.slice(o,i.offset)+n(i.codePoint,i.category),o=i.offset+(i.codePoint>65535?2:1);return u+e.slice(o)}var fe="1.3.10";export{fe as VERSION,b as getNewlineStats,K as getRecommendedSanctifierOptions,j as inspectText,C as inspectTextDetailed,ae as revealInvisible,T as sanctifyKeyboardOnly,N as sanctifyKeyboardOnlyEmoji,w as sanctifyLoose,L as sanctifyPasted,R as sanctifyStrict,W as summonSanctifier};

package/dist/types/hiddenScan.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Decodes text[start, end) as decodeTagText does, stopping before the output would
+ * pass `limit` UTF-16 units. A `<U+XXXX>` marker is written whole or not at all.
+ * @param {string} text
+ * @param {number} start
+ * @param {number} end
+ * @param {number} limit
+ * @returns {{ decoded: string, truncated: boolean }}
+ */
+export function decodeRange(text: string, start: number, end: number, limit: number): {
+    decoded: string;
+    truncated: boolean;
+};
+/**
+ * @param {string} text
+ * @param {HiddenScanOptions} [options]
+ * @param {(span: {offset: number, end: number, benign: boolean, kind: HiddenRunKind}) => void} [onSpan] - internal streaming visitor
+ * @returns {HiddenTextScan}
+ */
+export function scanHiddenSpans(text: string, options?: HiddenScanOptions, onSpan?: (span: {
+    offset: number;
+    end: number;
+    benign: boolean;
+    kind: HiddenRunKind;
+}) => void): HiddenTextScan;
+export type HiddenRunKind = import("./hiddenText.js").HiddenRunKind;
+export type HiddenRun = import("./hiddenText.js").HiddenRun;
+export type HiddenRunCounts = import("./hiddenText.js").HiddenRunCounts;
+export type HiddenTextScan = import("./hiddenText.js").HiddenTextScan;
+export type HiddenScanOptions = import("./hiddenText.js").HiddenScanOptions;

package/dist/types/hiddenText.d.ts

@@ -1,3 +1,43 @@
+/** @typedef {'tag' | 'variation_selector' | 'invisible_operator' | 'reserved_tag_plane'} HiddenRunKind */
+/**
+ * @typedef {Object} HiddenRun
+ * @property {HiddenRunKind} kind
+ * @property {number} offset - UTF-16 index of the first character
+ * @property {number} end - UTF-16 index just past the last character
+ * @property {number} count - number of code points in the run
+ * @property {number} line - 1-based line of the first character (as in inspectTextDetailed)
+ * @property {number} column - 1-based column of the first character, in UTF-16 units
+ * @property {string} [decoded] - tag runs only: the ASCII the tags spell (see decodeTagText),
+ *   at most `maxDecodedLength` UTF-16 units
+ * @property {boolean} [decodedTruncated] - tag runs only: true when `decoded` stops short of the run
+ */
+/**
+ * @typedef {Object} HiddenRunCounts
+ * @property {number} tag
+ * @property {number} variation_selector
+ * @property {number} invisible_operator
+ * @property {number} reserved_tag_plane
+ */
+/**
+ * @typedef {Object} HiddenTextScan
+ * @property {HiddenRun[]} runs - runs that may hide text, in order, at most `maxRuns` long
+ * @property {Array<[number, number]>} benign - [offset, end) spans of legitimate
+ *   sequences (subdivision flags, a single emoji or text presentation selector), at most `maxRuns` long
+ * @property {HiddenRunCounts} counts - every run per kind, listed or not
+ * @property {HiddenRunCounts} codePointCounts - code points in those runs per kind, listed or not
+ * @property {number} supplementarySelectorCount - code points U+E0100–U+E01EF in those runs, which
+ *   (unlike the emoji selectors U+FE00–U+FE0F) can carry data; included in codePointCounts.variation_selector
+ * @property {number} total - sum of `counts`
+ * @property {number} benignTotal - every benign span, listed or not
+ * @property {boolean} truncated - true when runs or benign spans were left out of the lists
+ */
+/**
+ * @typedef {Object} HiddenScanOptions
+ * @property {number} [maxRuns=Infinity] - cap on listed runs, and separately on listed benign spans
+ *   (non-negative integer or Infinity). Counts stay exact.
+ * @property {number} [maxDecodedLength=Infinity] - cap on each run's `decoded` text, in UTF-16 units.
+ *   For both, any other value (negative, fractional, NaN, a string) means the default, no cap.
+ */
 /**
  * Decodes tag characters to the ASCII they shadow: U+E0020–U+E007E become
  * U+0020–U+007E. Anything else (U+E0001 LANGUAGE TAG, U+E007F CANCEL TAG, unassigned
@@ -13,7 +53,10 @@ export function decodeTagText(text: string): string;
  * legitimate and listed under `benign` instead of `runs`:
  *  - the subdivision flags of England, Scotland and Wales: U+1F3F4 followed by the
  *    tags for "gbeng", "gbsct" or "gbwls" and U+E007F
- *  - a single U+FE0E or U+FE0F (text or emoji presentation) after another character
+ *  - a single U+FE0E or U+FE0F (text or emoji presentation) after an
+ *    Extended_Pictographic character, or between #, * or a digit and U+20E3 (a keycap),
+ *    the same rule as text-sanctifier/context. After a letter it is a run: one selector
+ *    per letter can carry a bit each.
  *
  * `line` and `column` are counted as in inspectTextDetailed. Every run and benign
  * span is counted; only the first `maxRuns` of each are listed. With the caps set,

package/dist/types/sanctifyText.d.ts

@@ -52,7 +52,7 @@ export function sanctifyPasted(text: string): string;
  * Brutal text normalizer and invisible trash scrubber,
  * configurable to kill whatever ghosts you want dead.
  *
- * ⚠️ Note: This is plain-text normalization/filtering — not an HTML/XSS sanitizer.
+ * Note: This is plain-text normalization/filtering — not an HTML/XSS sanitizer.
  *
  * @param {string} text
  * @param {boolean} [purgeInvisibleChars=false] - Remove ZWSP, NBSP, bidi, tags, variation selectors, etc.

package/dist/types/version.generated.d.ts

@@ -1,2 +1,2 @@
 /** The installed version of text-sanctifier, as in its package.json. */
-export const VERSION: "1.3.8";
+export const VERSION: "1.3.10";

package/package.json

@@ -1,83 +1,89 @@
-{
-  "name": "text-sanctifier",
-  "version": "1.3.8",
-  "type": "module",
-  "description": "A brutal text normalizer and invisible trash scrubber for modern web projects.",
-  "engines": {
-    "node": ">=18"
-  },
-  "main": "./src/index.js",
-  "module": "./src/index.js",
-  "browser": "./dist/text-sanctifier.min.js",
-  "bin": {
-    "text-sanctifier": "bin/text-sanctifier.js"
-  },
-  "files": [
-    "src",
-    "bin",
-    "dist/text-sanctifier.min.js",
-    "dist/types",
-    "LICENSE",
-    "README.md",
-    "ADDITIONAL_TERMS.md",
-    "robots.txt"
-  ],
-  "exports": {
-    ".": {
-      "types": "./dist/types/index.d.ts",
-      "default": "./src/index.js"
-    },
-    "./hidden": {
-      "types": "./dist/types/hiddenText.d.ts",
-      "default": "./src/hiddenText.js"
-    },
-    "./context": {
-      "types": "./dist/types/context.d.ts",
-      "default": "./src/context.js"
-    },
-    "./browser": {
-      "types": "./dist/types/index.d.ts",
-      "default": "./dist/text-sanctifier.min.js"
-    }
-  },
-  "types": "./dist/types/index.d.ts",
-  "sideEffects": false,
-  "scripts": {
-    "gen": "node scripts/gen-categories.js && node scripts/gen-version.js && node scripts/gen-virama.js",
-    "gen:check": "node scripts/gen-categories.js --check && node scripts/gen-version.js --check && node scripts/gen-virama.js --check",
-    "build": "node scripts/build.js",
-    "build:types": "tsc -p tsconfig.types.json",
-    "test:types": "tsc -p tests/types/tsconfig.json",
-    "test": "node tests/sanctifyText.test.js && node tests/inspectTextDetailed.test.js && node --expose-gc tests/hiddenText.test.js && node --expose-gc tests/context.test.js && node tests/cli.test.js",
-    "test-min": "node tests/sanctifyText.test.min.js",
-    "ci": "npm run gen:check && npm run test && npm run build && npm run size && npm run build:types && npm run test:types && npm run test-min",
-    "size": "node scripts/check-size.js"
-  },
-  "keywords": [
-    "text",
-    "sanitize",
-    "normalize",
-    "invisible",
-    "scrubber",
-    "unicode",
-    "clean",
-    "sanctify"
-  ],
-  "author": "WATT3D <WATT3D@protonmail.com>",
-  "license": "SEE LICENSE IN LICENSE",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/iWhatty/text-sanctifier.git"
-  },
-  "bugs": {
-    "url": "https://github.com/iWhatty/text-sanctifier/issues"
-  },
-  "homepage": "https://github.com/iWhatty/text-sanctifier#readme",
-  "directories": {
-    "test": "tests"
-  },
-  "devDependencies": {
-    "esbuild": "^0.25.3",
-    "typescript": "^5.9.3"
-  }
-}
+{
+  "name": "text-sanctifier",
+  "version": "1.3.10",
+  "type": "module",
+  "description": "Find and remove invisible Unicode in web input, model-bound text and repositories.",
+  "engines": {
+    "node": ">=18"
+  },
+  "main": "./src/index.js",
+  "module": "./src/index.js",
+  "browser": "./dist/text-sanctifier.min.js",
+  "bin": {
+    "text-sanctifier": "bin/text-sanctifier.js"
+  },
+  "files": [
+    "src",
+    "bin",
+    "dist/text-sanctifier.min.js",
+    "dist/types",
+    "LICENSE",
+    "README.md",
+    "ADDITIONAL_TERMS.md",
+    "robots.txt"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/types/index.d.ts",
+      "default": "./src/index.js"
+    },
+    "./hidden": {
+      "types": "./dist/types/hiddenText.d.ts",
+      "default": "./src/hiddenText.js"
+    },
+    "./context": {
+      "types": "./dist/types/context.d.ts",
+      "default": "./src/context.js"
+    },
+    "./browser": {
+      "types": "./dist/types/index.d.ts",
+      "default": "./dist/text-sanctifier.min.js"
+    }
+  },
+  "types": "./dist/types/index.d.ts",
+  "sideEffects": false,
+  "scripts": {
+    "gen": "node scripts/gen-categories.js && node scripts/gen-version.js && node scripts/gen-virama.js && node scripts/gen-docs.js",
+    "gen:check": "node scripts/gen-categories.js --check && node scripts/gen-version.js --check && node scripts/gen-virama.js --check && node scripts/gen-docs.js --check",
+    "build": "node scripts/build.js",
+    "build:types": "tsc -p tsconfig.types.json",
+    "test:types": "tsc -p tests/types/tsconfig.json",
+    "test": "node tests/sanctifyText.test.js && node tests/inspectTextDetailed.test.js && node --expose-gc tests/hiddenText.test.js && node --expose-gc tests/context.test.js && node tests/cli.test.js && node tests/release.test.js",
+    "test-min": "node tests/sanctifyText.test.min.js",
+    "check:self": "node bin/text-sanctifier.js check .",
+    "check:names": "node scripts/check-names.js",
+    "ci": "npm run gen:check && npm run check:names && npm run check:self && npm run test && npm run build && npm run size && npm run build:types && npm run test:types && npm run test-min",
+    "size": "node scripts/check-size.js",
+    "bench": "node --expose-gc scripts/bench.js",
+    "release:prep": "node scripts/release.js prep",
+    "release:verify": "node scripts/release.js verify",
+    "hooks:install": "git config core.hooksPath scripts/hooks"
+  },
+  "keywords": [
+    "text",
+    "sanitize",
+    "normalize",
+    "invisible",
+    "scrubber",
+    "unicode",
+    "clean",
+    "sanctify"
+  ],
+  "author": "WATT3D <WATT3D@protonmail.com>",
+  "license": "SEE LICENSE IN LICENSE",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/iWhatty/text-sanctifier.git"
+  },
+  "bugs": {
+    "url": "https://github.com/iWhatty/text-sanctifier/issues"
+  },
+  "homepage": "https://github.com/iWhatty/text-sanctifier#readme",
+  "directories": {
+    "test": "tests"
+  },
+  "devDependencies": {
+    "esbuild": "^0.25.3",
+    "typescript": "^5.9.3"
+  }
+}