visus-mcp 0.6.2 → 0.9.0

package/dist/content-handlers/json-handler.js

@@ -0,0 +1,116 @@
+/**
+ * JSON Content Handler
+ *
+ * Handles application/json content type. Recursively traverses all nodes in the JSON
+ * object tree and applies the full injection pattern registry to every string value.
+ *
+ * What it handles:
+ * - All string values in the JSON tree (any depth)
+ * - Arrays, nested objects, and mixed-type arrays
+ * - Falls back to plain text pipeline if JSON.parse fails
+ *
+ * What it strips:
+ * - Nothing (preserves original structure)
+ *
+ * What it passes through:
+ * - Sanitized JSON with original structure preserved
+ * - All non-string values pass through unchanged
+ */
+import { sanitize } from '../sanitizer/index.js';
+/**
+ * Handle JSON content
+ *
+ * @param content - Raw JSON string
+ * @param mimeType - Original MIME type
+ * @returns Sanitized handler result
+ */
+export function handleJson(content, mimeType) {
+    const startTime = Date.now();
+    // Convert Buffer to string if needed
+    const jsonString = Buffer.isBuffer(content) ? content.toString('utf-8') : content;
+    try {
+        // Parse JSON
+        const parsed = JSON.parse(jsonString);
+        // Track sanitization metadata across all fields
+        let sanitizedFieldCount = 0;
+        const allPatternsDetected = new Set();
+        const allPiiTypesRedacted = new Set();
+        const allPiiAllowlisted = [];
+        // Recursively sanitize all string values
+        const sanitized = recursiveSanitize(parsed, (text) => {
+            const result = sanitize(text);
+            if (result.sanitization.content_modified) {
+                sanitizedFieldCount++;
+            }
+            // Aggregate metadata
+            result.sanitization.patterns_detected.forEach(p => allPatternsDetected.add(p));
+            result.sanitization.pii_types_redacted.forEach(p => allPiiTypesRedacted.add(p));
+            allPiiAllowlisted.push(...result.sanitization.pii_allowlisted);
+            return result.content;
+        });
+        // Re-stringify with 2-space indent
+        const sanitizedJson = JSON.stringify(sanitized, null, 2);
+        const processingTime = Date.now() - startTime;
+        return {
+            status: 'sanitized',
+            content_type: mimeType,
+            sanitized_content: sanitizedJson,
+            sanitization: {
+                patterns_detected: Array.from(allPatternsDetected),
+                pii_types_redacted: Array.from(allPiiTypesRedacted),
+                pii_allowlisted: allPiiAllowlisted,
+                sanitized_fields: sanitizedFieldCount
+            },
+            processing_time_ms: processingTime
+        };
+    }
+    catch (error) {
+        // JSON.parse failed - fall back to plain text sanitization
+        const sanitizationResult = sanitize(jsonString);
+        const processingTime = Date.now() - startTime;
+        return {
+            status: 'sanitized',
+            content_type: mimeType,
+            sanitized_content: sanitizationResult.content,
+            sanitization: {
+                patterns_detected: sanitizationResult.sanitization.patterns_detected,
+                pii_types_redacted: sanitizationResult.sanitization.pii_types_redacted,
+                pii_allowlisted: sanitizationResult.sanitization.pii_allowlisted,
+                sanitized_fields: sanitizationResult.sanitization.patterns_detected.length
+            },
+            processing_time_ms: processingTime
+        };
+    }
+}
+/**
+ * Recursively traverse JSON tree and sanitize all string values
+ *
+ * @param obj - JSON object/array/primitive
+ * @param sanitizeFn - Function to sanitize string values
+ * @returns Sanitized object with same structure
+ */
+function recursiveSanitize(obj, sanitizeFn) {
+    // Handle null
+    if (obj === null) {
+        return null;
+    }
+    // Handle string - sanitize it
+    if (typeof obj === 'string') {
+        return sanitizeFn(obj);
+    }
+    // Handle array - recursively sanitize each element
+    if (Array.isArray(obj)) {
+        return obj.map((item) => recursiveSanitize(item, sanitizeFn));
+    }
+    // Handle object - recursively sanitize each value
+    if (typeof obj === 'object') {
+        const sanitizedObj = {};
+        for (const [key, value] of Object.entries(obj)) {
+            sanitizedObj[key] = recursiveSanitize(value, sanitizeFn);
+        }
+        return sanitizedObj;
+    }
+    // Handle primitives (number, boolean, undefined) - pass through
+    return obj;
+}
+//# sourceMappingURL=json-handler.js.map

package/dist/content-handlers/json-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-handler.js","sourceRoot":"","sources":["../../src/content-handlers/json-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGjD;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,OAAwB,EACxB,QAAgB;IAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,qCAAqC;IACrC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAElF,IAAI,CAAC;QACH,aAAa;QACb,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAEtC,gDAAgD;QAChD,IAAI,mBAAmB,GAAG,CAAC,CAAC;QAC5B,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9C,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9C,MAAM,iBAAiB,GAA2D,EAAE,CAAC;QAErF,yCAAyC;QACzC,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;YAC3D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,MAAM,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;gBACzC,mBAAmB,EAAE,CAAC;YACxB,CAAC;YAED,qBAAqB;YACrB,MAAM,CAAC,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/E,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAChF,iBAAiB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;YAE/D,OAAO,MAAM,CAAC,OAAO,CAAC;QACxB,CAAC,CAAC,CAAC;QAEH,mCAAmC;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEzD,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE9C,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,YAAY,EAAE,QAAQ;YACtB,iBAAiB,EAAE,aAAa;YAChC,YAAY,EAAE;gBACZ,iBAAiB,EAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC;gBAClD,kBAAkB,EAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC;gBACnD,eAAe,EAAE,iBAAiB;gBAClC,gBAAgB,EAAE,mBAAmB;aACtC;YACD,kBAAkB,EAAE,cAAc;SACnC,CAAC;IAEJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,2DAA2D;QAC3D,MAAM,kBAAkB,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;QAEhD,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE9C,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,YAAY,EAAE,QAAQ;YACtB,iBAAiB,EAAE,kBAAkB,CAAC,OAAO;YAC7C,YAAY,EAAE;gBACZ,iBAAiB,EAAE,kBAAkB,CAAC,YAAY,CAAC,iBAAiB;gBACpE,kBAAkB,EAAE,kBAAkB,CAAC,YAAY,CAAC,kBAAkB;gBACtE,eAAe,EAAE,kBAAkB,CAAC,YAAY,CAAC,eAAe;gBAChE,gBAAgB,EAAE,kBAAkB,CAAC,YAAY,CAAC,iBAAiB,CAAC,MAAM;aAC3E;YACD,kBAAkB,EAAE,cAAc;SACnC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,GAAQ,EAAE,UAAoC;IACvE,cAAc;IACd,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8BAA8B;IAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,mDAAmD;IACnD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,kDAAkD;IAClD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAwB,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,YAAY,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,gEAAgE;IAChE,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/content-handlers/pdf-handler.d.ts

@@ -0,0 +1,29 @@
+/**
+ * PDF Content Handler
+ *
+ * Handles application/pdf content type. Extracts text and metadata from PDF files,
+ * passes all text through the injection pattern registry, and returns sanitized plain text.
+ *
+ * What it handles:
+ * - PDF body text (full document)
+ * - PDF metadata: title, author, subject, keywords, creator, producer
+ * - Annotation text
+ * - Form field values
+ *
+ * What it strips:
+ * - Embedded binary objects (fonts, images, attachments)
+ * - Returns only extracted text, not original binary
+ *
+ * What it passes through:
+ * - All extracted text after injection pattern sanitization
+ */
+import type { HandlerResult } from './types.js';
+/**
+ * Handle PDF content
+ *
+ * @param content - Raw PDF binary data as Buffer or string
+ * @param mimeType - Original MIME type
+ * @returns Sanitized handler result
+ */
+export declare function handlePdf(content: string | Buffer, mimeType: string): Promise<HandlerResult>;
+//# sourceMappingURL=pdf-handler.d.ts.map

package/dist/content-handlers/pdf-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdf-handler.d.ts","sourceRoot":"","sources":["../../src/content-handlers/pdf-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,CAAC,CAwDxB"}

package/dist/content-handlers/pdf-handler.js

@@ -0,0 +1,77 @@
+/**
+ * PDF Content Handler
+ *
+ * Handles application/pdf content type. Extracts text and metadata from PDF files,
+ * passes all text through the injection pattern registry, and returns sanitized plain text.
+ *
+ * What it handles:
+ * - PDF body text (full document)
+ * - PDF metadata: title, author, subject, keywords, creator, producer
+ * - Annotation text
+ * - Form field values
+ *
+ * What it strips:
+ * - Embedded binary objects (fonts, images, attachments)
+ * - Returns only extracted text, not original binary
+ *
+ * What it passes through:
+ * - All extracted text after injection pattern sanitization
+ */
+import { PDFParse } from 'pdf-parse';
+import { sanitize } from '../sanitizer/index.js';
+/**
+ * Handle PDF content
+ *
+ * @param content - Raw PDF binary data as Buffer or string
+ * @param mimeType - Original MIME type
+ * @returns Sanitized handler result
+ */
+export async function handlePdf(content, mimeType) {
+    const startTime = Date.now();
+    try {
+        // Ensure we have a Buffer
+        const buffer = Buffer.isBuffer(content) ? content : Buffer.from(content);
+        // Parse PDF using pdf-parse v2 API
+        const parser = new PDFParse({ data: buffer });
+        // Get text and metadata separately
+        const textResult = await parser.getText();
+        const infoResult = await parser.getInfo();
+        // Extract text and metadata
+        const bodyText = textResult.text || '';
+        const metadata = infoResult.info || {};
+        // Build combined text from body + metadata
+        let combinedText = bodyText;
+        // Append metadata fields
+        const metadataFields = ['Title', 'Author', 'Subject', 'Keywords', 'Creator', 'Producer'];
+        for (const field of metadataFields) {
+            const value = metadata[field];
+            if (value && typeof value === 'string') {
+                combinedText += `\n\n${field}: ${value}`;
+            }
+        }
+        // Pass through injection detection pipeline
+        const sanitizationResult = sanitize(combinedText);
+        const processingTime = Date.now() - startTime;
+        return {
+            status: 'sanitized',
+            content_type: mimeType,
+            sanitized_content: sanitizationResult.content,
+            sanitization: {
+                patterns_detected: sanitizationResult.sanitization.patterns_detected,
+                pii_types_redacted: sanitizationResult.sanitization.pii_types_redacted,
+                pii_allowlisted: sanitizationResult.sanitization.pii_allowlisted,
+                sanitized_fields: sanitizationResult.sanitization.patterns_detected.length
+            },
+            processing_time_ms: processingTime
+        };
+    }
+    catch (error) {
+        return {
+            status: 'error',
+            reason: 'PDF_PARSE_FAILED',
+            mime: mimeType,
+            message: error instanceof Error ? error.message : String(error)
+        };
+    }
+}
+//# sourceMappingURL=pdf-handler.js.map

package/dist/content-handlers/pdf-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdf-handler.js","sourceRoot":"","sources":["../../src/content-handlers/pdf-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGjD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAwB,EACxB,QAAgB;IAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,0BAA0B;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEzE,mCAAmC;QACnC,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAE9C,mCAAmC;QACnC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QAE1C,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;QAEvC,2CAA2C;QAC3C,IAAI,YAAY,GAAG,QAAQ,CAAC;QAE5B,yBAAyB;QACzB,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACzF,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvC,YAAY,IAAI,OAAO,KAAK,KAAK,KAAK,EAAE,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,MAAM,kBAAkB,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;QAElD,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE9C,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,YAAY,EAAE,QAAQ;YACtB,iBAAiB,EAAE,kBAAkB,CAAC,OAAO;YAC7C,YAAY,EAAE;gBACZ,iBAAiB,EAAE,kBAAkB,CAAC,YAAY,CAAC,iBAAiB;gBACpE,kBAAkB,EAAE,kBAAkB,CAAC,YAAY,CAAC,kBAAkB;gBACtE,eAAe,EAAE,kBAAkB,CAAC,YAAY,CAAC,eAAe;gBAChE,gBAAgB,EAAE,kBAAkB,CAAC,YAAY,CAAC,iBAAiB,CAAC,MAAM;aAC3E;YACD,kBAAkB,EAAE,cAAc;SACnC,CAAC;IAEJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,kBAAkB;YAC1B,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAChE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/content-handlers/svg-handler.d.ts

@@ -0,0 +1,35 @@
+/**
+ * SVG Content Handler
+ *
+ * Handles image/svg+xml content type. SVG is XML, not a binary image, and can contain
+ * executable code and external references. This handler strips dangerous elements and
+ * attributes unconditionally, then sanitizes remaining text content.
+ *
+ * What it handles:
+ * - All text content in SVG elements after stripping dangerous parts
+ *
+ * What it strips (unconditionally, no attempt to sanitize):
+ * - <script> elements and all children
+ * - <use> elements with external href or xlink:href attributes
+ * - <foreignObject> elements and all children
+ * - All event handler attributes (onload, onclick, onerror, etc.)
+ * - <set> and <animate> elements that reference external resources
+ * - data: URI attributes
+ *
+ * What it passes through (after injection scan):
+ * - Path data (d attribute)
+ * - Text elements and their content
+ * - <title> and <desc> elements
+ * - Presentation attributes (fill, stroke, transform, etc.)
+ * - viewBox, width, height attributes
+ */
+import type { HandlerResult } from './types.js';
+/**
+ * Handle SVG content
+ *
+ * @param content - Raw SVG XML string or Buffer
+ * @param mimeType - Original MIME type
+ * @returns Sanitized handler result
+ */
+export declare function handleSvg(content: string | Buffer, mimeType: string): HandlerResult;
+//# sourceMappingURL=svg-handler.d.ts.map

package/dist/content-handlers/svg-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"svg-handler.d.ts","sourceRoot":"","sources":["../../src/content-handlers/svg-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD;;;;;;GAMG;AACH,wBAAgB,SAAS,CACvB,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,QAAQ,EAAE,MAAM,GACf,aAAa,CAsEf"}

package/dist/content-handlers/svg-handler.js

@@ -0,0 +1,206 @@
+/**
+ * SVG Content Handler
+ *
+ * Handles image/svg+xml content type. SVG is XML, not a binary image, and can contain
+ * executable code and external references. This handler strips dangerous elements and
+ * attributes unconditionally, then sanitizes remaining text content.
+ *
+ * What it handles:
+ * - All text content in SVG elements after stripping dangerous parts
+ *
+ * What it strips (unconditionally, no attempt to sanitize):
+ * - <script> elements and all children
+ * - <use> elements with external href or xlink:href attributes
+ * - <foreignObject> elements and all children
+ * - All event handler attributes (onload, onclick, onerror, etc.)
+ * - <set> and <animate> elements that reference external resources
+ * - data: URI attributes
+ *
+ * What it passes through (after injection scan):
+ * - Path data (d attribute)
+ * - Text elements and their content
+ * - <title> and <desc> elements
+ * - Presentation attributes (fill, stroke, transform, etc.)
+ * - viewBox, width, height attributes
+ */
+import { XMLParser, XMLBuilder } from 'fast-xml-parser';
+import { sanitize } from '../sanitizer/index.js';
+/**
+ * Handle SVG content
+ *
+ * @param content - Raw SVG XML string or Buffer
+ * @param mimeType - Original MIME type
+ * @returns Sanitized handler result
+ */
+export function handleSvg(content, mimeType) {
+    const startTime = Date.now();
+    // Convert Buffer to string if needed
+    const svgString = Buffer.isBuffer(content) ? content.toString('utf-8') : content;
+    try {
+        // Parse SVG XML
+        const parser = new XMLParser({
+            ignoreAttributes: false,
+            attributeNamePrefix: '@_',
+            textNodeName: '#text',
+            preserveOrder: false,
+            removeNSPrefix: true,
+        });
+        const parsed = parser.parse(svgString);
+        // Track sanitized field count
+        let sanitizedFieldCount = 0;
+        // Strip dangerous elements and attributes
+        const stripped = stripDangerousContent(parsed);
+        // Extract all text content for injection scanning
+        const textContent = extractTextContent(stripped);
+        // Run text through injection detection
+        let sanitizationResult;
+        if (textContent.length > 0) {
+            sanitizationResult = sanitize(textContent);
+            if (sanitizationResult.sanitization.content_modified) {
+                sanitizedFieldCount = sanitizationResult.sanitization.patterns_detected.length;
+            }
+        }
+        // Rebuild SVG
+        const builder = new XMLBuilder({
+            ignoreAttributes: false,
+            attributeNamePrefix: '@_',
+            textNodeName: '#text',
+            format: true,
+            suppressEmptyNode: true,
+        });
+        const sanitizedSvg = builder.build(stripped);
+        const processingTime = Date.now() - startTime;
+        return {
+            status: 'sanitized',
+            content_type: mimeType,
+            sanitized_content: sanitizedSvg,
+            sanitization: {
+                patterns_detected: sanitizationResult?.sanitization.patterns_detected || [],
+                pii_types_redacted: sanitizationResult?.sanitization.pii_types_redacted || [],
+                pii_allowlisted: sanitizationResult?.sanitization.pii_allowlisted || [],
+                sanitized_fields: sanitizedFieldCount
+            },
+            processing_time_ms: processingTime
+        };
+    }
+    catch (error) {
+        return {
+            status: 'error',
+            reason: 'SVG_PARSE_FAILED',
+            mime: mimeType,
+            message: error instanceof Error ? error.message : String(error)
+        };
+    }
+}
+/**
+ * Strip dangerous content from parsed SVG
+ *
+ * Removes:
+ * - <script> elements
+ * - <foreignObject> elements
+ * - <use> with external href
+ * - Event handler attributes
+ * - <set> and <animate> with external references
+ * - data: URIs
+ */
+function stripDangerousContent(node) {
+    if (typeof node !== 'object' || node === null) {
+        return node;
+    }
+    // Handle arrays
+    if (Array.isArray(node)) {
+        return node
+            .filter((item) => !shouldRemoveElement(item))
+            .map((item) => stripDangerousContent(item));
+    }
+    // Handle objects
+    const result = {};
+    for (const [key, value] of Object.entries(node)) {
+        // Skip dangerous elements
+        if (key === 'script' || key === 'foreignObject') {
+            continue;
+        }
+        // Handle <use> with external href
+        if (key === 'use' && typeof value === 'object' && value !== null) {
+            const href = value['@_href'] || value['@_xlink:href'];
+            if (href && (href.startsWith('http://') || href.startsWith('https://') || href.startsWith('//'))) {
+                continue;
+            }
+        }
+        // Handle <set> and <animate> with external references
+        if ((key === 'set' || key === 'animate') && typeof value === 'object' && value !== null) {
+            const href = value['@_href'] || value['@_xlink:href'];
+            if (href && (href.startsWith('http://') || href.startsWith('https://') || href.startsWith('//'))) {
+                continue;
+            }
+        }
+        // Strip event handler attributes
+        if (key.startsWith('@_on')) {
+            continue;
+        }
+        // Strip data: URIs
+        if (typeof value === 'string' && value.startsWith('data:')) {
+            result[key] = '';
+            continue;
+        }
+        // Strip attributes with data: URIs
+        if (key.startsWith('@_') && typeof value === 'string' && value.startsWith('data:')) {
+            continue;
+        }
+        // Recursively process
+        result[key] = stripDangerousContent(value);
+    }
+    return result;
+}
+/**
+ * Check if element should be removed entirely
+ */
+function shouldRemoveElement(element) {
+    if (typeof element !== 'object' || element === null) {
+        return false;
+    }
+    // Check for dangerous element types
+    const dangerousElements = ['script', 'foreignObject'];
+    for (const dangerous of dangerousElements) {
+        if (dangerous in element) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Extract all text content from SVG for injection scanning
+ */
+function extractTextContent(node) {
+    if (typeof node !== 'object' || node === null) {
+        return '';
+    }
+    if (typeof node === 'string') {
+        return node;
+    }
+    if (Array.isArray(node)) {
+        return node.map((item) => extractTextContent(item)).join(' ');
+    }
+    let text = '';
+    for (const [key, value] of Object.entries(node)) {
+        // Extract text from text nodes
+        if (key === '#text' && typeof value === 'string') {
+            text += value + ' ';
+        }
+        // Extract from title and desc elements (can be string or object)
+        if (key === 'title' || key === 'desc') {
+            if (typeof value === 'string') {
+                text += value + ' ';
+            }
+            else if (typeof value === 'object') {
+                text += extractTextContent(value) + ' ';
+            }
+        }
+        // Recursively extract from other children
+        if (key !== 'title' && key !== 'desc' && typeof value === 'object') {
+            text += extractTextContent(value) + ' ';
+        }
+    }
+    return text.trim();
+}
+//# sourceMappingURL=svg-handler.js.map

package/dist/content-handlers/svg-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"svg-handler.js","sourceRoot":"","sources":["../../src/content-handlers/svg-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGjD;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CACvB,OAAwB,EACxB,QAAgB;IAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,qCAAqC;IACrC,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAEjF,IAAI,CAAC;QACH,gBAAgB;QAChB,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;YAC3B,gBAAgB,EAAE,KAAK;YACvB,mBAAmB,EAAE,IAAI;YACzB,YAAY,EAAE,OAAO;YACrB,aAAa,EAAE,KAAK;YACpB,cAAc,EAAE,IAAI;SACrB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAEvC,8BAA8B;QAC9B,IAAI,mBAAmB,GAAG,CAAC,CAAC;QAE5B,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAE/C,kDAAkD;QAClD,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAEjD,uCAAuC;QACvC,IAAI,kBAAkB,CAAC;QACvB,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC3C,IAAI,kBAAkB,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;gBACrD,mBAAmB,GAAG,kBAAkB,CAAC,YAAY,CAAC,iBAAiB,CAAC,MAAM,CAAC;YACjF,CAAC;QACH,CAAC;QAED,cAAc;QACd,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC;YAC7B,gBAAgB,EAAE,KAAK;YACvB,mBAAmB,EAAE,IAAI;YACzB,YAAY,EAAE,OAAO;YACrB,MAAM,EAAE,IAAI;YACZ,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAE7C,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE9C,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,YAAY,EAAE,QAAQ;YACtB,iBAAiB,EAAE,YAAY;YAC/B,YAAY,EAAE;gBACZ,iBAAiB,EAAE,kBAAkB,EAAE,YAAY,CAAC,iBAAiB,IAAI,EAAE;gBAC3E,kBAAkB,EAAE,kBAAkB,EAAE,YAAY,CAAC,kBAAkB,IAAI,EAAE;gBAC7E,eAAe,EAAE,kBAAkB,EAAE,YAAY,CAAC,eAAe,IAAI,EAAE;gBACvE,gBAAgB,EAAE,mBAAmB;aACtC;YACD,kBAAkB,EAAE,cAAc;SACnC,CAAC;IAEJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,kBAAkB;YAC1B,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,qBAAqB,CAAC,IAAS;IACtC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gBAAgB;IAChB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI;aACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;aAC5C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,iBAAiB;IACjB,MAAM,MAAM,GAAQ,EAAE,CAAC;IAEvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,0BAA0B;QAC1B,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;YAChD,SAAS;QACX,CAAC;QAED,kCAAkC;QAClC,IAAI,GAAG,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACjE,MAAM,IAAI,GAAI,KAAa,CAAC,QAAQ,CAAC,IAAK,KAAa,CAAC,cAAc,CAAC,CAAC;YACxE,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACjG,SAAS;YACX,CAAC;QACH,CAAC;QAED,sDAAsD;QACtD,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,SAAS,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACxF,MAAM,IAAI,GAAI,KAAa,CAAC,QAAQ,CAAC,IAAK,KAAa,CAAC,cAAc,CAAC,CAAC;YACxE,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACjG,SAAS;YACX,CAAC;QACH,CAAC;QAED,iCAAiC;QACjC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,SAAS;QACX,CAAC;QAED,mBAAmB;QACnB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3D,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QAED,mCAAmC;QACnC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACnF,SAAS;QACX,CAAC;QAED,sBAAsB;QACtB,MAAM,CAAC,GAAG,CAAC,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,OAAY;IACvC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,oCAAoC;IACpC,MAAM,iBAAiB,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACtD,KAAK,MAAM,SAAS,IAAI,iBAAiB,EAAE,CAAC;QAC1C,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,IAAS;IACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,IAAI,GAAG,EAAE,CAAC;IAEd,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,+BAA+B;QAC/B,IAAI,GAAG,KAAK,OAAO,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACjD,IAAI,IAAI,KAAK,GAAG,GAAG,CAAC;QACtB,CAAC;QAED,iEAAiE;QACjE,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,IAAI,IAAI,KAAK,GAAG,GAAG,CAAC;YACtB,CAAC;iBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACrC,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,0CAA0C;QAC1C,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,MAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnE,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;AACrB,CAAC"}

package/dist/content-handlers/types.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Content Handler Types
+ *
+ * Shared interfaces for content-type specific handlers.
+ */
+/**
+ * Success result from a content handler
+ */
+export interface HandlerSuccessResult {
+    status: 'sanitized';
+    content_type: string;
+    sanitized_content: string;
+    sanitization: {
+        patterns_detected: string[];
+        pii_types_redacted: string[];
+        pii_allowlisted: Array<{
+            type: string;
+            value: string;
+            reason: string;
+        }>;
+        sanitized_fields: number;
+    };
+    processing_time_ms: number;
+}
+/**
+ * Error result from a content handler
+ */
+export interface HandlerErrorResult {
+    status: 'error' | 'rejected';
+    reason: string;
+    mime: string;
+    message: string;
+}
+/**
+ * Union type for all handler results
+ */
+export type HandlerResult = HandlerSuccessResult | HandlerErrorResult;
+/**
+ * Content handler function signature
+ */
+export type ContentHandler = (content: string | Buffer, mimeType: string) => Promise<HandlerResult> | HandlerResult;
+//# sourceMappingURL=types.d.ts.map

package/dist/content-handlers/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/content-handlers/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,WAAW,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE;QACZ,iBAAiB,EAAE,MAAM,EAAE,CAAC;QAC5B,kBAAkB,EAAE,MAAM,EAAE,CAAC;QAC7B,eAAe,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACxE,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,GAAG,UAAU,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,oBAAoB,GAAG,kBAAkB,CAAC;AAEtE;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,CAC3B,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,aAAa,CAAC,GAAG,aAAa,CAAC"}

package/dist/content-handlers/types.js

@@ -0,0 +1,7 @@
+/**
+ * Content Handler Types
+ *
+ * Shared interfaces for content-type specific handlers.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/content-handlers/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/content-handlers/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/sanitizer/framework-mapper.d.ts

@@ -4,12 +4,16 @@
  * Maps injection pattern categories to compliance framework identifiers:
  * - OWASP LLM Top 10 (2025)
  * - NIST AI 600-1 (Generative AI Profile)
+ * - NIST AI RMF (AI Risk Management Framework - AI 100-1)
+ * - NIST CSF 2.0 (Cybersecurity Framework 2.0)
  * - MITRE ATLAS (Adversarial Threat Landscape for AI Systems)
  * - ISO/IEC 42001:2023 (AI Management System - Annex A Controls)
  */
 export interface FrameworkMappings {
     owasp_llm: string;
     nist_ai_600_1: string;
+    nist_ai_rmf: string;
+    nist_csf_2_0: string;
     mitre_atlas: string;
     iso_42001: string;
 }

package/dist/sanitizer/framework-mapper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"framework-mapper.d.ts","sourceRoot":"","sources":["../../src/sanitizer/framework-mapper.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAyWD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,eAAe,EAAE,MAAM,GAAG,iBAAiB,CAE/E;AAED;;GAEG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,EAAE,CAOjD"}
+{"version":3,"file":"framework-mapper.d.ts","sourceRoot":"","sources":["../../src/sanitizer/framework-mapper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAicD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,eAAe,EAAE,MAAM,GAAG,iBAAiB,CAE/E;AAED;;GAEG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,EAAE,CASjD"}