@suaveplan/data-masking - PII/sensitive data masking for objects and strings: field-level masking rules, nested object traversal, format-preserving masking, tokenization, and FNV-1a hashing.
Summary
PII/sensitive data masking for objects and strings with field-level rules, nested traversal, eight masking strategies, and OpenTelemetry instrumentation.
Documentation tree
- masker — (no submodules)
- object-masker — (no submodules)
- errors — (no submodules)
- data-masking-error — (no submodules)
- schemas — (no submodules)
- mask-rule.schema — (no submodules)
- credit-card — The
credit-cardmasking strategy produces the PCI-DSS-compatible truncation format for payment card numbers: last 4 d… - email — The
emailmasking strategy anonymises email addresses while keeping the output immediately recognisable as an email a… - full — The
fullmasking strategy completely replaces an input string with a configurable replacement sentinel. It is the mos… - hash — The
hashmasking strategy produces a deterministic, fixed-length 8-character hexadecimal token from any input string… - partial — The
partialmasking strategy preserves a configurable number of characters at the start and end of an input string wh… - phone — The
phonemasking strategy anonymises phone numbers while preserving their formatting separators, making masked value… - preserve-format — The
preserve-formatmasking strategy replaces every alphanumeric character with a placeholder of the same character c… - tokenize — The
tokenizemasking strategy replaces a sensitive value with a structured opaque token of the form `TOKEN_… - types — (no submodules)
- mask-types — (no submodules)
- utils — (no submodules)
- path-matcher — (no submodules)
- email — The
emailmasking strategy anonymises email addresses while keeping the output immediately recognisable as an email a… - full — The
fullmasking strategy completely replaces an input string with a configurable replacement sentinel. It is the mos… - hash — The
hashmasking strategy produces a deterministic, fixed-length 8-character hexadecimal token from any input string… - partial — The
partialmasking strategy preserves a configurable number of characters at the start and end of an input string wh… - phone — The
phonemasking strategy anonymises phone numbers while preserving their formatting separators, making masked value… - preserve-format — The
preserve-formatmasking strategy replaces every alphanumeric character with a placeholder of the same character c… - tokenize — The
tokenizemasking strategy replaces a sensitive value with a structured opaque token of the form `TOKEN_… - types — (no submodules)- mask-types — (no submodules)- utils — (no submodules)- path-matcher — (no submodules)- object-masker — (no submodules)- errors — (no submodules)- data-masking-error — (no submodules)- schemas — (no submodules)- mask-rule.schema — (no submodules)- credit-card — The
credit-cardmasking strategy produces the PCI-DSS-compatible truncation format for payment card numbers: last 4 d… - email — The
emailmasking strategy anonymises email addresses while keeping the output immediately recognisable as an email a… - full — The
fullmasking strategy completely replaces an input string with a configurable replacement sentinel. It is the mos… - hash — The
hashmasking strategy produces a deterministic, fixed-length 8-character hexadecimal token from any input string… - partial — The
partialmasking strategy preserves a configurable number of characters at the start and end of an input string wh… - phone — The
phonemasking strategy anonymises phone numbers while preserving their formatting separators, making masked value… - preserve-format — The
preserve-formatmasking strategy replaces every alphanumeric character with a placeholder of the same character c… - tokenize — The
tokenizemasking strategy replaces a sensitive value with a structured opaque token of the form `TOKEN_… - types — (no submodules)- mask-types — (no submodules)- utils — (no submodules)- path-matcher — (no submodules)- object-masker — (no submodules)- errors — (no submodules)- data-masking-error — (no submodules)- schemas — (no submodules)- mask-rule.schema — (no submodules)- credit-card — The
credit-cardmasking strategy produces the PCI-DSS-compatible truncation format for payment card numbers: last 4 d… - email — The
emailmasking strategy anonymises email addresses while keeping the output immediately recognisable as an email a… - full — The
fullmasking strategy completely replaces an input string with a configurable replacement sentinel. It is the mos… - hash — The
hashmasking strategy produces a deterministic, fixed-length 8-character hexadecimal token from any input string… - partial — The
partialmasking strategy preserves a configurable number of characters at the start and end of an input string wh… - phone — The
phonemasking strategy anonymises phone numbers while preserving their formatting separators, making masked value… - preserve-format — The
preserve-formatmasking strategy replaces every alphanumeric character with a placeholder of the same character c… - tokenize — The
tokenizemasking strategy replaces a sensitive value with a structured opaque token of the form `TOKEN_… - types — (no submodules)- mask-types — (no submodules)- utils — (no submodules)- path-matcher — (no submodules)- object-masker — (no submodules)- errors — (no submodules) - data-masking-error — (no submodules)- schemas — (no submodules) - mask-rule.schema — (no submodules)- credit-card — The
credit-cardmasking strategy produces the PCI-DSS-compatible truncation format for payment card numbers: last 4 d… - email — The
emailmasking strategy anonymises email addresses while keeping the output immediately recognisable as an email a… - full — The
fullmasking strategy completely replaces an input string with a configurable replacement sentinel. It is the mos… - hash — The
hashmasking strategy produces a deterministic, fixed-length 8-character hexadecimal token from any input string… - partial — The
partialmasking strategy preserves a configurable number of characters at the start and end of an input string wh… - phone — The
phonemasking strategy anonymises phone numbers while preserving their formatting separators, making masked value… - preserve-format — The
preserve-formatmasking strategy replaces every alphanumeric character with a placeholder of the same character c… - tokenize — The
tokenizemasking strategy replaces a sensitive value with a structured opaque token of the form `TOKEN_… - types — (no submodules) - mask-types — (no submodules)- utils — (no submodules) - path-matcher — (no submodules)
Installation
bun add @suaveplan/data-masking
Quick Start
import { maskObject } from '@suaveplan/data-masking';
const result = maskObject(
{
user: { name: 'John Doe', email: 'john@example.com', ssn: '123-45-6789' },
payment: { cardNumber: '4111-1111-1111-1111', cvv: '123' },
},
{
rules: [
{ fields: ['user.email'], strategy: 'email' },
{ fields: ['user.ssn', 'payment.cvv'], strategy: 'full' },
{ fields: ['payment.cardNumber'], strategy: 'credit-card' },
],
},
);
console.log(result.masked.user.email); // 'j***@e***.com'
console.log(result.masked.payment.cardNumber); // '****-****-****-1111'
console.log(result.fieldsAffected); // ['payment.cardNumber', 'payment.cvv', 'user.email', 'user.ssn']
Strategies
| Strategy | Description | Example output |
|---|---|---|
full |
Replace entire value with *** |
*** |
partial |
Keep first/last N chars, mask middle | sk_***...****789 |
email |
Format-preserving email mask | j***@e***.com |
phone |
Keep last 4 digits | ***-***-1234 |
credit-card |
Keep last 4 digits | ****-****-****-1234 |
hash |
FNV-1a 32-bit hex (deterministic) | 4f9f2cab |
tokenize |
Opaque token (not reversible) | TOKEN_TOKENIZE_0 |
preserve-format |
Replace alnum with type placeholder | XXXXX000 |
Field Path Patterns
Rules use dot-notation paths with optional glob wildcards:
{ fields: ['user.email'] } // exact match
{ fields: ['user.*'] } // single-segment wildcard
{ fields: ['user.**'] } // multi-segment wildcard (any depth)
{ fields: ['**.email'] } // any path ending in .email
Modules
| Subpath | Contents |
|---|---|
@suaveplan/data-masking |
Main exports (maskObject, maskString, maskValue, types, schemas) |
@suaveplan/data-masking/masker |
object-masker — core traversal engine |
@suaveplan/data-masking/strategies |
full, partial, email, phone, credit-card, hash, tokenize, preserve-format |
@suaveplan/data-masking/errors |
DataMaskingError, DATA_MASKING_CODES |
@suaveplan/data-masking/schemas |
Zod schemas for MaskRule, MaskOptions |
License
MIT