/** * Numeric PII — card / TCKN / phone — with the same class of fix IBAN got * in 0.2.2: never start a match in the middle of a longer digit run. * * The card regex `(?:\d[ -]*?){13,16}` plus a phone regex with no leading * `\b` would match 13 digits *inside* a 16-digit PAN and leave * `411[MASKED_PII]`. `maskedCount` then claimed the field was protected. * A leftover prefix glued to a mask is not protection. * * Decision, on a *maximal* digit run (grouping spaces/hyphens allowed): * - 13–16 digits and Luhn holds → card, mask the whole run * - 11 digits starting with 0 → TR national phone (0 + 10 digits: * cep 05xx, sabit 02/03/04xx, 08xx). TCKN never starts with 0. * The 2nd-digit 5-vs-2/3/4 split is numbering-plan identity, not a * masking decision — 08xx would fall through it. * - 11 digits starting 1–9 → TCKN-shaped, mask the whole run * - 10 digits → phone-shaped (compact local, no trunk 0) * - longer (20, 25, …) → not a card; the content scanner does not touch it * Formatted phones (`+90 555 123 4567`) are a separate pass that also * refuses to start or end next to a digit. */ export declare const PII_SCAN_CHAR_CAP = 16384; /** Hard ceiling so an unbounded cap cannot become a DoS. */ export declare const PII_SCAN_CHAR_CAP_MAX = 1048576; /** * Env wins, then policy, then the compiled default. Invalid env falls back * to default rather than disabling the cap. */ export declare function resolveScanCharCap(policyCap?: number): number; export declare function luhnOk(digits: string): boolean; export declare function maskNumericPii(text: string): { text: string; count: number; }; /** Bounded email. Unbounded `{local}+@` backtracks O(n²) on a long * alphanumeric field that contains no `@` (TR33+40k digits, 20k hex). */ export declare const EMAIL_RE: RegExp; export declare function maskEmails(text: string): { text: string; count: number; }; export declare function maskEntityEncodedEmails(text: string): { text: string; count: number; }; //# sourceMappingURL=digit_pii.d.ts.map