@travelopia/kavach

Kavach (कवच) — divine armour in Hindu mythology. This package is the shield for your sensitive data.

A TypeScript utility for masking Personally Identifiable Information (PII) in data structures, designed for safe logging.

⚠️ Important: Kavach is for logging only. Never apply it to actual request/response data.

Installation

npm install @travelopia/kavach

Features

• Mask sensitive data: emails, phone numbers, credit cards, names, addresses, dates of birth, postal codes
• Smart field-name based detection for recursive object masking
• XML/SOAP payload masking with namespace support
• Preserves partial info for traceability (e.g. first char + domain for emails, last 4 digits for cards)
• TypeScript support with full type definitions
• Fully tested with Vitest

Usage

Basic String Masking

import { maskString } from '@travelopia/kavach';

maskString('hello'); // '*****'
maskString('hello', { showStart: 1, showEnd: 1 }); // 'h***o'
maskString('hello', { maskChar: '#' }); // '#####'

Email Masking

import { maskEmail } from '@travelopia/kavach';

maskEmail('[email protected]'); // 'j***@example.com'

Phone Number Masking

import { maskPhone } from '@travelopia/kavach';

maskPhone('1234567890'); // '******7890'
maskPhone('+1 (555) 123-4567'); // '*************4567'

Credit Card Masking

import { maskCardNumber } from '@travelopia/kavach';

maskCardNumber('4111111111111111'); // '************1111'

Object Masking

import { maskPIIInObject } from '@travelopia/kavach';

const user = {
  firstName: 'John',
  lastName: 'Doe',
  email: '[email protected]',
  phone: '1234567890',
  age: 30,
};

const masked = maskPIIInObject(user);
// Automatically detects and masks PII fields by name

XML/SOAP Masking

import { maskPIIInXML } from '@travelopia/kavach';

const masked = maskPIIInXML(soapPayload);
// Masks PII inside XML tags and attributes, including namespaced tags

API

maskEmail(email: string): string

Shows first character and full domain. e.g. j***@example.com

maskPhone(phone: string): string

Shows last 4 digits. e.g. ******3456

maskCardNumber(card: string): string

Shows last 4 digits. e.g. ************1111

maskName(name: string): string

Shows first character. e.g. J*****

maskDateOfBirth(date: string): string

Shows year only. e.g. 1994-**-**

maskAddress(address: string): string

Shows street number. e.g. 123 ***

maskZip(zip: string): string

Shows first 2 characters. e.g. 12***

maskPIIInObject(obj: unknown): unknown

Recursively masks fields matched by ~50 common PII field name patterns (case-insensitive). Covers email, phone, card, name, address, auth code fields.

maskPIIInXML(xml: string): string

Masks PII in XML/SOAP payloads via regex. Handles XML namespaces, tag content, and attributes.

Development

npm install
npm test
npm run test:watch
npm run type-check
npm run build
npm run lint

License

UNLICENSED - For internal use by Yachts App Squad only.