Skip to content

Custom entity mapping

Teach DataCloak your own secrets: employee IDs, project codes, ticket numbers, internal hostnames. Three levels, pick one.

1. Library: customPatterns

import { DataCloakEngine } from '@pratikw/detect';

const cloak = new DataCloakEngine({
  customPatterns: [
    { name: 'Employee ID', pattern: 'EMP-[0-9]{6}', category: 'EMPLOYEE_ID', type: 'pii' },
    { name: 'Project code', pattern: 'PROJ-[A-Z]{3}-[0-9]{3}', category: 'PROJECT_CODE', type: 'secret' },
  ],
});

cloak.cloak('owner EMP-482913 on PROJ-ABC-123');
// → 'owner EMP-710294 on PROJ-XQZ-041'  (same shape, fake values)

Patterns are validated at load (invalid regex throws loudly). Without a synthesizer, matches fall back to opaque [CATEGORY_XXXXXX] tokens; with one, you get realistic fakes that keep their shape.

Synthesizer expressions

A template is literal text plus {{expression}} placeholders:

Expression Output
{{string.numeric(n)}} n digits, e.g. {{string.numeric(6)}}
{{string.alphanumeric(n)}} n letters+digits
{{number.int(min, max)}} integer in range
{{person.firstName()}} / {{person.lastName()}} realistic names

Unknown expressions fail open: the value is cloaked with an opaque token and a warning goes to stderr. Templates honor the engine locale.

2. OpenCode plugin: datacloak.json

// .opencode/datacloak.json
{
  "customPatterns": [
    { "name": "Employee ID", "pattern": "EMP-[0-9]{6}",
      "category": "EMPLOYEE_ID", "type": "pii" }
  ]
}

Cloak, block, redact and restore all honor them automatically — no restart needed beyond OpenCode's config reload.

1b. Browser extension: Settings → Custom entities

One row per value — type the value, pick its type (Name, Employee ID, Email, Phone, Other). No regex, no category, no fake template: each type has a hardcoded matcher and a same-length / same-case / same-format fake built in. Ramesh cloaks every case variant; EMP-001234 cloaks any EMP-<digits> ID as EMP-738291. Rows save on edit and sync via chrome.storage.sync to every tab's engine.

Upgrading: old literal entries become Name rows automatically; old manual regex entries are dropped (names logged to the console).

Rows, detector flags, and UI prefs (blur, review, badge…) live inside cloak profiles — Default is seeded from your current setup on first load. Switching profiles repaints everything; site grants stay global.

3. CLI: --config

datacloak cloak --config ./datacloak.json < prompt.txt
datacloak scan --config ./datacloak.json < prompt.txt || echo "secrets found"

Same file shape as above. Hooks (guard) read DATACLOAK_CONFIG or ./datacloak.json in the project root, so adapters pick your entities up with zero extra flags.