packages/data-sanitization/README.md (1)

255-277: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix the PII/PHI example output for health_card.

The example masks health_card, but that key is not in piiPatterns/phiPatterns shown in this PR, so this output is likely incorrect. Either add a matching pattern in the example config or update the expected output.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/data-sanitization/README.md` around lines 255 - 277, The README
example is inconsistent: the patient object includes health_card but neither
piiPatterns nor phiPatterns (used in sanitizeData with customPatterns) define a
pattern for the "health_card" key, so the expected masked output is wrong;
update the example by either adding a matching pattern for "health_card" to the
patterns array referenced (piiPatterns or phiPatterns) or change the expected
output to show health_card unmasked, and ensure you reference the same symbols
(patient, sanitizeData, customPatterns, piiPatterns, phiPatterns, health_card)
so the example and config stay in sync.

packages/data-sanitization/test/matchers.test.ts (2)

268-279: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Tighten the semicolon delimiter test to assert the intended behavior.

Line 277 only checks toContain(';'), which passes whether ; is treated as a delimiter or consumed as value content. This test currently won’t catch regressions in delimiter handling.

Proposed test assertion update

-    it('should not treat a semicolon as a field delimiter', () => {
+    it('should treat a semicolon as a field delimiter', () => {
       // Arrange
       const matcher = cookieAndFormEncodedMatcher('password');
       const testData = 'password=secret;username=mark';

       // Act
       const allMatches = [...testData.matchAll(matcher)];

-      // Assert — semicolons are not in the stop-character set; value captures past the semicolon
+      // Assert
       expect(allMatches.length).toBe(1);
-      expect(allMatches[0]?.[0]).toContain(';');
+      expect(allMatches[0]?.[0]).toBe('password=secret;');
+      expect(allMatches[0]?.[1]).toBe('password=');
+      expect(allMatches[0]?.[2]).toBe(';');
     });

As per coding guidelines **/*.test.{js,ts,jsx,tsx}: Unit tests should follow best practices for test organization, assertions, and coverage.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/data-sanitization/test/matchers.test.ts` around lines 268 - 279, The
test for cookieAndFormEncodedMatcher is too weak — replace the loose
toContain(';') assertion with precise checks that the regex actually captures
the semicolon as part of the value: assert the full match equals
'password=secret;username=mark' (allMatches[0]?.[0]) and/or assert the value
capture group equals 'secret;username=mark' (allMatches[0]?.[1]) so the test
fails if the semicolon becomes a delimiter.

---

230-240: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Replace permissive assertions with deterministic expectations.

Line 239 (>= 1) is overly permissive, and Line 897 (>= 0) is always true. These assertions don’t reliably validate matcher behavior.

Proposed assertion tightening

     it('should match a field with an empty value', () => {
@@
-      // Assert — document current behavior when the value is empty
-      expect(allMatches.length).toBeGreaterThanOrEqual(1);
+      // Assert
+      expect(allMatches.length).toBe(1);
+      expect(allMatches[0]?.[0]).toBe('password=&');
     });
@@
     it('should handle values that contain escaped backslashes', () => {
@@
-      // Assert — the \\\\  in the value may interact with the regex stop pattern; document current behavior
-      expect(allMatches.length).toBeGreaterThanOrEqual(0);
+      // Assert
+      expect(allMatches.length).toBe(1);
+      expect(allMatches[0]?.[0]).toBe('\\"password\\":\\"sec\\\\ret\\"');
     });

As per coding guidelines **/*.test.{js,ts,jsx,tsx}: Unit tests should follow best practices for test organization, assertions, and coverage.

Also applies to: 887-898

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/data-sanitization/test/matchers.test.ts` around lines 230 - 240, The
test using cookieAndFormEncodedMatcher('password') is asserting a permissive
expect(allMatches.length).toBeGreaterThanOrEqual(1) which is non-deterministic;
change it to assert exact, deterministic behavior by checking that
allMatches.length equals the expected count (e.g., 1) and verify the matched
result content (e.g., the captured name is "password" and the captured value is
the empty string) using the iterator result from testData.matchAll(matcher).
Replace the >= assertions in this test and the similar assertions around lines
887–898 with precise expectations for length and captured groups so the matcher
behavior is unambiguous.