fix(core): sanitize JSONB + fail-closed gate + Postgres type coverage

[faculopezscala]

Summary

Three related fixes in the sanitizer module, all aimed at closing the gap
between "PII columns sow knows about" and "columns sow actually ships to
the sandbox".

Issue #4 — JSONB PII leak (closed)

jsonb columns were being copied to the branch verbatim. Real schemas
put PII inside metadata::jsonb constantly ({"email": "..."} in audit
rows, nested contact objects, array-of-user payloads), so this was an
actual leak through the sandbox.

The new JSONB transformer parses the value, walks it recursively, and
replaces any field whose key matches the built-in column-name patterns
(email, phone, firstName, etc.) with the corresponding faker
output — using the same deterministic seed so cross-table consistency
is preserved. Invalid JSON passes through untouched. Scalars, arrays,
deeply nested objects all handled.

Issue #9 — Fail-closed sanitization gate

Unknown Postgres types (a new enum, pg_lsn, hstore, a custom
composite type) previously slipped past the sanitizer and landed in
the branch unchanged. The acquisition-vs-retention reasoning: sow can
always ship an error with --allow-unsafe as the escape hatch, but it
cannot un-leak PII after the fact. So default = abort.

createSanitizer now walks every column of every sampled table, runs
each Postgres type through classifyPgType (safe / handled / unknown),
and throws SanitizationAbort with a clear multi-column error message
if any unknown types are found and config.allowUnsafe is not set.

When --allow-unsafe is passed, the offending columns are NULLed out
in the sanitized output (not passed through!) and a warning list is
surfaced in SanitizationResult.warnings for later sow doctor
reporting. The flag is wired through cli.ts → runConnect →
createConnector → sanitizationConfig.allowUnsafe.

Explicit rules in .sow.yml (sanitize.rules: [...]) always take
precedence over the gate — if the user says "this column is
free_text", the gate skips it.

Issue #10 — Postgres type coverage extension

Extended PIIType and the detector/transformer maps to handle the
long tail of Postgres types the sanitizer was previously uncertain
about. Everything below is now either handled with a dedicated
transformer or explicitly marked safe-passthrough so the fail-closed
gate doesn't trip on common schemas:

Postgres type	Handling
jsonb, json	Recursive field-by-key sanitization
inet, cidr	ip_address transformer (preserves CIDR suffix)
macaddr, macaddr8	mac_address transformer (faker internet.mac())
xml	xml_text transformer (lorem wrapped in <root>)
bytea	binary_blob passthrough (opt-in via explicit rule if needed)
money, interval	safe passthrough
int4range, int8range, numrange, tsrange, tstzrange, daterange	safe passthrough
text[], int4[], _text etc.	base type stripped via stripArraySuffix, classified via base
Custom enums	safe passthrough when the enum name is captured by the analyzer (analysis.schema.enums is now threaded into the sanitizer)

Test plan

• bunx vitest run — 120 passing (was 83/89; +31 new tests)
• bunx turbo build — clean
• bunx eslint on touched files — no new warnings (two pre-existing unused-import warnings in connector.ts and connect.ts untouched)
• Integration test against a live Postgres with jsonb containing PII (not run — no live DB in this env)
• Integration test against a schema with a custom enum + hstore column (not run — no live DB)

New tests (31 total)

• transformer.test.ts: +22 tests (7 JSONB cases including nested, arrays, invalid JSON, scalar passthrough, preservation of non-PII fields; 7 new-type transformers; determinism checks)
• detector.test.ts: +9 tests (classifyPgType for safe/handled/unknown/arrays/enums, pgTypeToPIIType mapping, type-intrinsic PII detection for jsonb and inet)
• sanitizer-gate.test.ts (new): 8 tests (throws by default, lists columns in error, NULLs on allowUnsafe, explicit rule precedence, safe types pass, custom enums pass, jsonb end-to-end, no-op when no unknown types)

Follow-ups I'd recommend

Integration tests that would need a live Postgres:

• A real jsonb roundtrip (driver parsing differs — some pg drivers return parsed objects, others return strings)
• A schema with hstore to confirm the abort message renders correctly end-to-end
• A custom enum threaded through analyzer → sanitizer to verify schema.enums population matches the classifyPgType lookup

Out-of-scope gaps I noticed while working:

• SanitizationConfig is duplicated inline inside connector.ts (rules: [] as { table; column; type: any }[]) rather than importing the type — worth cleaning up.
• There's no yaml-config surface yet for allowUnsafe — only the CLI flag. A .sow.yml key would be natural for teams that want to opt a project into it permanently.
• free_text transformer for xml fields may still leak PII if someone has email addresses inside their XML blobs — keyed sanitization of XML is doable with a proper parser but not in scope here.

🤖 Generated with Claude Code