@datafog/fogclaw 0.1.5 → 0.1.6

package/dist/scanner.js

@@ -1,17 +1,30 @@
+import { canonicalType } from "./types.js";
 import { RegexEngine } from "./engines/regex.js";
 import { GlinerEngine } from "./engines/gliner.js";
+function normalizeAllowlistValue(value) {
+    return value.trim().toLowerCase();
+}
+function buildPatternMaps(value) {
+    if (!value || value.length === 0) {
+        return [];
+    }
+    return value.map((pattern) => new RegExp(pattern, "i"));
+}
 export class Scanner {
     regexEngine;
     glinerEngine;
     glinerAvailable = false;
     config;
+    allowlist;
     constructor(config) {
         this.config = config;
         this.regexEngine = new RegexEngine();
-        this.glinerEngine = new GlinerEngine(config.model, config.confidence_threshold);
+        const glinerThreshold = this.computeGlinerThreshold(config);
+        this.glinerEngine = new GlinerEngine(config.model, glinerThreshold);
         if (config.custom_entities.length > 0) {
             this.glinerEngine.setCustomLabels(config.custom_entities);
         }
+        this.allowlist = this.buildAllowlistCache(config.allowlist);
     }
     async initialize() {
         try {
@@ -27,12 +40,14 @@ export class Scanner {
         if (!text)
             return { entities: [], text };
         // Step 1: Regex pass (always runs, synchronous)
-        const regexEntities = this.regexEngine.scan(text);
+        const regexEntities = this.filterByPolicy(this.regexEngine.scan(text));
         // Step 2: GLiNER pass (if available)
         let glinerEntities = [];
         if (this.glinerAvailable) {
             try {
                 glinerEntities = await this.glinerEngine.scan(text, extraLabels);
+                glinerEntities = this.filterByConfidence(glinerEntities);
+                glinerEntities = this.filterByPolicy(glinerEntities);
             }
             catch (err) {
                 console.warn(`[fogclaw] GLiNER scan failed, using regex results only: ${err instanceof Error ? err.message : String(err)}`);
@@ -42,6 +57,65 @@ export class Scanner {
         const merged = deduplicateEntities([...regexEntities, ...glinerEntities]);
         return { entities: merged, text };
     }
+    filterByConfidence(entities) {
+        return entities.filter((entity) => {
+            const threshold = this.getThresholdForLabel(entity.label);
+            return entity.confidence >= threshold;
+        });
+    }
+    filterByPolicy(entities) {
+        if (this.allowlist.values.size === 0 &&
+            this.allowlist.patterns.length === 0 &&
+            this.allowlist.entityValues.size === 0) {
+            return entities;
+        }
+        return entities.filter((entity) => !this.shouldAllowlistEntity(entity));
+    }
+    shouldAllowlistEntity(entity) {
+        const normalizedText = normalizeAllowlistValue(entity.text);
+        if (this.allowlist.values.has(normalizedText)) {
+            return true;
+        }
+        if (this.allowlist.patterns.some((pattern) => pattern.test(entity.text))) {
+            return true;
+        }
+        const entityValues = this.allowlist.entityValues.get(entity.label);
+        if (entityValues && entityValues.has(normalizedText)) {
+            return true;
+        }
+        return false;
+    }
+    getThresholdForLabel(label) {
+        const canonicalLabel = canonicalType(label);
+        return this.config.entityConfidenceThresholds[canonicalLabel] ?? this.config.confidence_threshold;
+    }
+    computeGlinerThreshold(config) {
+        const thresholds = Object.values(config.entityConfidenceThresholds);
+        if (thresholds.length === 0) {
+            return config.confidence_threshold;
+        }
+        return Math.min(config.confidence_threshold, ...thresholds);
+    }
+    buildAllowlistCache(allowlist) {
+        const globalValues = new Set(allowlist.values.map((value) => normalizeAllowlistValue(value)));
+        const globalPatterns = buildPatternMaps(allowlist.patterns);
+        const entityValues = new Map();
+        for (const [entityType, values] of Object.entries(allowlist.entities)) {
+            const canonical = canonicalType(entityType);
+            const uniqueValues = values
+                .map((value) => normalizeAllowlistValue(value))
+                .filter((value) => value.length > 0);
+            entityValues.set(canonical, new Set(uniqueValues));
+        }
+        return {
+            values: globalValues,
+            patterns: globalPatterns,
+            entityValues,
+        };
+    }
+    get isGlinerAvailable() {
+        return this.glinerAvailable;
+    }
 }
 /**
  * Remove overlapping entity spans. When two entities overlap,

package/dist/scanner.js.map

@@ -1 +1 @@
-{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,OAAO,OAAO;IACV,WAAW,CAAc;IACzB,YAAY,CAAe;IAC3B,eAAe,GAAG,KAAK,CAAC;IACxB,MAAM,CAAgB;IAE9B,YAAY,MAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAClC,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,oBAAoB,CAC5B,CAAC;QACF,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;YACrC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CACV,2EAA2E,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9H,CAAC;YACF,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,WAAsB;QAC7C,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAEzC,gDAAgD;QAChD,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAElD,qCAAqC;QACrC,IAAI,cAAc,GAAa,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YACnE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,2DAA2D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9H,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,MAAM,MAAM,GAAG,mBAAmB,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC;QAE1E,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,QAAkB;IAC7C,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE1C,wDAAwD;IACxD,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACzC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QAClD,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAErC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEvC,oBAAoB;QACpB,IAAI,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,mEAAmE;YACnE,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;gBACzC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC;YACtC,CAAC;YACD,0CAA0C;QAC5C,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAQnD,SAAS,uBAAuB,CAAC,KAAa;IAC5C,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAA2B;IACnD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,OAAO,OAAO;IACV,WAAW,CAAc;IACzB,YAAY,CAAe;IAC3B,eAAe,GAAG,KAAK,CAAC;IACxB,MAAM,CAAgB;IACtB,SAAS,CAAwB;IAEzC,YAAY,MAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;QAErC,MAAM,eAAe,GAAG,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QACpE,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;YACrC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CACV,2EAA2E,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9H,CAAC;YACF,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,WAAsB;QAC7C,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAEzC,gDAAgD;QAChD,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAEvE,qCAAqC;QACrC,IAAI,cAAc,GAAa,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBACjE,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;gBACzD,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CACV,2DACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,MAAM,MAAM,GAAG,mBAAmB,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC;QAE1E,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC;IAEO,kBAAkB,CAAC,QAAkB;QAC3C,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;YAChC,MAAM,SAAS,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1D,OAAO,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,QAAkB;QACvC,IACE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;YAChC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YACpC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,EACtC,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1E,CAAC;IAEO,qBAAqB,CAAC,MAAc;QAC1C,MAAM,cAAc,GAAG,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAE5D,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACzE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,YAAY,IAAI,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,oBAAoB,CAAC,KAAa;QACxC,MAAM,cAAc,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;IACpG,CAAC;IAEO,sBAAsB,CAAC,MAAqB;QAClD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACpE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,MAAM,CAAC,oBAAoB,CAAC;QACrC,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,UAAU,CAAC,CAAC;IAC9D,CAAC;IAEO,mBAAmB,CAAC,SAAqC;QAC/D,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAChE,CAAC;QAEF,MAAM,cAAc,GAAG,gBAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAE5D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;QACpD,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtE,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;YAC5C,MAAM,YAAY,GAAG,MAAM;iBACxB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;iBAC9C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACvC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;QACrD,CAAC;QAED,OAAO;YACL,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,cAAc;YACxB,YAAY;SACb,CAAC;IACJ,CAAC;IAED,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,QAAkB;IAC7C,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE1C,wDAAwD;IACxD,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACzC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QAClD,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAErC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEvC,oBAAoB;QACpB,IAAI,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,mEAAmE;YACnE,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;gBACzC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC;YACtC,CAAC;YACD,0CAA0C;QAC5C,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/types.d.ts

@@ -8,6 +8,14 @@ export interface Entity {
 }
 export type RedactStrategy = "token" | "mask" | "hash";
 export type GuardrailAction = "redact" | "block" | "warn";
+export interface EntityConfidenceThresholds {
+    [entityType: string]: number;
+}
+export interface EntityAllowlist {
+    values: string[];
+    patterns: string[];
+    entities: Record<string, string[]>;
+}
 export interface FogClawConfig {
     enabled: boolean;
     guardrail_mode: GuardrailAction;
@@ -16,6 +24,9 @@ export interface FogClawConfig {
     confidence_threshold: number;
     custom_entities: string[];
     entityActions: Record<string, GuardrailAction>;
+    entityConfidenceThresholds: EntityConfidenceThresholds;
+    allowlist: EntityAllowlist;
+    auditEnabled: boolean;
 }
 export interface ScanResult {
     entities: Entity[];
@@ -26,6 +37,11 @@ export interface RedactResult {
     mapping: Record<string, string>;
     entities: Entity[];
 }
+export interface GuardrailPlan {
+    blocked: Entity[];
+    warned: Entity[];
+    redacted: Entity[];
+}
 export declare const CANONICAL_TYPE_MAP: Record<string, string>;
 export declare function canonicalType(entityType: string): string;
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,OAAO,GAAG,QAAQ,CAAC;CAC5B;AAED,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAEvD,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,eAAe,CAAC;IAChC,cAAc,EAAE,cAAc,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,oBAAoB,EAAE,MAAM,CAAC;IAC7B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAYrD,CAAC;AAEF,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAGxD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,OAAO,GAAG,QAAQ,CAAC;CAC5B;AAED,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAEvD,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,0BAA0B;IACzC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,eAAe,CAAC;IAChC,cAAc,EAAE,cAAc,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,oBAAoB,EAAE,MAAM,CAAC;IAC7B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC/C,0BAA0B,EAAE,0BAA0B,CAAC;IACvD,SAAS,EAAE,eAAe,CAAC;IAC3B,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAYrD,CAAC;AAEF,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAGxD"}

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAkCA,MAAM,CAAC,MAAM,kBAAkB,GAA2B;IACxD,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,UAAU;IACf,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,cAAc;IACnB,GAAG,EAAE,UAAU;IACf,GAAG,EAAE,UAAU;IACf,GAAG,EAAE,SAAS;IACd,YAAY,EAAE,OAAO;IACrB,sBAAsB,EAAE,KAAK;IAC7B,kBAAkB,EAAE,aAAa;IACjC,aAAa,EAAE,MAAM;CACtB,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,MAAM,UAAU,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACnD,OAAO,kBAAkB,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC;AACtD,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAqDA,MAAM,CAAC,MAAM,kBAAkB,GAA2B;IACxD,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,UAAU;IACf,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,cAAc;IACnB,GAAG,EAAE,UAAU;IACf,GAAG,EAAE,UAAU;IACf,GAAG,EAAE,SAAS;IACd,YAAY,EAAE,OAAO;IACrB,sBAAsB,EAAE,KAAK;IAC7B,kBAAkB,EAAE,aAAa;IACjC,aAAa,EAAE,MAAM;CACtB,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,MAAM,UAAU,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACnD,OAAO,kBAAkB,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC;AACtD,CAAC"}

package/fogclaw.config.example.json

@@ -4,6 +4,10 @@
   "redactStrategy": "token",
   "model": "onnx-community/gliner_large-v2.1",
   "confidence_threshold": 0.5,
+  "entityConfidenceThresholds": {
+    "PERSON": 0.6,
+    "ORGANIZATION": 0.7
+  },
   "custom_entities": ["project codename", "internal tool name"],
   "entityActions": {
     "SSN": "block",
@@ -11,5 +15,19 @@
     "EMAIL": "redact",
     "PHONE": "redact",
     "PERSON": "warn"
-  }
+  },
+  "allowlist": {
+    "values": [
+      "noreply@example.com"
+    ],
+    "patterns": [
+      "^internal-"
+    ],
+    "entities": {
+      "PERSON": [
+        "john doe"
+      ]
+    }
+  },
+  "auditEnabled": true
 }

package/openclaw.plugin.json

@@ -1,8 +1,8 @@
 {
   "id": "fogclaw",
   "name": "FogClaw",
-  "version": "0.1.4",
-  "description": "PII detection & custom entity redaction powered by DataFog",
+  "version": "0.1.6",
+  "description": "PII detection & custom entity redaction plugin powered by DataFog",
   "configSchema": {
     "type": "object",
     "properties": {
@@ -30,6 +30,15 @@
         "minimum": 0,
         "maximum": 1
       },
+      "entityConfidenceThresholds": {
+        "type": "object",
+        "additionalProperties": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 1
+        },
+        "default": {}
+      },
       "custom_entities": {
         "type": "array",
         "items": {
@@ -44,6 +53,43 @@
           "enum": ["redact", "block", "warn"]
         },
         "default": {}
+      },
+      "allowlist": {
+        "type": "object",
+        "properties": {
+          "values": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "default": []
+          },
+          "patterns": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "default": []
+          },
+          "entities": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        },
+        "default": {
+          "values": [],
+          "patterns": [],
+          "entities": {}
+        }
+      },
+      "auditEnabled": {
+        "type": "boolean",
+        "default": true
       }
     }
   },
@@ -70,6 +116,11 @@
       "help": "Minimum GLiNER score (0-1) required before an entity is treated as a detection.",
       "advanced": true
     },
+    "entityConfidenceThresholds": {
+      "label": "Per-Entity Confidence Thresholds",
+      "help": "Override confidence thresholds by entity label (for example: {\"PERSON\": 0.95, \"ORGANIZATION\": 0.7}).",
+      "advanced": true
+    },
     "custom_entities": {
       "label": "Custom Entity Labels",
       "help": "Extra labels to detect as sensitive entities (for example: `project code`, `competitor name`)."
@@ -78,6 +129,16 @@
       "label": "Entity Actions",
       "help": "Map specific entity labels to per-entity behavior (for example: {\"EMAIL\": \"block\", \"PHONE\": \"redact\"}).",
       "advanced": true
+    },
+    "allowlist": {
+      "label": "Allowlist / Exemptions",
+      "help": "Global and per-entity allowlist entries to exclude from enforcement. Supports exact values and regex patterns.",
+      "advanced": true
+    },
+    "auditEnabled": {
+      "label": "Audit Logging",
+      "help": "Emit structured audit summaries for guardrail decisions.",
+      "advanced": true
     }
   }
 }

package/package.json

@@ -1,10 +1,17 @@
 {
   "name": "@datafog/fogclaw",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "OpenClaw plugin for PII detection & custom entity redaction powered by DataFog",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:plugin-smoke": "vitest run tests/plugin-smoke.test.ts",
+    "lint": "tsc --noEmit"
+  },
   "dependencies": {
     "gliner": "^0.0.19",
     "onnxruntime-node": "1.19.2",
@@ -32,12 +39,5 @@
   "overrides": {
     "onnxruntime-web": "1.21.0",
     "sharp": "0.34.5"
-  },
-  "scripts": {
-    "build": "tsc",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:plugin-smoke": "vitest run tests/plugin-smoke.test.ts",
-    "lint": "tsc --noEmit"
   }
-}
+}

package/src/config.ts

@@ -1,8 +1,109 @@
-import type { FogClawConfig, GuardrailAction, RedactStrategy } from "./types.js";
+import {
+  canonicalType,
+  type EntityAllowlist,
+  type FogClawConfig,
+  type GuardrailAction,
+  type RedactStrategy,
+} from "./types.js";
 
 const VALID_GUARDRAIL_MODES: GuardrailAction[] = ["redact", "block", "warn"];
 const VALID_REDACT_STRATEGIES: RedactStrategy[] = ["token", "mask", "hash"];
 
+function ensureStringList(value: unknown, path: string): string[] {
+  if (!Array.isArray(value)) {
+    throw new Error(`${path} must be an array of strings`);
+  }
+
+  const entries = value.filter((entry): entry is string => {
+    if (typeof entry !== "string") {
+      throw new Error(`${path} must contain only strings`);
+    }
+
+    return true;
+  });
+
+  return entries.map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+}
+
+function ensureEntityAllowlist(value: unknown): EntityAllowlist {
+  if (value == null) {
+    return { values: [], patterns: [], entities: {} };
+  }
+
+  if (typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("allowlist must be an object");
+  }
+
+  const raw = value as Record<string, unknown>;
+  const values = ensureStringList(raw.values ?? [], "allowlist.values");
+  const patterns = ensureStringList(raw.patterns ?? [], "allowlist.patterns");
+
+  for (const pattern of patterns) {
+    try {
+      new RegExp(pattern);
+    } catch {
+      throw new Error(`allowlist.patterns contains invalid regex pattern: "${pattern}"`);
+    }
+  }
+
+  const entitiesValue = raw.entities ?? {};
+  if (
+    typeof entitiesValue !== "object" ||
+    Array.isArray(entitiesValue) ||
+    entitiesValue === null
+  ) {
+    throw new Error("allowlist.entities must be an object mapping entity labels to string arrays");
+  }
+
+  const entities: Record<string, string[]> = {};
+  for (const [entityType, entryValue] of Object.entries(entitiesValue)) {
+    const normalizedType = canonicalType(entityType);
+    entities[normalizedType] = ensureStringList(entryValue, `allowlist.entities.${entityType}`);
+  }
+
+  return {
+    values: [...new Set(values)],
+    patterns: [...new Set(patterns)],
+    entities,
+  };
+}
+
+function ensureEntityConfidenceThresholds(
+  value: unknown,
+): Record<string, number> {
+  if (!value) {
+    return {};
+  }
+
+  if (typeof value !== "object" || Array.isArray(value) || value === null) {
+    throw new Error("entityConfidenceThresholds must be an object");
+  }
+
+  const raw = value as Record<string, unknown>;
+  const normalized: Record<string, number> = {};
+
+  for (const [entityType, rawThreshold] of Object.entries(raw)) {
+    if (typeof rawThreshold !== "number" || Number.isNaN(rawThreshold)) {
+      throw new Error(
+        `entityConfidenceThresholds["${entityType}"] must be a number between 0 and 1, got ${String(
+          rawThreshold,
+        )}`,
+      );
+    }
+
+    if (rawThreshold < 0 || rawThreshold > 1) {
+      throw new Error(
+        `entityConfidenceThresholds["${entityType}"] must be between 0 and 1, got ${rawThreshold}`,
+      );
+    }
+
+    const canonicalTypeKey = canonicalType(entityType);
+    normalized[canonicalTypeKey] = rawThreshold;
+  }
+
+  return normalized;
+}
+
 export const DEFAULT_CONFIG: FogClawConfig = {
   enabled: true,
   guardrail_mode: "redact",
@@ -11,10 +112,37 @@ export const DEFAULT_CONFIG: FogClawConfig = {
   confidence_threshold: 0.5,
   custom_entities: [],
   entityActions: {},
+  entityConfidenceThresholds: {},
+  allowlist: {
+    values: [],
+    patterns: [],
+    entities: {},
+  },
+  auditEnabled: true,
 };
 
 export function loadConfig(overrides: Partial<FogClawConfig>): FogClawConfig {
-  const config: FogClawConfig = { ...DEFAULT_CONFIG, ...overrides };
+  const config: FogClawConfig = {
+    ...DEFAULT_CONFIG,
+    ...overrides,
+    entityActions: {
+      ...DEFAULT_CONFIG.entityActions,
+      ...(overrides.entityActions ?? {}),
+    },
+    entityConfidenceThresholds: {
+      ...DEFAULT_CONFIG.entityConfidenceThresholds,
+      ...(overrides.entityConfidenceThresholds ?? {}),
+    },
+  };
+
+  config.allowlist = ensureEntityAllowlist(overrides.allowlist ?? DEFAULT_CONFIG.allowlist);
+  config.entityConfidenceThresholds = ensureEntityConfidenceThresholds(
+    config.entityConfidenceThresholds,
+  );
+
+  if (typeof config.enabled !== "boolean") {
+    throw new Error(`enabled must be true or false`);
+  }
 
   if (!VALID_GUARDRAIL_MODES.includes(config.guardrail_mode)) {
     throw new Error(
@@ -34,13 +162,22 @@ export function loadConfig(overrides: Partial<FogClawConfig>): FogClawConfig {
     );
   }
 
+  if (typeof config.auditEnabled !== "boolean") {
+    throw new Error(`auditEnabled must be true or false`);
+  }
+
+  const normalizedActions: Record<string, GuardrailAction> = {};
   for (const [entityType, action] of Object.entries(config.entityActions)) {
     if (!VALID_GUARDRAIL_MODES.includes(action)) {
       throw new Error(
         `Invalid action "${action}" for entity type "${entityType}". Must be one of: ${VALID_GUARDRAIL_MODES.join(", ")}`,
       );
     }
+
+    const normalizedType = canonicalType(entityType);
+    normalizedActions[normalizedType] = action;
   }
+  config.entityActions = normalizedActions;
 
   return config;
 }