@runflow-ai/sdk 1.0.94 → 1.0.96

package/dist/privacy/patterns.d.ts

@@ -0,0 +1,38 @@
+/**
+ * ============================================================================
+ * RUNFLOW SDK - PII DETECTION PATTERNS
+ * ============================================================================
+ *
+ * Region-specific and universal PII detection patterns.
+ * Each pattern includes validation to reduce false positives.
+ */
+import type { PIIPattern, PIILocale } from './types';
+/**
+ * Field names that indicate PII content regardless of value format.
+ * Case-insensitive matching is applied.
+ * These are matched EXACTLY (after normalization).
+ */
+export declare const DEFAULT_SENSITIVE_FIELDS: string[];
+/**
+ * Tokens that indicate PII when they appear in a field name.
+ * Split into two groups:
+ *
+ * ALWAYS_SENSITIVE: tokens that indicate PII even as standalone field names.
+ *   e.g., field named 'cpf', 'email', 'phone' → always redact.
+ *
+ * COMPOUND_ONLY: tokens that indicate PII only when part of a compound name.
+ *   e.g., 'name' alone could be a tool name or agent name (not PII),
+ *   but 'contactName' or 'nome_contato' → PII.
+ */
+export declare const SENSITIVE_TOKENS_ALWAYS: Set<string>;
+export declare const SENSITIVE_TOKENS_COMPOUND: Set<string>;
+/**
+ * Get all patterns for specified locales.
+ * 'common' patterns are always included.
+ */
+export declare function getPatterns(locales: PIILocale[]): PIIPattern[];
+/**
+ * Get all available patterns across all locales
+ */
+export declare function getAllPatterns(): PIIPattern[];
+//# sourceMappingURL=patterns.d.ts.map

package/dist/privacy/patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../src/privacy/patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AA4RrD;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,EAiC5C,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,EAAE,GAAG,CAAC,MAAM,CAe9C,CAAC;AAEH,eAAO,MAAM,yBAAyB,EAAE,GAAG,CAAC,MAAM,CAIhD,CAAC;AAaH;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,UAAU,EAAE,CAmB9D;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,UAAU,EAAE,CAE7C"}

package/dist/privacy/patterns.js

@@ -0,0 +1,388 @@
+"use strict";
+/**
+ * ============================================================================
+ * RUNFLOW SDK - PII DETECTION PATTERNS
+ * ============================================================================
+ *
+ * Region-specific and universal PII detection patterns.
+ * Each pattern includes validation to reduce false positives.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SENSITIVE_TOKENS_COMPOUND = exports.SENSITIVE_TOKENS_ALWAYS = exports.DEFAULT_SENSITIVE_FIELDS = void 0;
+exports.getPatterns = getPatterns;
+exports.getAllPatterns = getAllPatterns;
+// ============================================================================
+// VALIDATION HELPERS
+// ============================================================================
+/**
+ * Validate CPF using check digits algorithm
+ */
+function isValidCPF(cpf) {
+    const digits = cpf.replace(/\D/g, '');
+    if (digits.length !== 11)
+        return false;
+    if (/^(\d)\1{10}$/.test(digits))
+        return false;
+    let sum = 0;
+    for (let i = 0; i < 9; i++)
+        sum += parseInt(digits[i]) * (10 - i);
+    let check = 11 - (sum % 11);
+    if (check >= 10)
+        check = 0;
+    if (parseInt(digits[9]) !== check)
+        return false;
+    sum = 0;
+    for (let i = 0; i < 10; i++)
+        sum += parseInt(digits[i]) * (11 - i);
+    check = 11 - (sum % 11);
+    if (check >= 10)
+        check = 0;
+    return parseInt(digits[10]) === check;
+}
+/**
+ * Validate CNPJ using check digits algorithm
+ */
+function isValidCNPJ(cnpj) {
+    const digits = cnpj.replace(/\D/g, '');
+    if (digits.length !== 14)
+        return false;
+    if (/^(\d)\1{13}$/.test(digits))
+        return false;
+    const weights1 = [5, 4, 3, 2, 9, 8, 7, 6, 5, 4, 3, 2];
+    const weights2 = [6, 5, 4, 3, 2, 9, 8, 7, 6, 5, 4, 3, 2];
+    let sum = 0;
+    for (let i = 0; i < 12; i++)
+        sum += parseInt(digits[i]) * weights1[i];
+    let check = sum % 11 < 2 ? 0 : 11 - (sum % 11);
+    if (parseInt(digits[12]) !== check)
+        return false;
+    sum = 0;
+    for (let i = 0; i < 13; i++)
+        sum += parseInt(digits[i]) * weights2[i];
+    check = sum % 11 < 2 ? 0 : 11 - (sum % 11);
+    return parseInt(digits[13]) === check;
+}
+/**
+ * Luhn algorithm for credit card validation
+ */
+function isValidLuhn(number) {
+    const digits = number.replace(/\D/g, '');
+    if (digits.length < 13 || digits.length > 19)
+        return false;
+    let sum = 0;
+    let isEven = false;
+    for (let i = digits.length - 1; i >= 0; i--) {
+        let digit = parseInt(digits[i]);
+        if (isEven) {
+            digit *= 2;
+            if (digit > 9)
+                digit -= 9;
+        }
+        sum += digit;
+        isEven = !isEven;
+    }
+    return sum % 10 === 0;
+}
+// ============================================================================
+// BRAZILIAN PATTERNS
+// ============================================================================
+const BR_PATTERNS = [
+    {
+        id: 'br_cpf',
+        label: 'CPF',
+        category: 'document',
+        pattern: /\b\d{3}\.?\d{3}\.?\d{3}-?\d{2}\b/g,
+        validate: isValidCPF,
+    },
+    {
+        id: 'br_cnpj',
+        label: 'CNPJ',
+        category: 'document',
+        pattern: /\b\d{2}\.?\d{3}\.?\d{3}\/?\d{4}-?\d{2}\b/g,
+        validate: isValidCNPJ,
+    },
+    {
+        id: 'br_rg',
+        label: 'RG',
+        category: 'document',
+        pattern: /\b\d{2}\.?\d{3}\.?\d{3}-?[\dxX]\b/g,
+    },
+    {
+        id: 'br_phone',
+        label: 'Telefone BR',
+        category: 'contact',
+        pattern: /(?:\+55\s?)?(?:\(?\d{2}\)?\s?)?\d{4,5}[-.\s]?\d{4}\b/g,
+    },
+    {
+        id: 'br_cep',
+        label: 'CEP',
+        category: 'location',
+        pattern: /\b\d{5}-?\d{3}\b/g,
+    },
+    {
+        id: 'br_pis_pasep',
+        label: 'PIS/PASEP',
+        category: 'document',
+        pattern: /\b\d{3}\.?\d{5}\.?\d{2}-?\d\b/g,
+    },
+    {
+        id: 'br_cns',
+        label: 'Cartao Nacional de Saude',
+        category: 'health',
+        pattern: /\b[12]\d{2}\s?\d{4}\s?\d{4}\s?\d{4}\b/g,
+    },
+    {
+        id: 'br_titulo_eleitor',
+        label: 'Titulo de Eleitor',
+        category: 'document',
+        pattern: /\b\d{4}\s?\d{4}\s?\d{4}\b/g,
+    },
+];
+// ============================================================================
+// US PATTERNS
+// ============================================================================
+const US_PATTERNS = [
+    {
+        id: 'us_ssn',
+        label: 'SSN',
+        category: 'document',
+        pattern: /\b\d{3}-?\d{2}-?\d{4}\b/g,
+        validate: (match) => {
+            const digits = match.replace(/\D/g, '');
+            if (digits.length !== 9)
+                return false;
+            // SSN cannot start with 000, 666, or 9xx
+            const area = parseInt(digits.substring(0, 3));
+            return area !== 0 && area !== 666 && area < 900;
+        },
+    },
+    {
+        id: 'us_phone',
+        label: 'US Phone',
+        category: 'contact',
+        pattern: /(?:\+1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b/g,
+    },
+    {
+        id: 'us_zip',
+        label: 'ZIP Code',
+        category: 'location',
+        pattern: /\b\d{5}(?:-\d{4})?\b/g,
+    },
+    {
+        id: 'us_drivers_license',
+        label: 'Drivers License',
+        category: 'document',
+        pattern: /\b[A-Z]\d{7,8}\b/g,
+    },
+    {
+        id: 'us_passport',
+        label: 'US Passport',
+        category: 'document',
+        pattern: /\b[A-Z]\d{8}\b/g,
+    },
+];
+// ============================================================================
+// EUROPEAN PATTERNS
+// ============================================================================
+const EU_PATTERNS = [
+    {
+        id: 'eu_iban',
+        label: 'IBAN',
+        category: 'financial',
+        pattern: /\b[A-Z]{2}\d{2}\s?[\dA-Z]{4}\s?[\dA-Z]{4}\s?[\dA-Z]{4}(?:\s?[\dA-Z]{4}){0,6}(?:\s?[\dA-Z]{1,4})?\b/g,
+    },
+    {
+        id: 'eu_phone',
+        label: 'EU Phone',
+        category: 'contact',
+        pattern: /\+(?:3[0-9]|4[0-9]|[1-2]\d)\s?\d{2,4}[\s.-]?\d{3,4}[\s.-]?\d{3,4}\b/g,
+    },
+    {
+        id: 'eu_vat',
+        label: 'VAT Number',
+        category: 'document',
+        pattern: /\b[A-Z]{2}\d{8,12}\b/g,
+    },
+    {
+        id: 'eu_nif_pt',
+        label: 'NIF Portugal',
+        category: 'document',
+        pattern: /\b[125689]\d{8}\b/g,
+    },
+    {
+        id: 'eu_nie_es',
+        label: 'NIE Spain',
+        category: 'document',
+        pattern: /\b[XYZ]\d{7}[A-Z]\b/g,
+    },
+];
+// ============================================================================
+// COMMON/UNIVERSAL PATTERNS
+// ============================================================================
+const COMMON_PATTERNS = [
+    {
+        id: 'email',
+        label: 'Email',
+        category: 'contact',
+        pattern: /\b[\w.+-]+@[\w-]+(?:\.[\w-]+)+\b/g,
+    },
+    {
+        id: 'credit_card',
+        label: 'Credit Card',
+        category: 'financial',
+        pattern: /\b(?:4\d{3}|5[1-5]\d{2}|3[47]\d{2}|6(?:011|5\d{2}))[- ]?\d{4}[- ]?\d{4}[- ]?\d{3,4}\b/g,
+        validate: isValidLuhn,
+    },
+    {
+        id: 'ipv4',
+        label: 'IPv4 Address',
+        category: 'network',
+        pattern: /\b(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\b/g,
+        validate: (match) => {
+            // Exclude common non-PII IPs
+            return !['0.0.0.0', '127.0.0.1', '255.255.255.255', '192.168.0.1', '10.0.0.1'].includes(match);
+        },
+    },
+    {
+        id: 'ipv6',
+        label: 'IPv6 Address',
+        category: 'network',
+        pattern: /\b(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}\b/g,
+    },
+    {
+        id: 'mac_address',
+        label: 'MAC Address',
+        category: 'network',
+        pattern: /\b(?:[0-9a-fA-F]{2}[:-]){5}[0-9a-fA-F]{2}\b/g,
+    },
+    {
+        id: 'bearer_token',
+        label: 'Bearer Token',
+        category: 'credential',
+        pattern: /Bearer\s+[A-Za-z0-9\-._~+/]+=*/g,
+    },
+    {
+        id: 'api_key_generic',
+        label: 'API Key',
+        category: 'credential',
+        pattern: /(?:api[_-]?key|apikey|api[_-]?secret|access[_-]?token|auth[_-]?token)["\s:=]+["']?([A-Za-z0-9\-._~+/]{20,})["']?/gi,
+    },
+    {
+        id: 'jwt_token',
+        label: 'JWT Token',
+        category: 'credential',
+        pattern: /\beyJ[A-Za-z0-9-_]+\.eyJ[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\b/g,
+    },
+    {
+        id: 'aws_key',
+        label: 'AWS Access Key',
+        category: 'credential',
+        pattern: /\b(?:AKIA|ABIA|ACCA|ASIA)[0-9A-Z]{16}\b/g,
+    },
+    {
+        id: 'date_of_birth',
+        label: 'Date of Birth',
+        category: 'personal',
+        pattern: /\b(?:0[1-9]|[12]\d|3[01])[/.-](?:0[1-9]|1[0-2])[/.-](?:19|20)\d{2}\b/g,
+    },
+];
+// ============================================================================
+// DEFAULT SENSITIVE FIELD NAMES
+// ============================================================================
+/**
+ * Field names that indicate PII content regardless of value format.
+ * Case-insensitive matching is applied.
+ * These are matched EXACTLY (after normalization).
+ */
+exports.DEFAULT_SENSITIVE_FIELDS = [
+    // Personal identifiers
+    'cpf', 'cnpj', 'rg', 'ssn', 'passport', 'passport_number',
+    'national_id', 'identity_number', 'document_number',
+    'drivers_license', 'cnh', 'titulo_eleitor', 'pis', 'nis',
+    // Contact information
+    'email', 'e_mail', 'phone', 'phone_number', 'telefone', 'celular',
+    'mobile', 'whatsapp', 'fax',
+    // Names
+    'full_name', 'nome', 'nome_completo', 'first_name', 'last_name',
+    'sobrenome', 'nome_mae', 'mothers_name', 'nome_pai',
+    // Address
+    'address', 'endereco', 'street', 'rua', 'logradouro', 'cep',
+    'zip', 'zip_code', 'postal_code',
+    // Financial
+    'credit_card', 'card_number', 'numero_cartao', 'bank_account',
+    'conta_bancaria', 'agencia', 'iban', 'swift',
+    // Health
+    'cns', 'cartao_sus', 'health_plan', 'plano_saude',
+    'medical_record', 'prontuario',
+    // Credentials
+    'password', 'senha', 'secret', 'token', 'api_key', 'access_key',
+    'private_key', 'secret_key',
+    // Date of birth
+    'birth_date', 'data_nascimento', 'dob', 'date_of_birth',
+    'nascimento', 'birthday',
+];
+/**
+ * Tokens that indicate PII when they appear in a field name.
+ * Split into two groups:
+ *
+ * ALWAYS_SENSITIVE: tokens that indicate PII even as standalone field names.
+ *   e.g., field named 'cpf', 'email', 'phone' → always redact.
+ *
+ * COMPOUND_ONLY: tokens that indicate PII only when part of a compound name.
+ *   e.g., 'name' alone could be a tool name or agent name (not PII),
+ *   but 'contactName' or 'nome_contato' → PII.
+ */
+exports.SENSITIVE_TOKENS_ALWAYS = new Set([
+    // Document identifiers
+    'cpf', 'cnpj', 'rg', 'ssn', 'passport', 'cnh',
+    // Contact
+    'email', 'phone', 'telefone', 'celular', 'whatsapp', 'mobile', 'fax',
+    // Names (unambiguous standalone - always PII)
+    'nome', 'sobrenome',
+    // Address
+    'endereco', 'cep', 'logradouro',
+    // Credentials
+    'password', 'senha', 'secret',
+]);
+exports.SENSITIVE_TOKENS_COMPOUND = new Set([
+    // Only PII in compound names (e.g., 'contactName', 'user_address')
+    'name', // 'name' alone = tool/agent name; 'contactName' = PII
+    'address', // 'address' alone = ambiguous; 'email_address', 'home_address' = PII
+]);
+// ============================================================================
+// PATTERN REGISTRY
+// ============================================================================
+const LOCALE_PATTERNS = {
+    br: BR_PATTERNS,
+    us: US_PATTERNS,
+    eu: EU_PATTERNS,
+    common: COMMON_PATTERNS,
+};
+/**
+ * Get all patterns for specified locales.
+ * 'common' patterns are always included.
+ */
+function getPatterns(locales) {
+    const patternSet = new Map();
+    // Always include common patterns
+    for (const pattern of COMMON_PATTERNS) {
+        patternSet.set(pattern.id, pattern);
+    }
+    // Add locale-specific patterns
+    for (const locale of locales) {
+        const patterns = LOCALE_PATTERNS[locale];
+        if (patterns) {
+            for (const pattern of patterns) {
+                patternSet.set(pattern.id, pattern);
+            }
+        }
+    }
+    return Array.from(patternSet.values());
+}
+/**
+ * Get all available patterns across all locales
+ */
+function getAllPatterns() {
+    return getPatterns(['br', 'us', 'eu', 'common']);
+}
+//# sourceMappingURL=patterns.js.map

package/dist/privacy/patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../src/privacy/patterns.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAuXH,kCAmBC;AAKD,wCAEC;AA7YD,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;GAEG;AACH,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAE9C,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAClE,IAAI,KAAK,GAAG,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,KAAK,GAAG,CAAC,CAAC;IAC3B,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAEhD,GAAG,GAAG,CAAC,CAAC;IACR,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACnE,KAAK,GAAG,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;IACxB,IAAI,KAAK,IAAI,EAAE;QAAE,KAAK,GAAG,CAAC,CAAC;IAC3B,OAAO,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAE9C,MAAM,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAEzD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACtE,IAAI,KAAK,GAAG,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;IAC/C,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAEjD,GAAG,GAAG,CAAC,CAAC;IACR,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACtE,KAAK,GAAG,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;IAC3C,OAAO,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAE3D,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,IAAI,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,GAAG,CAAC;gBAAE,KAAK,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,GAAG,IAAI,KAAK,CAAC;QACb,MAAM,GAAG,CAAC,MAAM,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E,MAAM,WAAW,GAAiB;IAChC;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,mCAAmC;QAC5C,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,2CAA2C;QACpD,QAAQ,EAAE,WAAW;KACtB;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,oCAAoC;KAC9C;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,uDAAuD;KACjE;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,mBAAmB;KAC7B;IACD;QACE,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,gCAAgC;KAC1C;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,0BAA0B;QACjC,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,wCAAwC;KAClD;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,KAAK,EAAE,mBAAmB;QAC1B,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,4BAA4B;KACtC;CACF,CAAC;AAEF,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E,MAAM,WAAW,GAAiB;IAChC;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,0BAA0B;QACnC,QAAQ,EAAE,CAAC,KAAa,EAAE,EAAE;YAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACxC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACtC,yCAAyC;YACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9C,OAAO,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,GAAG,GAAG,CAAC;QAClD,CAAC;KACF;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,uDAAuD;KACjE;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,uBAAuB;KACjC;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,KAAK,EAAE,iBAAiB;QACxB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,mBAAmB;KAC7B;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,iBAAiB;KAC3B;CACF,CAAC;AAEF,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E,MAAM,WAAW,GAAiB;IAChC;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,qGAAqG;KAC/G;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,sEAAsE;KAChF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,YAAY;QACnB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,uBAAuB;KACjC;IACD;QACE,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,cAAc;QACrB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,oBAAoB;KAC9B;IACD;QACE,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,sBAAsB;KAChC;CACF,CAAC;AAEF,+EAA+E;AAC/E,4BAA4B;AAC5B,+EAA+E;AAE/E,MAAM,eAAe,GAAiB;IACpC;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,OAAO;QACd,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,mCAAmC;KAC7C;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,wFAAwF;QACjG,QAAQ,EAAE,WAAW;KACtB;IACD;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,cAAc;QACrB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,8EAA8E;QACvF,QAAQ,EAAE,CAAC,KAAa,EAAE,EAAE;YAC1B,6BAA6B;YAC7B,OAAO,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjG,CAAC;KACF;IACD;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,cAAc;QACrB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,+CAA+C;KACzD;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,8CAA8C;KACxD;IACD;QACE,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,cAAc;QACrB,QAAQ,EAAE,YAAY;QACtB,OAAO,EAAE,iCAAiC;KAC3C;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,YAAY;QACtB,OAAO,EAAE,oHAAoH;KAC9H;IACD;QACE,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,YAAY;QACtB,OAAO,EAAE,2DAA2D;KACrE;IACD;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,gBAAgB;QACvB,QAAQ,EAAE,YAAY;QACtB,OAAO,EAAE,0CAA0C;KACpD;IACD;QACE,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,eAAe;QACtB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,uEAAuE;KACjF;CACF,CAAC;AAEF,+EAA+E;AAC/E,gCAAgC;AAChC,+EAA+E;AAE/E;;;;GAIG;AACU,QAAA,wBAAwB,GAAa;IAChD,uBAAuB;IACvB,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,iBAAiB;IACzD,aAAa,EAAE,iBAAiB,EAAE,iBAAiB;IACnD,iBAAiB,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK;IAExD,sBAAsB;IACtB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS;IACjE,QAAQ,EAAE,UAAU,EAAE,KAAK;IAE3B,QAAQ;IACR,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW;IAC/D,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU;IAEnD,UAAU;IACV,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK;IAC3D,KAAK,EAAE,UAAU,EAAE,aAAa;IAEhC,YAAY;IACZ,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc;IAC7D,gBAAgB,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO;IAE5C,SAAS;IACT,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa;IACjD,gBAAgB,EAAE,YAAY;IAE9B,cAAc;IACd,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY;IAC/D,aAAa,EAAE,YAAY;IAE3B,gBAAgB;IAChB,YAAY,EAAE,iBAAiB,EAAE,KAAK,EAAE,eAAe;IACvD,YAAY,EAAE,UAAU;CACzB,CAAC;AAEF;;;;;;;;;;GAUG;AACU,QAAA,uBAAuB,GAAgB,IAAI,GAAG,CAAC;IAC1D,uBAAuB;IACvB,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK;IAE7C,UAAU;IACV,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK;IAEpE,8CAA8C;IAC9C,MAAM,EAAE,WAAW;IAEnB,UAAU;IACV,UAAU,EAAE,KAAK,EAAE,YAAY;IAE/B,cAAc;IACd,UAAU,EAAE,OAAO,EAAE,QAAQ;CAC9B,CAAC,CAAC;AAEU,QAAA,yBAAyB,GAAgB,IAAI,GAAG,CAAC;IAC5D,mEAAmE;IACnE,MAAM,EAAO,sDAAsD;IACnE,SAAS,EAAI,qEAAqE;CACnF,CAAC,CAAC;AAEH,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E,MAAM,eAAe,GAAoC;IACvD,EAAE,EAAE,WAAW;IACf,EAAE,EAAE,WAAW;IACf,EAAE,EAAE,WAAW;IACf,MAAM,EAAE,eAAe;CACxB,CAAC;AAEF;;;GAGG;AACH,SAAgB,WAAW,CAAC,OAAoB;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEjD,iCAAiC;IACjC,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IAED,+BAA+B;IAC/B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc;IAC5B,OAAO,WAAW,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;AACnD,CAAC"}

package/dist/privacy/pii-sanitizer.d.ts

@@ -0,0 +1,122 @@
+/**
+ * ============================================================================
+ * RUNFLOW SDK - PII SANITIZER
+ * ============================================================================
+ *
+ * High-performance, configurable PII sanitization engine.
+ * Integrates with the observability pipeline via onTrace callback.
+ *
+ * Safety guarantees:
+ * - Never crashes on unexpected input (circular refs, Dates, Buffers, etc.)
+ * - Never loses non-PII data (preserves structure and special types)
+ * - Never leaks PII on internal error (fails closed)
+ * - Handles any input type: string, JSON, nested objects, arrays, mixed
+ *
+ * Usage:
+ *   const agent = new Agent({
+ *     privacy: { locales: ['br'], strategy: 'redact' },
+ *     ...
+ *   });
+ *
+ * Or standalone:
+ *   const sanitizer = new PIISanitizer({ locales: ['br'] });
+ *   const clean = sanitizer.sanitize("Meu CPF 123.456.789-09");
+ */
+import type { TraceData } from '../types';
+import type { PrivacyConfig } from './types';
+export declare class PIISanitizer {
+    private patterns;
+    private sensitiveFields;
+    private allowFields;
+    private activeCategories;
+    private config;
+    private redactionCount;
+    constructor(config?: PrivacyConfig);
+    /**
+     * Sanitize a string value by applying all active PII patterns.
+     */
+    sanitize(value: string, path?: string, field?: string): string;
+    /**
+     * Deep-sanitize any value (string, object, array).
+     * Traverses nested structures and applies both pattern and field-name detection.
+     *
+     * Safety:
+     * - Handles circular references (via seen set)
+     * - Preserves Date, Buffer, RegExp, Map, Set, Error (converts to safe representation)
+     * - Caps recursion depth to prevent stack overflow
+     * - Never throws - returns data as-is on unexpected types
+     */
+    sanitizeDeep(data: any, path?: string, field?: string): any;
+    private _sanitizeDeep;
+    /**
+     * Redact all string values in a structure (used for sensitive field objects).
+     * When a sensitive field name contains an object, ALL nested strings get redacted.
+     */
+    private _redactDeep;
+    /**
+     * Create an onTrace callback for use with ObservabilityConfig.
+     * This is the primary integration point with the RunFlow trace system.
+     *
+     * Safety: wraps everything in try/catch. On any error, returns null
+     * (cancels the trace) to prevent PII leakage. Privacy fails closed.
+     */
+    createTraceInterceptor(): (trace: TraceData) => TraceData | null | void;
+    /**
+     * Get the total number of redactions performed.
+     */
+    getRedactionCount(): number;
+    /**
+     * Reset the redaction counter.
+     */
+    resetStats(): void;
+    private applyReplacement;
+    private applyFieldRedaction;
+    /**
+     * Mask a value based on its pattern type.
+     * Shows partial data for usability while hiding the full value.
+     */
+    private maskValue;
+    /**
+     * Generic masking: show first and last char, mask the rest.
+     */
+    private maskGeneric;
+    /**
+     * Hash a value using SHA-256 (truncated).
+     * Same input always produces same output, enabling correlation without exposing data.
+     */
+    private hashValue;
+    private isSensitiveField;
+    private recordRedaction;
+}
+/**
+ * Create a PII sanitizer instance with the given configuration.
+ *
+ * @example
+ * const sanitizer = createPIISanitizer({
+ *   locales: ['br'],
+ *   strategy: 'mask',
+ *   audit: true,
+ *   onRedaction: (event) => console.log('PII found:', event.patternId),
+ * });
+ */
+export declare function createPIISanitizer(config?: PrivacyConfig): PIISanitizer;
+/**
+ * Normalize shorthand privacy config into full PrivacyConfig.
+ *
+ *   true            → { enabled: true }   (all locales)
+ *   'br'            → { locales: ['br'] }
+ *   ['br', 'us']    → { locales: ['br', 'us'] }
+ *   { ... }         → passthrough
+ */
+export declare function normalizePrivacyConfig(config: boolean | string | string[] | PrivacyConfig): PrivacyConfig | null;
+/**
+ * Build the onTrace callback from a PrivacyConfig.
+ * Used internally by Agent to wire privacy into the observability pipeline.
+ */
+export declare function buildPrivacyInterceptor(config: PrivacyConfig): (trace: TraceData) => TraceData | null | void;
+/**
+ * Compose multiple onTrace callbacks into a single callback.
+ * Handles the full onTrace contract: TraceData → continue, null → cancel, void → use original.
+ */
+export declare function composeTraceInterceptors(...interceptors: Array<((trace: TraceData) => TraceData | null | void) | undefined>): (trace: TraceData) => TraceData | null | void;
+//# sourceMappingURL=pii-sanitizer.d.ts.map

package/dist/privacy/pii-sanitizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-sanitizer.d.ts","sourceRoot":"","sources":["../../src/privacy/pii-sanitizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,KAAK,EACV,aAAa,EAMd,MAAM,SAAS,CAAC;AAuBjB,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,eAAe,CAAc;IACrC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,gBAAgB,CAA0B;IAClD,OAAO,CAAC,MAAM,CASZ;IACF,OAAO,CAAC,cAAc,CAAK;gBAEf,MAAM,GAAE,aAAkB;IA8DtC;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,SAAK,EAAE,KAAK,SAAK,GAAG,MAAM;IAsBtD;;;;;;;;;OASG;IACH,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,SAAK,EAAE,KAAK,SAAK,GAAG,GAAG;IAInD,OAAO,CAAC,aAAa;IA8HrB;;;OAGG;IACH,OAAO,CAAC,WAAW;IAyCnB;;;;;;OAMG;IACH,sBAAsB,IAAI,CAAC,KAAK,EAAE,SAAS,KAAK,SAAS,GAAG,IAAI,GAAG,IAAI;IAkEvE;;OAEG;IACH,iBAAiB,IAAI,MAAM;IAI3B;;OAEG;IACH,UAAU,IAAI,IAAI;IAQlB,OAAO,CAAC,gBAAgB;IAiCxB,OAAO,CAAC,mBAAmB;IA0B3B;;;OAGG;IACH,OAAO,CAAC,SAAS;IAkCjB;;OAEG;IACH,OAAO,CAAC,WAAW;IAKnB;;;OAGG;IACH,OAAO,CAAC,SAAS;IASjB,OAAO,CAAC,gBAAgB;IAgDxB,OAAO,CAAC,eAAe;CAyBxB;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,GAAE,aAAkB,GAAG,YAAY,CAE3E;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,aAAa,GAClD,aAAa,GAAG,IAAI,CAMtB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,aAAa,GACpB,CAAC,KAAK,EAAE,SAAS,KAAK,SAAS,GAAG,IAAI,GAAG,IAAI,CAG/C;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,KAAK,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,GAClF,CAAC,KAAK,EAAE,SAAS,KAAK,SAAS,GAAG,IAAI,GAAG,IAAI,CAqB/C"}