@stll/anonymize-wasm 2.0.1 → 2.1.0

package/dist/capabilities.d.mts

@@ -0,0 +1,123 @@
+import { o as ENTITY_CAPABILITIES } from "./constants2.mjs";
+//#region src/capabilities.d.ts
+declare const CAPABILITY_MANIFEST_SCHEMA_VERSION: 1;
+declare const CAPABILITY_RUNTIMES: readonly ["node", "python", "wasm"];
+type CapabilityRuntime = (typeof CAPABILITY_RUNTIMES)[number];
+type CapabilityManifest = {
+  schemaVersion: typeof CAPABILITY_MANIFEST_SCHEMA_VERSION;
+  runtimes: readonly CapabilityRuntime[];
+  entities: typeof ENTITY_CAPABILITIES;
+};
+/**
+ * Versioned, runtime-free discovery contract for the deterministic pipeline.
+ * The manifest contains no accuracy claims; it describes available labels,
+ * activation, provenance sources, and runtime parity only.
+ */
+declare const CAPABILITY_MANIFEST: {
+  readonly schemaVersion: 1;
+  readonly runtimes: readonly ["node", "python", "wasm"];
+  readonly entities: readonly [{
+    readonly label: "person";
+    readonly selection: "default";
+    readonly detectionSources: readonly ["trigger", "regex", "deny-list", "coreference"];
+  }, {
+    readonly label: "organization";
+    readonly selection: "default";
+    readonly detectionSources: readonly ["trigger", "deny-list", "legal-form", "gazetteer", "coreference"];
+  }, {
+    readonly label: "phone number";
+    readonly selection: "default";
+    readonly detectionSources: readonly ["regex", "trigger"];
+  }, {
+    readonly label: "address";
+    readonly selection: "default";
+    readonly detectionSources: readonly ["regex", "trigger", "deny-list"];
+  }, {
+    readonly label: "country";
+    readonly selection: "default";
+    readonly detectionSources: readonly ["country"];
+  }, {
+    readonly label: "email address";
+    readonly selection: "default";
+    readonly detectionSources: readonly ["regex"];
+  }, {
+    readonly label: "date";
+    readonly selection: "default";
+    readonly detectionSources: readonly ["regex", "trigger"];
+  }, {
+    readonly label: "date of birth";
+    readonly selection: "default";
+    readonly detectionSources: readonly ["trigger"];
+  }, {
+    readonly label: "bank account number";
+    readonly selection: "default";
+    readonly detectionSources: readonly ["regex", "trigger"];
+  }, {
+    readonly label: "iban";
+    readonly selection: "default";
+    readonly detectionSources: readonly ["regex", "trigger"];
+  }, {
+    readonly label: "tax identification number";
+    readonly selection: "default";
+    readonly detectionSources: readonly ["regex", "trigger"];
+  }, {
+    readonly label: "identity card number";
+    readonly selection: "default";
+    readonly detectionSources: readonly ["regex", "trigger"];
+  }, {
+    readonly label: "birth number";
+    readonly selection: "default";
+    readonly detectionSources: readonly ["regex", "trigger"];
+  }, {
+    readonly label: "national identification number";
+    readonly selection: "default";
+    readonly detectionSources: readonly ["regex", "trigger"];
+  }, {
+    readonly label: "social security number";
+    readonly selection: "default";
+    readonly detectionSources: readonly ["regex", "trigger"];
+  }, {
+    readonly label: "registration number";
+    readonly selection: "default";
+    readonly detectionSources: readonly ["regex", "trigger"];
+  }, {
+    readonly label: "credit card number";
+    readonly selection: "default";
+    readonly detectionSources: readonly ["regex"];
+  }, {
+    readonly label: "passport number";
+    readonly selection: "default";
+    readonly detectionSources: readonly ["regex"];
+  }, {
+    readonly label: "crypto";
+    readonly selection: "default";
+    readonly detectionSources: readonly ["regex"];
+  }, {
+    readonly label: "monetary amount";
+    readonly selection: "default";
+    readonly detectionSources: readonly ["regex", "trigger"];
+  }, {
+    readonly label: "land parcel";
+    readonly selection: "default";
+    readonly detectionSources: readonly ["trigger"];
+  }, {
+    readonly label: "misc";
+    readonly selection: "default";
+    readonly detectionSources: readonly ["regex", "deny-list"];
+  }, {
+    readonly label: "ip address";
+    readonly selection: "opt-in";
+    readonly detectionSources: readonly ["regex"];
+  }, {
+    readonly label: "mac address";
+    readonly selection: "opt-in";
+    readonly detectionSources: readonly ["regex"];
+  }, {
+    readonly label: "url";
+    readonly selection: "opt-in";
+    readonly detectionSources: readonly ["regex"];
+  }];
+};
+//#endregion
+export { CAPABILITY_MANIFEST, CAPABILITY_MANIFEST_SCHEMA_VERSION, CAPABILITY_RUNTIMES, CapabilityManifest, CapabilityRuntime };
+//# sourceMappingURL=capabilities.d.mts.map

package/dist/capabilities.mjs

@@ -0,0 +1,22 @@
+import { ENTITY_CAPABILITIES } from "./constants.mjs";
+//#region src/capabilities.ts
+const CAPABILITY_MANIFEST_SCHEMA_VERSION = 1;
+const CAPABILITY_RUNTIMES = [
+	"node",
+	"python",
+	"wasm"
+];
+/**
+* Versioned, runtime-free discovery contract for the deterministic pipeline.
+* The manifest contains no accuracy claims; it describes available labels,
+* activation, provenance sources, and runtime parity only.
+*/
+const CAPABILITY_MANIFEST = {
+	schemaVersion: 1,
+	runtimes: CAPABILITY_RUNTIMES,
+	entities: ENTITY_CAPABILITIES
+};
+//#endregion
+export { CAPABILITY_MANIFEST, CAPABILITY_MANIFEST_SCHEMA_VERSION, CAPABILITY_RUNTIMES };
+
+//# sourceMappingURL=capabilities.mjs.map

package/dist/capabilities.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.mjs","names":[],"sources":["../../src/capabilities.ts"],"sourcesContent":["import { ENTITY_CAPABILITIES } from \"./constants\";\n\nexport const CAPABILITY_MANIFEST_SCHEMA_VERSION = 1 as const;\n\nexport const CAPABILITY_RUNTIMES = [\"node\", \"python\", \"wasm\"] as const;\n\nexport type CapabilityRuntime = (typeof CAPABILITY_RUNTIMES)[number];\n\nexport type CapabilityManifest = {\n  schemaVersion: typeof CAPABILITY_MANIFEST_SCHEMA_VERSION;\n  runtimes: readonly CapabilityRuntime[];\n  entities: typeof ENTITY_CAPABILITIES;\n};\n\n/**\n * Versioned, runtime-free discovery contract for the deterministic pipeline.\n * The manifest contains no accuracy claims; it describes available labels,\n * activation, provenance sources, and runtime parity only.\n */\nexport const CAPABILITY_MANIFEST = {\n  schemaVersion: CAPABILITY_MANIFEST_SCHEMA_VERSION,\n  runtimes: CAPABILITY_RUNTIMES,\n  entities: ENTITY_CAPABILITIES,\n} as const satisfies CapabilityManifest;\n"],"mappings":";;AAEA,MAAa,qCAAqC;AAElD,MAAa,sBAAsB;CAAC;CAAQ;CAAU;AAAM;;;;;;AAe5D,MAAa,sBAAsB;CACjC,eAAA;CACA,UAAU;CACV,UAAU;AACZ"}

package/dist/constants.d.mts

@@ -1,2 +1,2 @@
-import { a as OPERATOR_TYPES, i as DetectionSource, n as DETECTION_SOURCES, o as OperatorType, r as DETECTOR_PRIORITY, t as DEFAULT_ENTITY_LABELS } from "./constants2.mjs";
-export { DEFAULT_ENTITY_LABELS, DETECTION_SOURCES, DETECTOR_PRIORITY, DetectionSource, OPERATOR_TYPES, OperatorType };
+import { a as DetectionSource, c as ENTITY_SELECTIONS, d as EntitySelection, f as OPERATOR_TYPES, i as DefaultEntityLabel, l as EntityCapability, n as DETECTION_SOURCES, o as ENTITY_CAPABILITIES, p as OperatorType, r as DETECTOR_PRIORITY, s as ENTITY_LABELS, t as DEFAULT_ENTITY_LABELS, u as EntityLabel } from "./constants2.mjs";
+export { DEFAULT_ENTITY_LABELS, DETECTION_SOURCES, DETECTOR_PRIORITY, DefaultEntityLabel, DetectionSource, ENTITY_CAPABILITIES, ENTITY_LABELS, ENTITY_SELECTIONS, EntityCapability, EntityLabel, EntitySelection, OPERATOR_TYPES, OperatorType };

package/dist/constants.mjs

@@ -49,41 +49,171 @@ const DETECTOR_PRIORITY = {
 * Anonymization operator types. Each operator defines
 * how a confirmed entity is replaced in the output.
 */
-const OPERATOR_TYPES = ["replace", "redact"];
+const OPERATOR_TYPES = [
+	"replace",
+	"redact",
+	"keep",
+	"mask"
+];
+const ENTITY_SELECTIONS = {
+	DEFAULT: "default",
+	OPT_IN: "opt-in"
+};
 /**
-* Canonical entity labels used across the pipeline.
-* NER models may use different native labels; the bench
-* NER wrapper maps model output to these canonical names.
+* Canonical entity capabilities exposed by the deterministic native pipeline.
+* `selection` describes whether the default package requests the label; opt-in
+* labels have built-in detection rules but must be requested explicitly.
 *
 * These labels are ephemeral: entities are regenerated on
 * every pipeline run and never persisted to the database.
 * Renaming a label here requires no migration.
 */
-const DEFAULT_ENTITY_LABELS = [
-	"person",
-	"organization",
-	"phone number",
-	"address",
-	"country",
-	"email address",
-	"date",
-	"date of birth",
-	"bank account number",
-	"iban",
-	"tax identification number",
-	"identity card number",
-	"birth number",
-	"national identification number",
-	"social security number",
-	"registration number",
-	"credit card number",
-	"passport number",
-	"crypto",
-	"monetary amount",
-	"land parcel",
-	"misc"
+const ENTITY_CAPABILITIES = [
+	{
+		label: "person",
+		selection: ENTITY_SELECTIONS.DEFAULT,
+		detectionSources: [
+			DETECTION_SOURCES.TRIGGER,
+			DETECTION_SOURCES.REGEX,
+			DETECTION_SOURCES.DENY_LIST,
+			DETECTION_SOURCES.COREFERENCE
+		]
+	},
+	{
+		label: "organization",
+		selection: ENTITY_SELECTIONS.DEFAULT,
+		detectionSources: [
+			DETECTION_SOURCES.TRIGGER,
+			DETECTION_SOURCES.DENY_LIST,
+			DETECTION_SOURCES.LEGAL_FORM,
+			DETECTION_SOURCES.GAZETTEER,
+			DETECTION_SOURCES.COREFERENCE
+		]
+	},
+	{
+		label: "phone number",
+		selection: ENTITY_SELECTIONS.DEFAULT,
+		detectionSources: [DETECTION_SOURCES.REGEX, DETECTION_SOURCES.TRIGGER]
+	},
+	{
+		label: "address",
+		selection: ENTITY_SELECTIONS.DEFAULT,
+		detectionSources: [
+			DETECTION_SOURCES.REGEX,
+			DETECTION_SOURCES.TRIGGER,
+			DETECTION_SOURCES.DENY_LIST
+		]
+	},
+	{
+		label: "country",
+		selection: ENTITY_SELECTIONS.DEFAULT,
+		detectionSources: [DETECTION_SOURCES.COUNTRY]
+	},
+	{
+		label: "email address",
+		selection: ENTITY_SELECTIONS.DEFAULT,
+		detectionSources: [DETECTION_SOURCES.REGEX]
+	},
+	{
+		label: "date",
+		selection: ENTITY_SELECTIONS.DEFAULT,
+		detectionSources: [DETECTION_SOURCES.REGEX, DETECTION_SOURCES.TRIGGER]
+	},
+	{
+		label: "date of birth",
+		selection: ENTITY_SELECTIONS.DEFAULT,
+		detectionSources: [DETECTION_SOURCES.TRIGGER]
+	},
+	{
+		label: "bank account number",
+		selection: ENTITY_SELECTIONS.DEFAULT,
+		detectionSources: [DETECTION_SOURCES.REGEX, DETECTION_SOURCES.TRIGGER]
+	},
+	{
+		label: "iban",
+		selection: ENTITY_SELECTIONS.DEFAULT,
+		detectionSources: [DETECTION_SOURCES.REGEX, DETECTION_SOURCES.TRIGGER]
+	},
+	{
+		label: "tax identification number",
+		selection: ENTITY_SELECTIONS.DEFAULT,
+		detectionSources: [DETECTION_SOURCES.REGEX, DETECTION_SOURCES.TRIGGER]
+	},
+	{
+		label: "identity card number",
+		selection: ENTITY_SELECTIONS.DEFAULT,
+		detectionSources: [DETECTION_SOURCES.REGEX, DETECTION_SOURCES.TRIGGER]
+	},
+	{
+		label: "birth number",
+		selection: ENTITY_SELECTIONS.DEFAULT,
+		detectionSources: [DETECTION_SOURCES.REGEX, DETECTION_SOURCES.TRIGGER]
+	},
+	{
+		label: "national identification number",
+		selection: ENTITY_SELECTIONS.DEFAULT,
+		detectionSources: [DETECTION_SOURCES.REGEX, DETECTION_SOURCES.TRIGGER]
+	},
+	{
+		label: "social security number",
+		selection: ENTITY_SELECTIONS.DEFAULT,
+		detectionSources: [DETECTION_SOURCES.REGEX, DETECTION_SOURCES.TRIGGER]
+	},
+	{
+		label: "registration number",
+		selection: ENTITY_SELECTIONS.DEFAULT,
+		detectionSources: [DETECTION_SOURCES.REGEX, DETECTION_SOURCES.TRIGGER]
+	},
+	{
+		label: "credit card number",
+		selection: ENTITY_SELECTIONS.DEFAULT,
+		detectionSources: [DETECTION_SOURCES.REGEX]
+	},
+	{
+		label: "passport number",
+		selection: ENTITY_SELECTIONS.DEFAULT,
+		detectionSources: [DETECTION_SOURCES.REGEX]
+	},
+	{
+		label: "crypto",
+		selection: ENTITY_SELECTIONS.DEFAULT,
+		detectionSources: [DETECTION_SOURCES.REGEX]
+	},
+	{
+		label: "monetary amount",
+		selection: ENTITY_SELECTIONS.DEFAULT,
+		detectionSources: [DETECTION_SOURCES.REGEX, DETECTION_SOURCES.TRIGGER]
+	},
+	{
+		label: "land parcel",
+		selection: ENTITY_SELECTIONS.DEFAULT,
+		detectionSources: [DETECTION_SOURCES.TRIGGER]
+	},
+	{
+		label: "misc",
+		selection: ENTITY_SELECTIONS.DEFAULT,
+		detectionSources: [DETECTION_SOURCES.REGEX, DETECTION_SOURCES.DENY_LIST]
+	},
+	{
+		label: "ip address",
+		selection: ENTITY_SELECTIONS.OPT_IN,
+		detectionSources: [DETECTION_SOURCES.REGEX]
+	},
+	{
+		label: "mac address",
+		selection: ENTITY_SELECTIONS.OPT_IN,
+		detectionSources: [DETECTION_SOURCES.REGEX]
+	},
+	{
+		label: "url",
+		selection: ENTITY_SELECTIONS.OPT_IN,
+		detectionSources: [DETECTION_SOURCES.REGEX]
+	}
 ];
+const ENTITY_LABELS = ENTITY_CAPABILITIES.map(({ label }) => label);
+const isDefaultEntityCapability = (capability) => capability.selection === ENTITY_SELECTIONS.DEFAULT;
+const DEFAULT_ENTITY_LABELS = ENTITY_CAPABILITIES.filter(isDefaultEntityCapability).map(({ label }) => label);
 //#endregion
-export { DEFAULT_ENTITY_LABELS, DETECTION_SOURCES, DETECTOR_PRIORITY, OPERATOR_TYPES };
+export { DEFAULT_ENTITY_LABELS, DETECTION_SOURCES, DETECTOR_PRIORITY, ENTITY_CAPABILITIES, ENTITY_LABELS, ENTITY_SELECTIONS, OPERATOR_TYPES };
 
 //# sourceMappingURL=constants.mjs.map

package/dist/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":[],"sources":["../../src/constants.ts"],"sourcesContent":["/**\n * Runtime-free constants for the anonymization pipeline.\n *\n * This module is the SSR-safe / browser-safe entrypoint:\n * importing it must not pull in `@stll/text-search`,\n * `@stll/anonymize-wasm`, or any other runtime-bearing\n * module. Consumers that only need the static label list,\n * detection-source identifiers, or operator names import\n * from `@stll/anonymize/constants` (or\n * `@stll/anonymize-wasm/constants`) without paying the\n * wasm / regex-set startup cost.\n *\n * `types.ts` re-exports these for back-compat, so existing\n * `import { DEFAULT_ENTITY_LABELS } from \"@stll/anonymize\"`\n * call sites keep working.\n */\n\n/**\n * Source of a detected entity span.\n * Ordered by detection layer in the pipeline.\n */\nexport const DETECTION_SOURCES = {\n  TRIGGER: \"trigger\",\n  REGEX: \"regex\",\n  DENY_LIST: \"deny-list\",\n  LEGAL_FORM: \"legal-form\",\n  GAZETTEER: \"gazetteer\",\n  COUNTRY: \"country\",\n  NER: \"ner\",\n  COREFERENCE: \"coreference\",\n} as const;\n\nexport type DetectionSource =\n  (typeof DETECTION_SOURCES)[keyof typeof DETECTION_SOURCES];\n\n/**\n * Priority levels for detection sources.\n * Higher = more structurally reliable. Used during\n * overlap resolution so deterministic detectors beat\n * probabilistic ones regardless of raw score.\n */\nexport const DETECTOR_PRIORITY = {\n  [DETECTION_SOURCES.GAZETTEER]: 5,\n  [DETECTION_SOURCES.TRIGGER]: 4,\n  [DETECTION_SOURCES.LEGAL_FORM]: 3,\n  [DETECTION_SOURCES.REGEX]: 3,\n  [DETECTION_SOURCES.COUNTRY]: 3,\n  [DETECTION_SOURCES.DENY_LIST]: 2,\n  [DETECTION_SOURCES.COREFERENCE]: 2,\n  [DETECTION_SOURCES.NER]: 1,\n} as const satisfies Record<DetectionSource, number>;\n\n/**\n * Anonymization operator types. Each operator defines\n * how a confirmed entity is replaced in the output.\n */\nexport const OPERATOR_TYPES = [\"replace\", \"redact\"] as const;\n\nexport type OperatorType = (typeof OPERATOR_TYPES)[number];\n\n/**\n * Canonical entity labels used across the pipeline.\n * NER models may use different native labels; the bench\n * NER wrapper maps model output to these canonical names.\n *\n * These labels are ephemeral: entities are regenerated on\n * every pipeline run and never persisted to the database.\n * Renaming a label here requires no migration.\n */\nexport const DEFAULT_ENTITY_LABELS = [\n  \"person\",\n  \"organization\",\n  \"phone number\",\n  \"address\",\n  \"country\",\n  \"email address\",\n  \"date\",\n  \"date of birth\",\n  \"bank account number\",\n  \"iban\",\n  \"tax identification number\",\n  \"identity card number\",\n  \"birth number\",\n  \"national identification number\",\n  \"social security number\",\n  \"registration number\",\n  \"credit card number\",\n  \"passport number\",\n  \"crypto\",\n  \"monetary amount\",\n  \"land parcel\",\n  \"misc\",\n] as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,oBAAoB;CAC/B,SAAS;CACT,OAAO;CACP,WAAW;CACX,YAAY;CACZ,WAAW;CACX,SAAS;CACT,KAAK;CACL,aAAa;AACf;;;;;;;AAWA,MAAa,oBAAoB;EAC9B,kBAAkB,YAAY;EAC9B,kBAAkB,UAAU;EAC5B,kBAAkB,aAAa;EAC/B,kBAAkB,QAAQ;EAC1B,kBAAkB,UAAU;EAC5B,kBAAkB,YAAY;EAC9B,kBAAkB,cAAc;EAChC,kBAAkB,MAAM;AAC3B;;;;;AAMA,MAAa,iBAAiB,CAAC,WAAW,QAAQ;;;;;;;;;;AAalD,MAAa,wBAAwB;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF"}
+{"version":3,"file":"constants.mjs","names":[],"sources":["../../src/constants.ts"],"sourcesContent":["/**\n * Runtime-free constants for the anonymization pipeline.\n *\n * This module is the SSR-safe / browser-safe entrypoint:\n * importing it must not pull in `@stll/text-search`,\n * `@stll/anonymize-wasm`, or any other runtime-bearing\n * module. Consumers that only need the static label list,\n * detection-source identifiers, or operator names import\n * from `@stll/anonymize/constants` (or\n * `@stll/anonymize-wasm/constants`) without paying the\n * wasm / regex-set startup cost.\n *\n * `types.ts` re-exports these for back-compat, so existing\n * `import { DEFAULT_ENTITY_LABELS } from \"@stll/anonymize\"`\n * call sites keep working.\n */\n\n/**\n * Source of a detected entity span.\n * Ordered by detection layer in the pipeline.\n */\nexport const DETECTION_SOURCES = {\n  TRIGGER: \"trigger\",\n  REGEX: \"regex\",\n  DENY_LIST: \"deny-list\",\n  LEGAL_FORM: \"legal-form\",\n  GAZETTEER: \"gazetteer\",\n  COUNTRY: \"country\",\n  NER: \"ner\",\n  COREFERENCE: \"coreference\",\n} as const;\n\nexport type DetectionSource =\n  (typeof DETECTION_SOURCES)[keyof typeof DETECTION_SOURCES];\n\n/**\n * Priority levels for detection sources.\n * Higher = more structurally reliable. Used during\n * overlap resolution so deterministic detectors beat\n * probabilistic ones regardless of raw score.\n */\nexport const DETECTOR_PRIORITY = {\n  [DETECTION_SOURCES.GAZETTEER]: 5,\n  [DETECTION_SOURCES.TRIGGER]: 4,\n  [DETECTION_SOURCES.LEGAL_FORM]: 3,\n  [DETECTION_SOURCES.REGEX]: 3,\n  [DETECTION_SOURCES.COUNTRY]: 3,\n  [DETECTION_SOURCES.DENY_LIST]: 2,\n  [DETECTION_SOURCES.COREFERENCE]: 2,\n  [DETECTION_SOURCES.NER]: 1,\n} as const satisfies Record<DetectionSource, number>;\n\n/**\n * Anonymization operator types. Each operator defines\n * how a confirmed entity is replaced in the output.\n */\nexport const OPERATOR_TYPES = [\"replace\", \"redact\", \"keep\", \"mask\"] as const;\n\nexport type OperatorType = (typeof OPERATOR_TYPES)[number];\n\nexport const ENTITY_SELECTIONS = {\n  DEFAULT: \"default\",\n  OPT_IN: \"opt-in\",\n} as const;\n\nexport type EntitySelection =\n  (typeof ENTITY_SELECTIONS)[keyof typeof ENTITY_SELECTIONS];\n\nexport type EntityCapability = {\n  label: string;\n  selection: EntitySelection;\n  detectionSources: readonly DetectionSource[];\n};\n\n/**\n * Canonical entity capabilities exposed by the deterministic native pipeline.\n * `selection` describes whether the default package requests the label; opt-in\n * labels have built-in detection rules but must be requested explicitly.\n *\n * These labels are ephemeral: entities are regenerated on\n * every pipeline run and never persisted to the database.\n * Renaming a label here requires no migration.\n */\nexport const ENTITY_CAPABILITIES = [\n  {\n    label: \"person\",\n    selection: ENTITY_SELECTIONS.DEFAULT,\n    detectionSources: [\n      DETECTION_SOURCES.TRIGGER,\n      DETECTION_SOURCES.REGEX,\n      DETECTION_SOURCES.DENY_LIST,\n      DETECTION_SOURCES.COREFERENCE,\n    ],\n  },\n  {\n    label: \"organization\",\n    selection: ENTITY_SELECTIONS.DEFAULT,\n    detectionSources: [\n      DETECTION_SOURCES.TRIGGER,\n      DETECTION_SOURCES.DENY_LIST,\n      DETECTION_SOURCES.LEGAL_FORM,\n      DETECTION_SOURCES.GAZETTEER,\n      DETECTION_SOURCES.COREFERENCE,\n    ],\n  },\n  {\n    label: \"phone number\",\n    selection: ENTITY_SELECTIONS.DEFAULT,\n    detectionSources: [DETECTION_SOURCES.REGEX, DETECTION_SOURCES.TRIGGER],\n  },\n  {\n    label: \"address\",\n    selection: ENTITY_SELECTIONS.DEFAULT,\n    detectionSources: [\n      DETECTION_SOURCES.REGEX,\n      DETECTION_SOURCES.TRIGGER,\n      DETECTION_SOURCES.DENY_LIST,\n    ],\n  },\n  {\n    label: \"country\",\n    selection: ENTITY_SELECTIONS.DEFAULT,\n    detectionSources: [DETECTION_SOURCES.COUNTRY],\n  },\n  {\n    label: \"email address\",\n    selection: ENTITY_SELECTIONS.DEFAULT,\n    detectionSources: [DETECTION_SOURCES.REGEX],\n  },\n  {\n    label: \"date\",\n    selection: ENTITY_SELECTIONS.DEFAULT,\n    detectionSources: [DETECTION_SOURCES.REGEX, DETECTION_SOURCES.TRIGGER],\n  },\n  {\n    label: \"date of birth\",\n    selection: ENTITY_SELECTIONS.DEFAULT,\n    detectionSources: [DETECTION_SOURCES.TRIGGER],\n  },\n  {\n    label: \"bank account number\",\n    selection: ENTITY_SELECTIONS.DEFAULT,\n    detectionSources: [DETECTION_SOURCES.REGEX, DETECTION_SOURCES.TRIGGER],\n  },\n  {\n    label: \"iban\",\n    selection: ENTITY_SELECTIONS.DEFAULT,\n    detectionSources: [DETECTION_SOURCES.REGEX, DETECTION_SOURCES.TRIGGER],\n  },\n  {\n    label: \"tax identification number\",\n    selection: ENTITY_SELECTIONS.DEFAULT,\n    detectionSources: [DETECTION_SOURCES.REGEX, DETECTION_SOURCES.TRIGGER],\n  },\n  {\n    label: \"identity card number\",\n    selection: ENTITY_SELECTIONS.DEFAULT,\n    detectionSources: [DETECTION_SOURCES.REGEX, DETECTION_SOURCES.TRIGGER],\n  },\n  {\n    label: \"birth number\",\n    selection: ENTITY_SELECTIONS.DEFAULT,\n    detectionSources: [DETECTION_SOURCES.REGEX, DETECTION_SOURCES.TRIGGER],\n  },\n  {\n    label: \"national identification number\",\n    selection: ENTITY_SELECTIONS.DEFAULT,\n    detectionSources: [DETECTION_SOURCES.REGEX, DETECTION_SOURCES.TRIGGER],\n  },\n  {\n    label: \"social security number\",\n    selection: ENTITY_SELECTIONS.DEFAULT,\n    detectionSources: [DETECTION_SOURCES.REGEX, DETECTION_SOURCES.TRIGGER],\n  },\n  {\n    label: \"registration number\",\n    selection: ENTITY_SELECTIONS.DEFAULT,\n    detectionSources: [DETECTION_SOURCES.REGEX, DETECTION_SOURCES.TRIGGER],\n  },\n  {\n    label: \"credit card number\",\n    selection: ENTITY_SELECTIONS.DEFAULT,\n    detectionSources: [DETECTION_SOURCES.REGEX],\n  },\n  {\n    label: \"passport number\",\n    selection: ENTITY_SELECTIONS.DEFAULT,\n    detectionSources: [DETECTION_SOURCES.REGEX],\n  },\n  {\n    label: \"crypto\",\n    selection: ENTITY_SELECTIONS.DEFAULT,\n    detectionSources: [DETECTION_SOURCES.REGEX],\n  },\n  {\n    label: \"monetary amount\",\n    selection: ENTITY_SELECTIONS.DEFAULT,\n    detectionSources: [DETECTION_SOURCES.REGEX, DETECTION_SOURCES.TRIGGER],\n  },\n  {\n    label: \"land parcel\",\n    selection: ENTITY_SELECTIONS.DEFAULT,\n    detectionSources: [DETECTION_SOURCES.TRIGGER],\n  },\n  {\n    label: \"misc\",\n    selection: ENTITY_SELECTIONS.DEFAULT,\n    detectionSources: [DETECTION_SOURCES.REGEX, DETECTION_SOURCES.DENY_LIST],\n  },\n  {\n    label: \"ip address\",\n    selection: ENTITY_SELECTIONS.OPT_IN,\n    detectionSources: [DETECTION_SOURCES.REGEX],\n  },\n  {\n    label: \"mac address\",\n    selection: ENTITY_SELECTIONS.OPT_IN,\n    detectionSources: [DETECTION_SOURCES.REGEX],\n  },\n  {\n    label: \"url\",\n    selection: ENTITY_SELECTIONS.OPT_IN,\n    detectionSources: [DETECTION_SOURCES.REGEX],\n  },\n] as const satisfies readonly EntityCapability[];\n\ntype KnownEntityCapability = (typeof ENTITY_CAPABILITIES)[number];\n\nexport type EntityLabel = KnownEntityCapability[\"label\"];\n\nexport const ENTITY_LABELS: readonly EntityLabel[] = ENTITY_CAPABILITIES.map(\n  ({ label }) => label,\n);\n\nconst isDefaultEntityCapability = (\n  capability: KnownEntityCapability,\n): capability is Extract<\n  KnownEntityCapability,\n  { selection: typeof ENTITY_SELECTIONS.DEFAULT }\n> => capability.selection === ENTITY_SELECTIONS.DEFAULT;\n\nexport type DefaultEntityLabel = Extract<\n  KnownEntityCapability,\n  { selection: typeof ENTITY_SELECTIONS.DEFAULT }\n>[\"label\"];\n\nexport const DEFAULT_ENTITY_LABELS: readonly DefaultEntityLabel[] =\n  ENTITY_CAPABILITIES.filter(isDefaultEntityCapability).map(\n    ({ label }) => label,\n  );\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,oBAAoB;CAC/B,SAAS;CACT,OAAO;CACP,WAAW;CACX,YAAY;CACZ,WAAW;CACX,SAAS;CACT,KAAK;CACL,aAAa;AACf;;;;;;;AAWA,MAAa,oBAAoB;EAC9B,kBAAkB,YAAY;EAC9B,kBAAkB,UAAU;EAC5B,kBAAkB,aAAa;EAC/B,kBAAkB,QAAQ;EAC1B,kBAAkB,UAAU;EAC5B,kBAAkB,YAAY;EAC9B,kBAAkB,cAAc;EAChC,kBAAkB,MAAM;AAC3B;;;;;AAMA,MAAa,iBAAiB;CAAC;CAAW;CAAU;CAAQ;AAAM;AAIlE,MAAa,oBAAoB;CAC/B,SAAS;CACT,QAAQ;AACV;;;;;;;;;;AAoBA,MAAa,sBAAsB;CACjC;EACE,OAAO;EACP,WAAW,kBAAkB;EAC7B,kBAAkB;GAChB,kBAAkB;GAClB,kBAAkB;GAClB,kBAAkB;GAClB,kBAAkB;EACpB;CACF;CACA;EACE,OAAO;EACP,WAAW,kBAAkB;EAC7B,kBAAkB;GAChB,kBAAkB;GAClB,kBAAkB;GAClB,kBAAkB;GAClB,kBAAkB;GAClB,kBAAkB;EACpB;CACF;CACA;EACE,OAAO;EACP,WAAW,kBAAkB;EAC7B,kBAAkB,CAAC,kBAAkB,OAAO,kBAAkB,OAAO;CACvE;CACA;EACE,OAAO;EACP,WAAW,kBAAkB;EAC7B,kBAAkB;GAChB,kBAAkB;GAClB,kBAAkB;GAClB,kBAAkB;EACpB;CACF;CACA;EACE,OAAO;EACP,WAAW,kBAAkB;EAC7B,kBAAkB,CAAC,kBAAkB,OAAO;CAC9C;CACA;EACE,OAAO;EACP,WAAW,kBAAkB;EAC7B,kBAAkB,CAAC,kBAAkB,KAAK;CAC5C;CACA;EACE,OAAO;EACP,WAAW,kBAAkB;EAC7B,kBAAkB,CAAC,kBAAkB,OAAO,kBAAkB,OAAO;CACvE;CACA;EACE,OAAO;EACP,WAAW,kBAAkB;EAC7B,kBAAkB,CAAC,kBAAkB,OAAO;CAC9C;CACA;EACE,OAAO;EACP,WAAW,kBAAkB;EAC7B,kBAAkB,CAAC,kBAAkB,OAAO,kBAAkB,OAAO;CACvE;CACA;EACE,OAAO;EACP,WAAW,kBAAkB;EAC7B,kBAAkB,CAAC,kBAAkB,OAAO,kBAAkB,OAAO;CACvE;CACA;EACE,OAAO;EACP,WAAW,kBAAkB;EAC7B,kBAAkB,CAAC,kBAAkB,OAAO,kBAAkB,OAAO;CACvE;CACA;EACE,OAAO;EACP,WAAW,kBAAkB;EAC7B,kBAAkB,CAAC,kBAAkB,OAAO,kBAAkB,OAAO;CACvE;CACA;EACE,OAAO;EACP,WAAW,kBAAkB;EAC7B,kBAAkB,CAAC,kBAAkB,OAAO,kBAAkB,OAAO;CACvE;CACA;EACE,OAAO;EACP,WAAW,kBAAkB;EAC7B,kBAAkB,CAAC,kBAAkB,OAAO,kBAAkB,OAAO;CACvE;CACA;EACE,OAAO;EACP,WAAW,kBAAkB;EAC7B,kBAAkB,CAAC,kBAAkB,OAAO,kBAAkB,OAAO;CACvE;CACA;EACE,OAAO;EACP,WAAW,kBAAkB;EAC7B,kBAAkB,CAAC,kBAAkB,OAAO,kBAAkB,OAAO;CACvE;CACA;EACE,OAAO;EACP,WAAW,kBAAkB;EAC7B,kBAAkB,CAAC,kBAAkB,KAAK;CAC5C;CACA;EACE,OAAO;EACP,WAAW,kBAAkB;EAC7B,kBAAkB,CAAC,kBAAkB,KAAK;CAC5C;CACA;EACE,OAAO;EACP,WAAW,kBAAkB;EAC7B,kBAAkB,CAAC,kBAAkB,KAAK;CAC5C;CACA;EACE,OAAO;EACP,WAAW,kBAAkB;EAC7B,kBAAkB,CAAC,kBAAkB,OAAO,kBAAkB,OAAO;CACvE;CACA;EACE,OAAO;EACP,WAAW,kBAAkB;EAC7B,kBAAkB,CAAC,kBAAkB,OAAO;CAC9C;CACA;EACE,OAAO;EACP,WAAW,kBAAkB;EAC7B,kBAAkB,CAAC,kBAAkB,OAAO,kBAAkB,SAAS;CACzE;CACA;EACE,OAAO;EACP,WAAW,kBAAkB;EAC7B,kBAAkB,CAAC,kBAAkB,KAAK;CAC5C;CACA;EACE,OAAO;EACP,WAAW,kBAAkB;EAC7B,kBAAkB,CAAC,kBAAkB,KAAK;CAC5C;CACA;EACE,OAAO;EACP,WAAW,kBAAkB;EAC7B,kBAAkB,CAAC,kBAAkB,KAAK;CAC5C;AACF;AAMA,MAAa,gBAAwC,oBAAoB,KACtE,EAAE,YAAY,KACjB;AAEA,MAAM,6BACJ,eAIG,WAAW,cAAc,kBAAkB;AAOhD,MAAa,wBACX,oBAAoB,OAAO,yBAAyB,CAAC,CAAC,KACnD,EAAE,YAAY,KACjB"}

package/dist/constants2.d.mts

@@ -50,18 +50,135 @@ declare const DETECTOR_PRIORITY: {
  * Anonymization operator types. Each operator defines
  * how a confirmed entity is replaced in the output.
  */
-declare const OPERATOR_TYPES: readonly ["replace", "redact"];
+declare const OPERATOR_TYPES: readonly ["replace", "redact", "keep", "mask"];
 type OperatorType = (typeof OPERATOR_TYPES)[number];
+declare const ENTITY_SELECTIONS: {
+  readonly DEFAULT: "default";
+  readonly OPT_IN: "opt-in";
+};
+type EntitySelection = (typeof ENTITY_SELECTIONS)[keyof typeof ENTITY_SELECTIONS];
+type EntityCapability = {
+  label: string;
+  selection: EntitySelection;
+  detectionSources: readonly DetectionSource[];
+};
 /**
- * Canonical entity labels used across the pipeline.
- * NER models may use different native labels; the bench
- * NER wrapper maps model output to these canonical names.
+ * Canonical entity capabilities exposed by the deterministic native pipeline.
+ * `selection` describes whether the default package requests the label; opt-in
+ * labels have built-in detection rules but must be requested explicitly.
  *
  * These labels are ephemeral: entities are regenerated on
  * every pipeline run and never persisted to the database.
  * Renaming a label here requires no migration.
  */
-declare const DEFAULT_ENTITY_LABELS: readonly ["person", "organization", "phone number", "address", "country", "email address", "date", "date of birth", "bank account number", "iban", "tax identification number", "identity card number", "birth number", "national identification number", "social security number", "registration number", "credit card number", "passport number", "crypto", "monetary amount", "land parcel", "misc"];
+declare const ENTITY_CAPABILITIES: readonly [{
+  readonly label: "person";
+  readonly selection: "default";
+  readonly detectionSources: readonly ["trigger", "regex", "deny-list", "coreference"];
+}, {
+  readonly label: "organization";
+  readonly selection: "default";
+  readonly detectionSources: readonly ["trigger", "deny-list", "legal-form", "gazetteer", "coreference"];
+}, {
+  readonly label: "phone number";
+  readonly selection: "default";
+  readonly detectionSources: readonly ["regex", "trigger"];
+}, {
+  readonly label: "address";
+  readonly selection: "default";
+  readonly detectionSources: readonly ["regex", "trigger", "deny-list"];
+}, {
+  readonly label: "country";
+  readonly selection: "default";
+  readonly detectionSources: readonly ["country"];
+}, {
+  readonly label: "email address";
+  readonly selection: "default";
+  readonly detectionSources: readonly ["regex"];
+}, {
+  readonly label: "date";
+  readonly selection: "default";
+  readonly detectionSources: readonly ["regex", "trigger"];
+}, {
+  readonly label: "date of birth";
+  readonly selection: "default";
+  readonly detectionSources: readonly ["trigger"];
+}, {
+  readonly label: "bank account number";
+  readonly selection: "default";
+  readonly detectionSources: readonly ["regex", "trigger"];
+}, {
+  readonly label: "iban";
+  readonly selection: "default";
+  readonly detectionSources: readonly ["regex", "trigger"];
+}, {
+  readonly label: "tax identification number";
+  readonly selection: "default";
+  readonly detectionSources: readonly ["regex", "trigger"];
+}, {
+  readonly label: "identity card number";
+  readonly selection: "default";
+  readonly detectionSources: readonly ["regex", "trigger"];
+}, {
+  readonly label: "birth number";
+  readonly selection: "default";
+  readonly detectionSources: readonly ["regex", "trigger"];
+}, {
+  readonly label: "national identification number";
+  readonly selection: "default";
+  readonly detectionSources: readonly ["regex", "trigger"];
+}, {
+  readonly label: "social security number";
+  readonly selection: "default";
+  readonly detectionSources: readonly ["regex", "trigger"];
+}, {
+  readonly label: "registration number";
+  readonly selection: "default";
+  readonly detectionSources: readonly ["regex", "trigger"];
+}, {
+  readonly label: "credit card number";
+  readonly selection: "default";
+  readonly detectionSources: readonly ["regex"];
+}, {
+  readonly label: "passport number";
+  readonly selection: "default";
+  readonly detectionSources: readonly ["regex"];
+}, {
+  readonly label: "crypto";
+  readonly selection: "default";
+  readonly detectionSources: readonly ["regex"];
+}, {
+  readonly label: "monetary amount";
+  readonly selection: "default";
+  readonly detectionSources: readonly ["regex", "trigger"];
+}, {
+  readonly label: "land parcel";
+  readonly selection: "default";
+  readonly detectionSources: readonly ["trigger"];
+}, {
+  readonly label: "misc";
+  readonly selection: "default";
+  readonly detectionSources: readonly ["regex", "deny-list"];
+}, {
+  readonly label: "ip address";
+  readonly selection: "opt-in";
+  readonly detectionSources: readonly ["regex"];
+}, {
+  readonly label: "mac address";
+  readonly selection: "opt-in";
+  readonly detectionSources: readonly ["regex"];
+}, {
+  readonly label: "url";
+  readonly selection: "opt-in";
+  readonly detectionSources: readonly ["regex"];
+}];
+type KnownEntityCapability = (typeof ENTITY_CAPABILITIES)[number];
+type EntityLabel = KnownEntityCapability["label"];
+declare const ENTITY_LABELS: readonly EntityLabel[];
+type DefaultEntityLabel = Extract<KnownEntityCapability, {
+  selection: typeof ENTITY_SELECTIONS.DEFAULT;
+}>["label"];
+declare const DEFAULT_ENTITY_LABELS: readonly DefaultEntityLabel[];
 //#endregion
-export { OPERATOR_TYPES as a, DetectionSource as i, DETECTION_SOURCES as n, OperatorType as o, DETECTOR_PRIORITY as r, DEFAULT_ENTITY_LABELS as t };
+export { DetectionSource as a, ENTITY_SELECTIONS as c, EntitySelection as d, OPERATOR_TYPES as f, DefaultEntityLabel as i, EntityCapability as l, DETECTION_SOURCES as n, ENTITY_CAPABILITIES as o, OperatorType as p, DETECTOR_PRIORITY as r, ENTITY_LABELS as s, DEFAULT_ENTITY_LABELS as t, EntityLabel as u };
 //# sourceMappingURL=constants2.d.mts.map

package/dist/native/index.wasi-browser.js

@@ -11973,7 +11973,9 @@ var {
   }
 });
 var index_wasi_browser_default = __napiModule.exports;
+var NativePreparedRedactionSession = __napiModule.exports.NativePreparedRedactionSession;
 var NativePreparedSearch = __napiModule.exports.NativePreparedSearch;
+var NativePreparedSessionRedactionPlan = __napiModule.exports.NativePreparedSessionRedactionPlan;
 var assembleStaticSearchCompressedPackageBytes = __napiModule.exports.assembleStaticSearchCompressedPackageBytes;
 var assembleStaticSearchConfigJson = __napiModule.exports.assembleStaticSearchConfigJson;
 var assembleStaticSearchPackageBytes = __napiModule.exports.assembleStaticSearchPackageBytes;
@@ -11998,5 +12000,7 @@ export {
   assembleStaticSearchPackageBytes,
   assembleStaticSearchConfigJson,
   assembleStaticSearchCompressedPackageBytes,
-  NativePreparedSearch
+  NativePreparedSessionRedactionPlan,
+  NativePreparedSearch,
+  NativePreparedRedactionSession
 };

package/dist/native/index.wasi.cjs

@@ -108,7 +108,9 @@ const { instance: __napiInstance, module: __wasiModule, napiModule: __napiModule
   },
 })
 module.exports = __napiModule.exports
+module.exports.NativePreparedRedactionSession = __napiModule.exports.NativePreparedRedactionSession
 module.exports.NativePreparedSearch = __napiModule.exports.NativePreparedSearch
+module.exports.NativePreparedSessionRedactionPlan = __napiModule.exports.NativePreparedSessionRedactionPlan
 module.exports.assembleStaticSearchCompressedPackageBytes = __napiModule.exports.assembleStaticSearchCompressedPackageBytes
 module.exports.assembleStaticSearchConfigJson = __napiModule.exports.assembleStaticSearchConfigJson
 module.exports.assembleStaticSearchPackageBytes = __napiModule.exports.assembleStaticSearchPackageBytes

package/dist/vite.d.mts

@@ -1,5 +1,4 @@
 import { Plugin } from "vite";
-
 //#region src/vite.d.ts
 /** Which bundled `.stlanonpkg` prepared packages the plugin emits into a
  * production build. The wasm binary, glue, and workers are always emitted; only