euredact 0.5.1 → 0.7.0

package/dist/esm/rules/validators.d.ts

@@ -65,7 +65,21 @@ export declare function validateSpanishDni(candidate: string): boolean;
 export declare function validateSpanishNie(candidate: string): boolean;
 export declare function validatePortugueseNif(candidate: string): boolean;
 export declare function validatePolishPesel(candidate: string): boolean;
+/** Polish domestic account number (NRB): the PL IBAN without its "PL", so the IBAN's mod-97 decides it (rules-engine#93). */
+export declare function validatePolishNrb(candidate: string): boolean;
 export declare function validatePolishNip(candidate: string): boolean;
+/**
+ * Polish identity card (dowód osobisty): 3 letters + 6 digits, the first digit
+ * a check digit. Letters A=10 … Z=35, weights 7,3,1,9,7,3,1,7,3: the weighted
+ * sum of all nine is 0 mod 10 exactly when the check digit is right (rules-engine#75).
+ */
+export declare function validatePolishIdCard(candidate: string): boolean;
+/**
+ * Polish REGON: 9 digits, or 14 for a local unit, each with a mod-11 check (a
+ * remainder of 10 counts as 0). A 14-digit REGON begins with its parent's valid
+ * 9-digit REGON (rules-engine#76).
+ */
+export declare function validatePolishRegon(candidate: string): boolean;
 export declare function validateCzechBirthNumber(candidate: string): boolean;
 export declare function validateRomanianCnp(candidate: string): boolean;
 export declare function validateHungarianTaj(candidate: string): boolean;

package/dist/esm/rules/validators.js

@@ -467,10 +467,24 @@ export function validatePortugueseNif(candidate) {
     const check = remainder < 2 ? 0 : 11 - remainder;
     return parseInt(c[8]) === check;
 }
+// PESEL carries the century in the month field: +0 is the 1900s, +20 the 2000s,
+// +40 the 2100s, +60 the 2200s, +80 the 1800s. Without a date check this
+// accepted 80666603210 -- day 66 -- as NATIONAL_ID at high confidence
+// (rules-engine#43).
 export function validatePolishPesel(candidate) {
     const c = candidate.replace(/[\s\-]/g, "");
     if (c.length !== 11 || !/^\d{11}$/.test(c))
         return false;
+    const rawMonth = parseInt(c.slice(2, 4), 10);
+    let month = null;
+    for (const off of [0, 20, 40, 60, 80]) {
+        if (rawMonth - off >= 1 && rawMonth - off <= 12) {
+            month = rawMonth - off;
+            break;
+        }
+    }
+    if (month === null || !isRealDay(month, parseInt(c.slice(4, 6), 10)))
+        return false;
     const d = c.split("").map(Number);
     const weights = [1, 3, 7, 9, 1, 3, 7, 9, 1, 3];
     let total = 0;
@@ -478,6 +492,13 @@ export function validatePolishPesel(candidate) {
         total += d[i] * weights[i];
     return d[10] === (10 - (total % 10)) % 10;
 }
+/** Polish domestic account number (NRB): the PL IBAN without its "PL", so the IBAN's mod-97 decides it (rules-engine#93). */
+export function validatePolishNrb(candidate) {
+    const c = candidate.replace(/[\s\-]/g, "");
+    if (!/^\d{26}$/.test(c))
+        return false;
+    return validateIban("PL" + c);
+}
 export function validatePolishNip(candidate) {
     const c = candidate.replace(/[\s\-]/g, "");
     if (c.length !== 10 || !/^\d{10}$/.test(c))
@@ -489,18 +510,90 @@ export function validatePolishNip(candidate) {
         total += d[i] * weights[i];
     return total % 11 === d[9];
 }
+/**
+ * Polish identity card (dowód osobisty): 3 letters + 6 digits, the first digit
+ * a check digit. Letters A=10 … Z=35, weights 7,3,1,9,7,3,1,7,3: the weighted
+ * sum of all nine is 0 mod 10 exactly when the check digit is right (rules-engine#75).
+ */
+export function validatePolishIdCard(candidate) {
+    const c = candidate.replace(/\s/g, "").toUpperCase();
+    if (!/^[A-Z]{3}\d{6}$/.test(c))
+        return false;
+    const weights = [7, 3, 1, 9, 7, 3, 1, 7, 3];
+    let total = 0;
+    for (let i = 0; i < 9; i++) {
+        const ch = c[i];
+        total += (/[A-Z]/.test(ch) ? ch.charCodeAt(0) - 55 : Number(ch)) * weights[i];
+    }
+    return total % 10 === 0;
+}
+/**
+ * Polish REGON: 9 digits, or 14 for a local unit, each with a mod-11 check (a
+ * remainder of 10 counts as 0). A 14-digit REGON begins with its parent's valid
+ * 9-digit REGON (rules-engine#76).
+ */
+export function validatePolishRegon(candidate) {
+    const c = candidate.replace(/[\s\-]/g, "");
+    if (!/^\d+$/.test(c) || (c.length !== 9 && c.length !== 14))
+        return false;
+    const check = (digits, weights) => {
+        let total = 0;
+        for (let i = 0; i < weights.length; i++)
+            total += Number(digits[i]) * weights[i];
+        const rest = total % 11;
+        return (rest === 10 ? 0 : rest) === Number(digits[weights.length]);
+    };
+    if (!check(c.slice(0, 9), [8, 9, 2, 3, 4, 5, 6, 7]))
+        return false;
+    return c.length === 9 || check(c, [2, 4, 8, 5, 0, 9, 7, 3, 6, 1, 2, 4, 8]);
+}
+// Days per month for the rodné číslo date check. February is 29 because the
+// century is not recoverable from a two-digit year, so a leap year cannot be
+// ruled out -- being permissive by one day is the right direction here.
+const RC_DAYS = [31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+// The calendar month a rodné číslo month field encodes, or null. Four ranges
+// are legal: 1-12 is a man, +50 a woman, and since 2004 +20 marks a birth on a
+// day whose sequence numbers were exhausted (so +70 is a woman on such a day).
+// Whether `day` exists in `month`, February permissive at 29 because a
+// two-digit year does not reveal the century.
+function isRealDay(month, day) {
+    return month >= 1 && month <= 12 && day >= 1 && day <= RC_DAYS[month - 1];
+}
+function czechMonth(raw) {
+    for (const offset of [0, 20, 50, 70]) {
+        if (raw - offset >= 1 && raw - offset <= 12)
+            return raw - offset;
+    }
+    return null;
+}
+// The date is checked, not only the checksum. Without it the validator accepted
+// an impossible month, and a Czech mobile number is the same shape -- nine
+// digits opening 6 or 7 -- so any mobile that happened to pass mod 11 was typed
+// NATIONAL_ID at high confidence: 606666032 (MM=66), 778836400 (MM=88),
+// 728990603 (MM=89). 284 per corpus pass, the largest single false-positive
+// bucket in the evaluation (rules-engine#37).
 export function validateCzechBirthNumber(candidate) {
     const c = candidate.replace(/[/\s]/g, "");
     if (!/^\d+$/.test(c) || (c.length !== 9 && c.length !== 10))
         return false;
+    const month = czechMonth(parseInt(c.slice(2, 4), 10));
+    if (month === null)
+        return false;
+    const day = parseInt(c.slice(4, 6), 10);
+    if (day < 1 || day > RC_DAYS[month - 1])
+        return false;
     if (c.length === 10)
         return parseInt(c) % 11 === 0;
     return true;
 }
+// S YY MM DD JJ NNN C -- the leading S carries the century, so the month needs
+// no offset convention here (rules-engine#43).
 export function validateRomanianCnp(candidate) {
     const c = candidate.replace(/[\s\-]/g, "");
     if (c.length !== 13 || !/^\d{13}$/.test(c) || !"12345678".includes(c[0]))
         return false;
+    if (!isRealDay(parseInt(c.slice(3, 5), 10), parseInt(c.slice(5, 7), 10)))
+        return false;
     const key = "279146358279";
     let total = 0;
     for (let i = 0; i < 12; i++)
@@ -547,10 +640,14 @@ export function validateCroatianOib(candidate) {
     const check = (11 - product) % 10;
     return check === parseInt(c[10]);
 }
+// DD MM YYY RR BBB K -- note EMSO opens with the *day*, where the Czech, Polish
+// and Romanian forms open with the year or a century digit (rules-engine#43).
 export function validateSlovenianEmso(candidate) {
     const c = candidate.replace(/[\s\-]/g, "");
     if (c.length !== 13 || !/^\d{13}$/.test(c))
         return false;
+    if (!isRealDay(parseInt(c.slice(2, 4), 10), parseInt(c.slice(0, 2), 10)))
+        return false;
     const d = c.split("").map(Number);
     const weights = [7, 6, 5, 4, 3, 2, 7, 6, 5, 4, 3, 2];
     let total = 0;
@@ -700,6 +797,9 @@ export const VALIDATORS = {
     portuguese_nif: validatePortugueseNif,
     polish_pesel: validatePolishPesel,
     polish_nip: validatePolishNip,
+    polish_nrb: validatePolishNrb,
+    polish_id_card: validatePolishIdCard,
+    polish_regon: validatePolishRegon,
     czech_birth_number: validateCzechBirthNumber,
     romanian_cnp: validateRomanianCnp,
     hungarian_taj: validateHungarianTaj,

package/dist/esm/sdk.d.ts

@@ -22,11 +22,51 @@ type LabelFor = (det: Detection, slice: string) => string;
  */
 export declare function applyReplacements(text: string, detections: Detection[], labelFor: LabelFor): string;
 /**
- * Characters a token suffix is drawn from. No vowels, so a suffix never spells
- * a word; no 0/1/I/O, so it survives being read back by a person; no
- * underscore, so the type prefix stays unambiguous.
+ * One label in the text sent to the cloud tier: where it sits in the masked
+ * text, and the extent of the original it replaced —
+ * `[maskedStart, maskedEnd, start, end]`.
  */
-export declare const TOKEN_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+export type WireLabel = [number, number, number, number];
+/**
+ * Bracket-mask `text` and record where each label landed.
+ *
+ * Returns what is sent to the cloud tier, plus one `WireLabel` per label.
+ * Everything between labels is copied unchanged, so the labels are all it
+ * takes to carry an offset from the masked text back to the original.
+ *
+ * Always `[TYPE]`, whatever label scheme the caller asked for. That is the
+ * syntax the model was trained on, where a placeholder means "already handled,
+ * do not list it". A token or a numbered label would be read as ordinary text,
+ * so the format on the wire is a model contract and not an output option.
+ */
+/** @internal Shared with cloud/batches.ts. */
+export declare function maskForCloud(text: string, detections: Detection[]): [string, WireLabel[]];
+/**
+ * Carry the service's spans from the masked text onto the original.
+ *
+ * The service only ever saw `masked`, so its offsets index that. An offset in
+ * copied text shifts by whatever the labels before it added or removed. An
+ * offset inside a label has no counterpart in the original, so it snaps
+ * outward to the edge of the value the label replaced: an address the model
+ * reports around `[POSTAL_CODE]` covers the postal code, never half of it.
+ * Over-masking is the safe direction.
+ *
+ * A span lying wholly inside one label describes the label, not the document.
+ * It is dropped; the local detection behind the label stands.
+ *
+ * Throws `Unplaceable` when a span does not match the text that was sent. Such
+ * a span cannot be placed, and masking where it points would cover the wrong
+ * characters and leave the right ones in the clear.
+ */
+/** @internal Shared with cloud/batches.ts. */
+export declare function ontoOriginal(spans: Detection[], masked: string, text: string, labels: WireLabel[], Unplaceable: new (message: string) => Error): Detection[];
+/**
+ * Characters a token suffix is drawn from. No vowels (and no Y), so a suffix
+ * never spells a word; no 0/1/I/O, so it survives being read back by a person;
+ * no underscore, so the type prefix stays unambiguous. A, E, U and Y were in it
+ * until rules-engine#55, against this comment.
+ */
+export declare const TOKEN_ALPHABET = "BCDFGHJKLMNPQRSTVWXZ23456789";
 export declare const TOKEN_SUFFIX_LENGTH = 4;
 /**
  * Maps each distinct PII value in one call to a reversible token.
@@ -106,6 +146,13 @@ export interface RedactOptions {
     allowlistDomains?: string[] | null;
     detectDates?: boolean;
     cache?: boolean;
+    /**
+     * `mode: "cloud"` only. Sent as the request's `Idempotency-Key`: the same key
+     * returns the same job instead of running (and billing) the document again,
+     * which is what a caller retrying after its own timeout needs. One is
+     * generated per call when omitted.
+     */
+    idempotencyKey?: string;
 }
 export declare class EuRedact {
     private engine;
@@ -136,7 +183,16 @@ export declare class EuRedact {
     /** The label function for one call, given its output options. */
     private labelFor;
     /**
-     * Send a document to the cloud tier.
+     * Run the rules here, then send what they left to the cloud tier.
+     *
+     * Local-first: the rules engine masks everything it can find on the caller's
+     * machine, and only that masked text is sent. The service looks for what has
+     * no shape to match on — names, employers, diagnoses — and answers with
+     * spans relative to the text it received, which are mapped back onto the
+     * original here.
+     *
+     * This is minimisation, not an exemption: what the rules miss, and the names
+     * and diagnoses the model is there to find, still travel.
      *
      * Options the service cannot honour throw rather than being ignored. Silently
      * dropping one would mean returning a result that does not match what was
@@ -144,21 +200,9 @@ export declare class EuRedact {
      * under-redaction wearing a plausible face.
      */
     private redactViaCloud;
-    /**
-     * Rebuild the masked text from the service's spans, in place.
-     *
-     * The service masks with bracketed labels only. Any other output option is
-     * applied here, from its spans: the service builds its `redacted_text` from
-     * exactly the spans it returns (entities it reports but cannot place are
-     * listed separately and never applied), so nothing it masked is lost by
-     * masking again from the same spans.
-     *
-     * The service reports offsets in code points and this SDK slices UTF-16
-     * units, so the slice check is what stands between an emoji in the document
-     * and a rebuilt text with the wrong characters masked.
-     */
-    private remaskCloudResult;
     redact(text: string, options?: RedactOptions): RedactResult;
+    /** The local pipeline: normalise, detect, exempt, mask. */
+    private redactRules;
     /**
      * Redact, awaiting the cloud tier when `mode: "cloud"` is asked for.
      *

package/dist/esm/sdk.js

@@ -1,4 +1,4 @@
-import { randomInt } from "node:crypto";
+import { randomIndex } from "./platform.js";
 import { ResultCache } from "./cache.js";
 import { normalize, mapOffsetToOriginal } from "./normalizer.js";
 import { RuleEngine } from "./rules/engine.js";
@@ -49,11 +49,104 @@ export function applyReplacements(text, detections, labelFor) {
     return parts.join("");
 }
 /**
- * Characters a token suffix is drawn from. No vowels, so a suffix never spells
- * a word; no 0/1/I/O, so it survives being read back by a person; no
- * underscore, so the type prefix stays unambiguous.
+ * Bracket-mask `text` and record where each label landed.
+ *
+ * Returns what is sent to the cloud tier, plus one `WireLabel` per label.
+ * Everything between labels is copied unchanged, so the labels are all it
+ * takes to carry an offset from the masked text back to the original.
+ *
+ * Always `[TYPE]`, whatever label scheme the caller asked for. That is the
+ * syntax the model was trained on, where a placeholder means "already handled,
+ * do not list it". A token or a numbered label would be read as ordinary text,
+ * so the format on the wire is a model contract and not an output option.
+ */
+/** @internal Shared with cloud/batches.ts. */
+export function maskForCloud(text, detections) {
+    const parts = [];
+    const labels = [];
+    let pos = 0;
+    let out = 0;
+    for (const det of detections) {
+        const start = Math.max(det.start, pos);
+        if (det.end <= start)
+            continue;
+        const label = `[${det.entityType}]`;
+        out += start - pos;
+        parts.push(text.slice(pos, start), label);
+        labels.push([out, out + label.length, start, det.end]);
+        out += label.length;
+        pos = det.end;
+    }
+    parts.push(text.slice(pos));
+    return [parts.join(""), labels];
+}
+/** Index of the last label starting at or before `offset` — strictly before
+ *  when `strict` — or -1. */
+function labelBefore(labels, offset, strict) {
+    let lo = 0;
+    let hi = labels.length;
+    while (lo < hi) {
+        const mid = (lo + hi) >>> 1;
+        if (strict ? labels[mid][0] < offset : labels[mid][0] <= offset)
+            lo = mid + 1;
+        else
+            hi = mid;
+    }
+    return lo - 1;
+}
+/**
+ * Carry the service's spans from the masked text onto the original.
+ *
+ * The service only ever saw `masked`, so its offsets index that. An offset in
+ * copied text shifts by whatever the labels before it added or removed. An
+ * offset inside a label has no counterpart in the original, so it snaps
+ * outward to the edge of the value the label replaced: an address the model
+ * reports around `[POSTAL_CODE]` covers the postal code, never half of it.
+ * Over-masking is the safe direction.
+ *
+ * A span lying wholly inside one label describes the label, not the document.
+ * It is dropped; the local detection behind the label stands.
+ *
+ * Throws `Unplaceable` when a span does not match the text that was sent. Such
+ * a span cannot be placed, and masking where it points would cover the wrong
+ * characters and leave the right ones in the clear.
+ */
+/** @internal Shared with cloud/batches.ts. */
+export function ontoOriginal(spans, masked, text, labels, Unplaceable) {
+    const placed = [];
+    for (const span of spans) {
+        if (!(0 <= span.start && span.start <= span.end && span.end <= masked.length) ||
+            masked.slice(span.start, span.end) !== span.text) {
+            throw new Unplaceable("span offsets do not match the text that was sent; cannot place the " +
+                "service's detections in the document");
+        }
+        if (span.start === span.end)
+            continue;
+        let start = span.start;
+        let at = labelBefore(labels, span.start, false);
+        if (at >= 0) {
+            const [, maskedEnd, origStart, origEnd] = labels[at];
+            if (span.end <= maskedEnd)
+                continue;
+            start = span.start < maskedEnd ? origStart : origEnd + span.start - maskedEnd;
+        }
+        let end = span.end;
+        at = labelBefore(labels, span.end, true);
+        if (at >= 0) {
+            const [, maskedEnd, , origEnd] = labels[at];
+            end = origEnd + Math.max(0, span.end - maskedEnd);
+        }
+        placed.push({ ...span, start, end, text: text.slice(start, end) });
+    }
+    return placed;
+}
+/**
+ * Characters a token suffix is drawn from. No vowels (and no Y), so a suffix
+ * never spells a word; no 0/1/I/O, so it survives being read back by a person;
+ * no underscore, so the type prefix stays unambiguous. A, E, U and Y were in it
+ * until rules-engine#55, against this comment.
  */
-export const TOKEN_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+export const TOKEN_ALPHABET = "BCDFGHJKLMNPQRSTVWXZ23456789";
 export const TOKEN_SUFFIX_LENGTH = 4;
 const TOKEN_MAX_DRAWS = 100;
 function escapeRegExp(s) {
@@ -101,7 +194,7 @@ export class TokenMapper {
                 }
                 let suffix = "";
                 for (let i = 0; i < TOKEN_SUFFIX_LENGTH; i++) {
-                    suffix += TOKEN_ALPHABET[randomInt(TOKEN_ALPHABET.length)];
+                    suffix += TOKEN_ALPHABET[randomIndex(TOKEN_ALPHABET.length)];
                 }
                 token = prefix + suffix;
             } while (this.taken.has(token));
@@ -386,7 +479,16 @@ export class EuRedact {
         return (det) => `[${det.entityType}]`;
     }
     /**
-     * Send a document to the cloud tier.
+     * Run the rules here, then send what they left to the cloud tier.
+     *
+     * Local-first: the rules engine masks everything it can find on the caller's
+     * machine, and only that masked text is sent. The service looks for what has
+     * no shape to match on — names, employers, diagnoses — and answers with
+     * spans relative to the text it received, which are mapped back onto the
+     * original here.
+     *
+     * This is minimisation, not an exemption: what the rules miss, and the names
+     * and diagnoses the model is there to find, still travel.
      *
      * Options the service cannot honour throw rather than being ignored. Silently
      * dropping one would mean returning a result that does not match what was
@@ -395,6 +497,7 @@ export class EuRedact {
      */
     async redactViaCloud(text, options) {
         const { CloudClient } = await import("./cloud/client.js");
+        const { CloudError } = await import("./cloud/errors.js");
         const countries = options.countries ?? null;
         if (!countries || countries.length !== 1) {
             throw new Error('cloud mode needs exactly one country, e.g. { countries: ["BE"] }. The ' +
@@ -412,43 +515,37 @@ export class EuRedact {
         if (options.referentialIntegrity) {
             throw new Error("referentialIntegrity is not supported in cloud mode");
         }
-        // detectDates is deliberately NOT forwarded. The service always runs its
-        // rules engine with dates on, because that is what the model was trained
-        // against; the caller's value cannot change that. It is the one ignored
-        // option that is safe to ignore — it can only cause MORE to be detected,
-        // never less, so it cannot produce under-redaction.
         const allowed = this.allowedFor(options);
         const domains = this.domainsFor(options);
-        const result = await new CloudClient().redact(text, { country: countries[0] });
-        if (options.tokenize || allowed.size > 0 || domains.size > 0) {
-            await this.remaskCloudResult(result, text, { tokenize: options.tokenize ?? false, allowed, domains });
-        }
-        return result;
-    }
-    /**
-     * Rebuild the masked text from the service's spans, in place.
-     *
-     * The service masks with bracketed labels only. Any other output option is
-     * applied here, from its spans: the service builds its `redacted_text` from
-     * exactly the spans it returns (entities it reports but cannot place are
-     * listed separately and never applied), so nothing it masked is lost by
-     * masking again from the same spans.
-     *
-     * The service reports offsets in code points and this SDK slices UTF-16
-     * units, so the slice check is what stands between an emoji in the document
-     * and a rebuilt text with the wrong characters masked.
-     */
-    async remaskCloudResult(result, text, opts) {
-        const { CloudError } = await import("./cloud/errors.js");
-        for (const det of result.detections) {
-            if (text.slice(det.start, det.end) !== det.text) {
-                throw new CloudError("span offsets do not match the document; cannot apply tokenize/allowlist locally");
-            }
-        }
-        [result.detections, result.exempted] = applyAllowlist(text, result.detections, opts.allowed, opts.domains);
-        const tokenMapper = opts.tokenize ? new TokenMapper(text, result.detections) : null;
-        result.redactedText = applyReplacements(text, result.detections, this.labelFor(false, tokenMapper));
-        result.tokens = tokenMapper ? tokenMapper.tokens : {};
+        const client = new CloudClient();
+        // Dates are always on, whatever detectDates says: that is the rules output
+        // the model was trained against, and a date of birth the rules can place
+        // has no reason to travel. It is the one ignored option that is safe to
+        // ignore — it can only cause MORE to be detected, never less.
+        //
+        // No allowlist and no tokens on this pass. An exemption says what the
+        // caller wants back, not what may leave; both are applied below, after the
+        // response, to the merged spans.
+        const local = this.redactRules(text, { countries, detectDates: true, cache: options.cache }, new Map(), new Map());
+        const [masked, labels] = maskForCloud(text, local.detections);
+        // The client converts the service's code-point offsets to UTF-16 units of
+        // the text it sent, so everything from here on is in one unit.
+        const remote = await client.redact(masked, {
+            country: countries[0], idempotencyKey: options.idempotencyKey,
+        });
+        // A new array throughout: `local` may be the cached rules result.
+        const [detections, exempted] = applyAllowlist(text, [...local.detections, ...ontoOriginal(remote.detections, masked, text, labels, CloudError)], allowed, domains);
+        detections.sort((a, b) => a.start - b.start || b.end - a.end);
+        const tokenMapper = options.tokenize ? new TokenMapper(text, detections) : null;
+        return {
+            ...local,
+            redactedText: applyReplacements(text, detections, this.labelFor(false, tokenMapper)),
+            detections,
+            source: "cloud",
+            tokens: tokenMapper ? tokenMapper.tokens : {},
+            exempted,
+            ...(remote.cloud ? { cloud: remote.cloud } : {}),
+        };
     }
     redact(text, options = {}) {
         checkCountryArg(options.countries, "countries");
@@ -469,12 +566,19 @@ export class EuRedact {
         if (requestedMode !== "rules") {
             throw new Error(`unknown mode ${JSON.stringify(requestedMode)}: expected "rules" or "cloud"`);
         }
+        if (options.idempotencyKey !== undefined) {
+            throw new Error('idempotencyKey applies to mode: "cloud" only: a rules-only redaction makes no request to deduplicate');
+        }
+        return this.redactRules(text, options, allowed, domains);
+    }
+    /** The local pipeline: normalise, detect, exempt, mask. */
+    redactRules(text, options, allowed, domains) {
         if (text.length > this.maxInputLength) {
             throw new Error(`Input text length (${text.length.toLocaleString()} chars) exceeds the maximum ` +
                 `(${this.maxInputLength.toLocaleString()} chars). Split the input or ` +
                 `increase maxInputLength when constructing EuRedact.`);
         }
-        const { countries = null, countryHint = null, context = null, chunkOffset = 0, mode = "rules", referentialIntegrity = false, tokenize = false, detectDates = false, } = options;
+        const { countries = null, countryHint = null, context = null, chunkOffset = 0, referentialIntegrity = false, tokenize = false, detectDates = false, } = options;
         // A context makes the result depend on evidence from other chunks, so the
         // text no longer identifies the result. Caching is disabled rather than
         // keyed on the context, whose contents change as chunks arrive.
@@ -492,7 +596,7 @@ export class EuRedact {
         // separator, and two different lists must never share a key.
         const allowKey = (allowed.size ? JSON.stringify([...allowed.keys()].sort()) : "")
             + (domains.size ? "|dom=" + JSON.stringify([...domains.keys()].sort()) : "");
-        const cacheMode = `${mode}|dates=${detectDates}|hint=${hintKey}|ri=${referentialIntegrity}|tok=${tokenize}|allow=${allowKey}`;
+        const cacheMode = `rules|dates=${detectDates}|hint=${hintKey}|ri=${referentialIntegrity}|tok=${tokenize}|allow=${allowKey}`;
         let cacheKey;
         if (cache) {
             cacheKey = this.cache.key(normalizedText, countriesTuple, cacheMode);

package/dist/esm/types.d.ts

@@ -69,7 +69,8 @@ export declare enum EntityType {
     BIOMETRIC_REF = "BIOMETRIC_REF",
     FINANCIAL_AMOUNT = "FINANCIAL_AMOUNT",
     QUASI_IDENTIFIER = "QUASI_IDENTIFIER",
-    CREDENTIAL = "CREDENTIAL",
+    /** Legacy alias of SECRET: every credential, the model's included, is SECRET (rules-engine#111). */
+    CREDENTIAL = "SECRET",
     URL = "URL",
     OTHER = "OTHER"
 }
@@ -116,7 +117,13 @@ export interface Detection {
     text: string;
     source: DetectionSource;
     country: string | null;
-    confidence: string;
+    /**
+     * How the type was arrived at: "high", "medium" or "low" for a rules
+     * detection. `null` for a span the cloud model found and reported no
+     * confidence for: the model emits none today, and "high" would claim the
+     * checksum-backed evidence a rules detection has (rules-engine#108).
+     */
+    confidence: string | null;
     /**
      * How strongly the document supports {@link Detection.country}, in [0, 1].
      *
@@ -151,6 +158,52 @@ export interface Exemption {
     /** `"value"` for the literal allowlist, `"domain"` for allowlistDomains. */
     ruleKind: "value" | "domain";
 }
+/**
+ * One reason a cloud request cost what it did. `code` is one of the service's
+ * factor codes (`rules_only`, `document_length`, `instructions`,
+ * `dense_document`, `special_category_check`, `long_document`, `batch_rate`),
+ * kept as a string so a code added later on the service still arrives.
+ */
+export interface UsageFactor {
+    code: string;
+    /** One sentence explaining the factor, written by the service. */
+    detail: string;
+    /** `special_category_check` only: the kinds of data that triggered it. */
+    types?: string[];
+}
+/**
+ * What a cloud request cost, and why (rules-engine#89). A total and its
+ * reasons, never a cost per step; `credits` is `round(tokens * billingRate)`,
+ * the formula the service debits by.
+ */
+export interface Usage {
+    tokens: number;
+    billingRate: number;
+    credits: number;
+    factors: UsageFactor[];
+}
+/**
+ * Something the model found that could not be placed in the document: the
+ * service could not match it to a position in what it was sent, so nothing was
+ * masked for it. Reported so a caller can decide, rather than never being told.
+ */
+export interface Unlocated {
+    text: string;
+    entityType: EntityType | string;
+}
+/** What the cloud service said about a request, beside its spans (rules-engine#89). */
+export interface CloudInfo {
+    /** The service's job id: for support, for `Jobs.retrieve`, and to recognise an
+     *  idempotent replay. `null` for a batch document. */
+    jobId: string | null;
+    /** The public name of the model that answered, `null` when only rules ran. */
+    modelVersion: string | null;
+    /** What the request cost and why. Absent when the service does not report it
+     *  (older versions, batch documents) or reported it malformed. */
+    usage?: Usage;
+    /** What the model found but could not place in the text it was sent. */
+    unlocated: Unlocated[];
+}
 export interface RedactResult {
     redactedText: string;
     detections: Detection[];
@@ -188,6 +241,9 @@ export interface RedactResult {
     /** Detections the allowlist kept out of the output, with the rule that
      *  matched. Empty unless an allowlist was in force. */
     exempted: Exemption[];
+    /** What the cloud service reported beside the spans: job id, model, cost and
+     *  anything it could not place. Absent on a rules-only result. */
+    cloud?: CloudInfo;
 }
 export interface PatternDef {
     entityType: EntityType | string;

package/dist/esm/types.js

@@ -75,7 +75,8 @@ export var EntityType;
     EntityType["BIOMETRIC_REF"] = "BIOMETRIC_REF";
     EntityType["FINANCIAL_AMOUNT"] = "FINANCIAL_AMOUNT";
     EntityType["QUASI_IDENTIFIER"] = "QUASI_IDENTIFIER";
-    EntityType["CREDENTIAL"] = "CREDENTIAL";
+    /** Legacy alias of SECRET: every credential, the model's included, is SECRET (rules-engine#111). */
+    EntityType["CREDENTIAL"] = "SECRET";
     EntityType["URL"] = "URL";
     EntityType["OTHER"] = "OTHER";
 })(EntityType || (EntityType = {}));
@@ -89,6 +90,8 @@ export const LEGACY_TYPE_ALIASES = {
     NAME: "PERSON_NAME",
     STREET_ADDRESS: "ADDRESS",
     NATIONALITY_ETHNICITY: "SENSITIVE_ATTRIBUTE",
+    // The model labels prose credentials CREDENTIAL; the SDK reports every credential as SECRET (rules-engine#111).
+    CREDENTIAL: "SECRET",
 };
 /**
  * Resolve a possibly-legacy type name to its canonical form.