euredact 0.5.1 → 0.7.0

package/dist/cjs/cloud/client.js

@@ -2,11 +2,15 @@
 /**
  * [CLOUD EXTENSION] The cloud client.
  *
- * Speaks to the euRedact inference service: a deterministic rules engine
- * followed by a fine-tuned model asked only *what did the rules miss?* The
- * service returns both the redacted document and located spans, so this
+ * Speaks to the euRedact inference service: a fine-tuned model asked only
+ * *what did the rules miss?* The service returns located spans, so this
  * module's job is transport and translation, not detection.
  *
+ * It sends the text it is given, as given. `redactAsync(text, { mode: "cloud" })`
+ * is what runs the rules engine first and hands this client only the masked
+ * text; call the client directly and whatever you pass is what leaves the
+ * machine. The spans that come back index the text that was sent.
+ *
  * Three things it hides from the caller:
  *
  * - **Whether the document finished inside the service's sync window.** A short
@@ -22,12 +26,27 @@
  * own `fetch`.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CloudClient = void 0;
+exports.CloudClient = exports.RETRY_STATUS = void 0;
+exports.requireFetch = requireFetch;
+exports.sleep = sleep;
+exports.retryAfterMs = retryAfterMs;
+exports.backoffMs = backoffMs;
+exports.uuid = uuid;
+exports.codePointOffsets = codePointOffsets;
+exports.isInteger = isInteger;
+exports.toUsage = toUsage;
+exports.toCloudInfo = toCloudInfo;
+exports.isQuota = isQuota;
+exports.cloudErrorFor = cloudErrorFor;
+exports.toResult = toResult;
+exports.readJson = readJson;
 const config_js_1 = require("./config.js");
 const errors_js_1 = require("./errors.js");
 const types_js_1 = require("../types.js");
-const RETRY_STATUS = new Set([429, 500, 502, 503, 504]);
+/** @internal Shared with cloud/account.ts. */
+exports.RETRY_STATUS = new Set([429, 500, 502, 503, 504]);
 const MAX_BACKOFF_MS = 30_000;
+/** @internal */
 function requireFetch(supplied) {
     const impl = supplied ?? globalThis.fetch;
     if (typeof impl !== "function") {
@@ -36,9 +55,11 @@ function requireFetch(supplied) {
     }
     return impl;
 }
+/** @internal */
 function sleep(ms) {
     return new Promise(resolve => setTimeout(resolve, ms));
 }
+/** @internal */
 function retryAfterMs(headers) {
     const raw = headers?.get("Retry-After");
     if (!raw)
@@ -51,11 +72,13 @@ function retryAfterMs(headers) {
  * Full jitter. A synchronised retry storm from many clients is how a
  * recovering service is knocked back over.
  */
+/** @internal */
 function backoffMs(attempt, retryAfter) {
     if (retryAfter !== null)
         return Math.min(retryAfter, MAX_BACKOFF_MS);
     return Math.min(MAX_BACKOFF_MS, Math.random() * 2 ** attempt * 1000);
 }
+/** @internal */
 function uuid() {
     const c = globalThis.crypto;
     if (c && typeof c.randomUUID === "function")
@@ -83,6 +106,7 @@ function toEntityType(raw) {
  * Returns the identity when the text has none, which is the common case and
  * costs one regex test.
  */
+/** @internal Shared with cloud/batches.ts. */
 function codePointOffsets(text) {
     if (!/[\uD800-\uDBFF]/.test(text))
         return cp => cp;
@@ -95,6 +119,97 @@ function codePointOffsets(text) {
     units.push(i);
     return cp => units[Math.min(cp, units.length - 1)];
 }
+/** @internal */
+function isInteger(value) {
+    return typeof value === "number" && Number.isInteger(value);
+}
+/**
+ * The `usage` block, or undefined when absent or malformed. Shared rules with
+ * the Python SDK (`conformance/cloud_usage.json`): `tokens` and `credits` are
+ * integers, `billing_rate` a number, `factors` a list whose entries carry a
+ * string `code`. Anything else there drops the whole block rather than
+ * reporting a cost nobody can trust; unknown keys are ignored.
+ * @internal Exported for the conformance test.
+ */
+function toUsage(raw) {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        return undefined;
+    const u = raw;
+    if (!isInteger(u.tokens) || !isInteger(u.credits) || typeof u.billing_rate !== "number"
+        || !Array.isArray(u.factors))
+        return undefined;
+    const factors = [];
+    for (const f of u.factors) {
+        if (f === null || typeof f !== "object" || Array.isArray(f))
+            return undefined;
+        const r = f;
+        if (typeof r.code !== "string")
+            return undefined;
+        const factor = { code: r.code, detail: typeof r.detail === "string" ? r.detail : "" };
+        if (Array.isArray(r.types))
+            factor.types = r.types.filter((t) => typeof t === "string");
+        factors.push(factor);
+    }
+    return { tokens: u.tokens, billingRate: u.billing_rate, credits: u.credits, factors };
+}
+function str(value) {
+    return typeof value === "string" ? value : null;
+}
+/**
+ * The service's account of a request beside its spans. Shared rules with the
+ * Python SDK (`conformance/cloud_result.json`): a field of the wrong type reads
+ * as absent, and an unlocated entry without string `text` is skipped.
+ * @internal
+ */
+function toCloudInfo(payload) {
+    const unlocated = [];
+    for (const item of Array.isArray(payload.unlocated) ? payload.unlocated : []) {
+        if (item && typeof item === "object" && typeof item.text === "string") {
+            const t = item.type;
+            unlocated.push({
+                text: item.text,
+                entityType: toEntityType(typeof t === "string" ? t : "OTHER"),
+            });
+        }
+    }
+    const usage = toUsage(payload.usage);
+    return {
+        jobId: str(payload.job_id),
+        modelVersion: str(payload.model_version),
+        ...(usage ? { usage } : {}),
+        unlocated,
+    };
+}
+/**
+ * A 429 from the gateway's daily quota rather than the edge's rate limit: the
+ * gateway answers in JSON with `detail.used` and `detail.limit`; nginx in HTML.
+ * @internal
+ */
+function isQuota(payload) {
+    const detail = payload.detail;
+    return !!detail && typeof detail === "object" && "limit" in detail && "used" in detail;
+}
+/** The error for a non-success answer. @internal Shared with batches and account. */
+function cloudErrorFor(status, payload) {
+    const message = typeof payload.error === "string" ? payload.error : `HTTP ${status}`;
+    const detail = (payload.detail && typeof payload.detail === "object"
+        ? payload.detail : {});
+    if (status === 401)
+        return new errors_js_1.CloudError(`authentication failed: ${message}`, status);
+    if (status === 404)
+        return new errors_js_1.NotFoundError(message, status, detail);
+    if (status === 410)
+        return new errors_js_1.ResultExpiredError(message, status, detail);
+    if (status === 413)
+        return new errors_js_1.TooLargeError(message, status, detail);
+    if (status === 429) {
+        return isQuota(payload)
+            ? new errors_js_1.QuotaExceededError(message, status, detail)
+            : new errors_js_1.RateLimitedError("rate limited by the service (HTTP 429); try again shortly", status, detail);
+    }
+    return new errors_js_1.CloudError(message, status, detail);
+}
+/** @internal Shared with cloud/batches.ts. */
 function toResult(payload, text) {
     const offset = codePointOffsets(text);
     const detections = (payload.entities ?? []).map(span => ({
@@ -104,7 +219,9 @@ function toResult(payload, text) {
         text: span.text,
         source: span.source === "model" ? types_js_1.DetectionSource.CLOUD : types_js_1.DetectionSource.RULES,
         country: null,
-        confidence: span.confidence ?? "high",
+        // A model span carries no evidence of its own: the service's confidence
+        // when it sends one, never an invented "high" (rules-engine#108).
+        confidence: span.source === "model" ? (span.confidence ?? null) : (span.confidence ?? "high"),
     }));
     detections.sort((a, b) => a.start - b.start || b.end - a.end);
     return {
@@ -117,6 +234,7 @@ function toResult(payload, text) {
         detectionMode: "declared",
         tokens: {},
         exempted: [],
+        cloud: toCloudInfo(payload),
     };
 }
 class CloudClient {
@@ -125,6 +243,8 @@ class CloudClient {
         const resolved = config ?? (0, config_js_1.getConfig)();
         if (resolved === null)
             throw new errors_js_1.NotConfiguredError();
+        // A config built by hand bypasses configure(), so check it here too.
+        (0, config_js_1.requireSecureBaseUrl)(resolved.baseUrl);
         this.config = resolved;
     }
     headers(idempotencyKey) {
@@ -138,15 +258,7 @@ class CloudClient {
         };
     }
     raiseFor(status, payload) {
-        const message = payload.error ?? `HTTP ${status}`;
-        const detail = payload.detail ?? {};
-        if (status === 401)
-            throw new errors_js_1.CloudError(`authentication failed: ${message}`, status);
-        if (status === 413)
-            throw new errors_js_1.TooLargeError(message, status, detail);
-        if (status === 429)
-            throw new errors_js_1.QuotaExceededError(message, status, detail);
-        throw new errors_js_1.CloudError(message, status, detail);
+        throw cloudErrorFor(status, payload);
     }
     async redact(text, options) {
         const doFetch = requireFetch(options.fetchImpl);
@@ -156,7 +268,6 @@ class CloudClient {
             country: options.country.toUpperCase(),
             language: options.language ?? "",
             priority: options.priority ?? "interactive",
-            rules_only: options.rulesOnly ?? false,
         });
         let attempt = 0;
         for (;;) {
@@ -186,7 +297,8 @@ class CloudClient {
                 }
                 if (response.status === 200)
                     return toResult(payload, text);
-                if (!RETRY_STATUS.has(response.status) || attempt >= this.config.maxRetries) {
+                if (!exports.RETRY_STATUS.has(response.status) || attempt >= this.config.maxRetries
+                    || (response.status === 429 && isQuota(payload))) {
                     this.raiseFor(response.status, payload);
                 }
             }
@@ -209,7 +321,7 @@ class CloudClient {
             if (response.status === 200 && payload.redacted_text !== undefined) {
                 return payload;
             }
-            if (response.status !== 200 && !RETRY_STATUS.has(response.status)) {
+            if (response.status !== 200 && !exports.RETRY_STATUS.has(response.status)) {
                 this.raiseFor(response.status, payload);
             }
             if (Date.now() >= deadline) {
@@ -232,6 +344,7 @@ class CloudClient {
     }
 }
 exports.CloudClient = CloudClient;
+/** @internal */
 async function readJson(response) {
     try {
         const data = await response.json();

package/dist/cjs/cloud/config.js

@@ -2,6 +2,7 @@
 /** [CLOUD EXTENSION] Cloud tier configuration. */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_MAX_RETRIES = exports.DEFAULT_POLL_TIMEOUT_MS = exports.DEFAULT_TIMEOUT_MS = exports.DEFAULT_BASE_URL = void 0;
+exports.requireSecureBaseUrl = requireSecureBaseUrl;
 exports.configure = configure;
 exports.getConfig = getConfig;
 exports.reset = reset;
@@ -19,6 +20,29 @@ exports.DEFAULT_TIMEOUT_MS = 90_000;
  */
 exports.DEFAULT_POLL_TIMEOUT_MS = 900_000;
 exports.DEFAULT_MAX_RETRIES = 3;
+/** Hosts a plain-HTTP base URL may name: a gateway or TLS proxy on this machine. */
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+/**
+ * Refuse a cloud address that would not use TLS. The API key and the text sent
+ * must travel encrypted; plain `http` is allowed only to a loopback host, for a
+ * local gateway or a TLS-terminating proxy on the same machine (rules-engine#86).
+ */
+function requireSecureBaseUrl(baseUrl) {
+    // Parsed by hand rather than with `URL`: a runtime without that global would
+    // otherwise refuse every address, https included, with a misleading message.
+    const m = /^([a-z][a-z0-9+.-]*):\/\/(?:[^@/?#]*@)?(\[[^\]]*\]|[^:/?#]*)/i.exec(baseUrl);
+    if (m !== null) {
+        const scheme = m[1].toLowerCase();
+        const host = m[2].toLowerCase();
+        if (scheme === "https" && host)
+            return;
+        if (scheme === "http" && LOOPBACK_HOSTS.has(host))
+            return;
+    }
+    throw new Error(`refusing cloud base URL ${JSON.stringify(baseUrl)}: it must start with https:// ` +
+        "(plain http:// is allowed only to localhost, 127.0.0.1 or ::1), because the " +
+        "API key and document text would otherwise travel unencrypted");
+}
 let config = null;
 /** Read an env var where there is an environment to read. Browsers have none. */
 function env(name) {
@@ -36,10 +60,12 @@ function configure(options = {}) {
     if (!apiKey) {
         throw new Error("no API key: pass configure({ apiKey }) or set EUREDACT_API_KEY");
     }
+    const baseUrl = (options.baseUrl ?? env("EUREDACT_BASE_URL") ?? exports.DEFAULT_BASE_URL)
+        .replace(/\/+$/, "");
+    requireSecureBaseUrl(baseUrl);
     config = {
         apiKey,
-        baseUrl: (options.baseUrl ?? env("EUREDACT_BASE_URL") ?? exports.DEFAULT_BASE_URL)
-            .replace(/\/+$/, ""),
+        baseUrl,
         timeoutMs: options.timeoutMs ?? exports.DEFAULT_TIMEOUT_MS,
         pollTimeoutMs: options.pollTimeoutMs ?? exports.DEFAULT_POLL_TIMEOUT_MS,
         maxRetries: options.maxRetries ?? exports.DEFAULT_MAX_RETRIES,

package/dist/cjs/cloud/errors.js

@@ -1,7 +1,7 @@
 "use strict";
 /** [CLOUD EXTENSION] Errors the cloud tier can raise. */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TooLargeError = exports.QuotaExceededError = exports.NotConfiguredError = exports.CloudError = void 0;
+exports.TooLargeError = exports.ResultExpiredError = exports.NotFoundError = exports.RateLimitedError = exports.QuotaExceededError = exports.NotConfiguredError = exports.CloudError = void 0;
 class CloudError extends Error {
     status;
     detail;
@@ -31,7 +31,11 @@ class NotConfiguredError extends CloudError {
     }
 }
 exports.NotConfiguredError = NotConfiguredError;
-/** 429 after retries were exhausted. */
+/**
+ * 429: the account's daily document quota is used up. Thrown at once, not
+ * after retries: the gateway's quota answer (JSON with `detail.used` and
+ * `detail.limit`) will not change before the day does (rules-engine#89).
+ */
 class QuotaExceededError extends CloudError {
     constructor(message, status, detail) {
         super(message, status, detail);
@@ -39,6 +43,39 @@ class QuotaExceededError extends CloudError {
     }
 }
 exports.QuotaExceededError = QuotaExceededError;
+/**
+ * 429 from the edge's rate limit, still there after every retry. It clears
+ * within seconds, so it is retried with backoff first. A subclass of
+ * `QuotaExceededError`, which is what every 429 threw before the two were told apart.
+ */
+class RateLimitedError extends QuotaExceededError {
+    constructor(message, status, detail) {
+        super(message, status, detail);
+        this.name = "RateLimitedError";
+    }
+}
+exports.RateLimitedError = RateLimitedError;
+/** 404: no such job, batch or key -- or another account's, which the service
+ *  deliberately does not distinguish. */
+class NotFoundError extends CloudError {
+    constructor(message, status, detail) {
+        super(message, status, detail);
+        this.name = "NotFoundError";
+    }
+}
+exports.NotFoundError = NotFoundError;
+/**
+ * 410: the job succeeded, but its result is no longer retained -- swept by the
+ * account's retention period, or discarded on delivery under no-retention. An
+ * empty result here would read like a document with no personal data in it.
+ */
+class ResultExpiredError extends CloudError {
+    constructor(message, status, detail) {
+        super(message, status, detail);
+        this.name = "ResultExpiredError";
+    }
+}
+exports.ResultExpiredError = ResultExpiredError;
 /**
  * 413. The document is over the service's input cap.
  *

package/dist/cjs/cloud/index.js

@@ -16,16 +16,31 @@
  * ```
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TooLargeError = exports.QuotaExceededError = exports.NotConfiguredError = exports.CloudError = exports.DEFAULT_BASE_URL = exports.reset = exports.getConfig = exports.configure = exports.CloudClient = void 0;
+exports.TooLargeError = exports.ResultExpiredError = exports.RateLimitedError = exports.QuotaExceededError = exports.NotFoundError = exports.NotConfiguredError = exports.CloudError = exports.DEFAULT_BASE_URL = exports.requireSecureBaseUrl = exports.reset = exports.getConfig = exports.configure = exports.MAX_DOCUMENT_TOKENS = exports.MAX_BODY_BYTES = exports.CUSTOM_ID = exports.MAX_CUSTOM_ID = exports.MAX_DOCUMENTS = exports.BatchError = exports.Batches = exports.Jobs = exports.Account = exports.CloudClient = void 0;
 var client_js_1 = require("./client.js");
 Object.defineProperty(exports, "CloudClient", { enumerable: true, get: function () { return client_js_1.CloudClient; } });
+var account_js_1 = require("./account.js");
+Object.defineProperty(exports, "Account", { enumerable: true, get: function () { return account_js_1.Account; } });
+Object.defineProperty(exports, "Jobs", { enumerable: true, get: function () { return account_js_1.Jobs; } });
+var batches_js_1 = require("./batches.js");
+Object.defineProperty(exports, "Batches", { enumerable: true, get: function () { return batches_js_1.Batches; } });
+Object.defineProperty(exports, "BatchError", { enumerable: true, get: function () { return batches_js_1.BatchError; } });
+Object.defineProperty(exports, "MAX_DOCUMENTS", { enumerable: true, get: function () { return batches_js_1.MAX_DOCUMENTS; } });
+Object.defineProperty(exports, "MAX_CUSTOM_ID", { enumerable: true, get: function () { return batches_js_1.MAX_CUSTOM_ID; } });
+Object.defineProperty(exports, "CUSTOM_ID", { enumerable: true, get: function () { return batches_js_1.CUSTOM_ID; } });
+Object.defineProperty(exports, "MAX_BODY_BYTES", { enumerable: true, get: function () { return batches_js_1.MAX_BODY_BYTES; } });
+Object.defineProperty(exports, "MAX_DOCUMENT_TOKENS", { enumerable: true, get: function () { return batches_js_1.MAX_DOCUMENT_TOKENS; } });
 var config_js_1 = require("./config.js");
 Object.defineProperty(exports, "configure", { enumerable: true, get: function () { return config_js_1.configure; } });
 Object.defineProperty(exports, "getConfig", { enumerable: true, get: function () { return config_js_1.getConfig; } });
 Object.defineProperty(exports, "reset", { enumerable: true, get: function () { return config_js_1.reset; } });
+Object.defineProperty(exports, "requireSecureBaseUrl", { enumerable: true, get: function () { return config_js_1.requireSecureBaseUrl; } });
 Object.defineProperty(exports, "DEFAULT_BASE_URL", { enumerable: true, get: function () { return config_js_1.DEFAULT_BASE_URL; } });
 var errors_js_1 = require("./errors.js");
 Object.defineProperty(exports, "CloudError", { enumerable: true, get: function () { return errors_js_1.CloudError; } });
 Object.defineProperty(exports, "NotConfiguredError", { enumerable: true, get: function () { return errors_js_1.NotConfiguredError; } });
+Object.defineProperty(exports, "NotFoundError", { enumerable: true, get: function () { return errors_js_1.NotFoundError; } });
 Object.defineProperty(exports, "QuotaExceededError", { enumerable: true, get: function () { return errors_js_1.QuotaExceededError; } });
+Object.defineProperty(exports, "RateLimitedError", { enumerable: true, get: function () { return errors_js_1.RateLimitedError; } });
+Object.defineProperty(exports, "ResultExpiredError", { enumerable: true, get: function () { return errors_js_1.ResultExpiredError; } });
 Object.defineProperty(exports, "TooLargeError", { enumerable: true, get: function () { return errors_js_1.TooLargeError; } });

package/dist/cjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TooLargeError = exports.QuotaExceededError = exports.NotConfiguredError = exports.CloudError = exports.CloudClient = exports.getConfig = exports.configure = exports.SEED_BIC6_PREFIXES = exports.getBicRegistry = exports.setBicRegistry = exports.COUNTRY_CONFIGS = exports.restore = exports.EuRedact = exports.DocumentContext = exports.canonicalType = exports.LEGACY_TYPE_ALIASES = exports.DetectionSource = exports.EntityType = void 0;
+exports.TooLargeError = exports.ResultExpiredError = exports.RateLimitedError = exports.QuotaExceededError = exports.NotFoundError = exports.NotConfiguredError = exports.Jobs = exports.CUSTOM_ID = exports.BatchError = exports.Batches = exports.CloudError = exports.CloudClient = exports.Account = exports.getConfig = exports.configure = exports.SEED_BIC6_PREFIXES = exports.getBicRegistry = exports.setBicRegistry = exports.COUNTRY_CONFIGS = exports.restore = exports.EuRedact = exports.DocumentContext = exports.canonicalType = exports.LEGACY_TYPE_ALIASES = exports.DetectionSource = exports.EntityType = void 0;
 exports.availableCountries = availableCountries;
 exports.redact = redact;
 exports.redactAsync = redactAsync;
@@ -26,10 +26,18 @@ Object.defineProperty(exports, "SEED_BIC6_PREFIXES", { enumerable: true, get: fu
 var index_js_2 = require("./cloud/index.js");
 Object.defineProperty(exports, "configure", { enumerable: true, get: function () { return index_js_2.configure; } });
 Object.defineProperty(exports, "getConfig", { enumerable: true, get: function () { return index_js_2.getConfig; } });
+Object.defineProperty(exports, "Account", { enumerable: true, get: function () { return index_js_2.Account; } });
 Object.defineProperty(exports, "CloudClient", { enumerable: true, get: function () { return index_js_2.CloudClient; } });
 Object.defineProperty(exports, "CloudError", { enumerable: true, get: function () { return index_js_2.CloudError; } });
+Object.defineProperty(exports, "Batches", { enumerable: true, get: function () { return index_js_2.Batches; } });
+Object.defineProperty(exports, "BatchError", { enumerable: true, get: function () { return index_js_2.BatchError; } });
+Object.defineProperty(exports, "CUSTOM_ID", { enumerable: true, get: function () { return index_js_2.CUSTOM_ID; } });
+Object.defineProperty(exports, "Jobs", { enumerable: true, get: function () { return index_js_2.Jobs; } });
 Object.defineProperty(exports, "NotConfiguredError", { enumerable: true, get: function () { return index_js_2.NotConfiguredError; } });
+Object.defineProperty(exports, "NotFoundError", { enumerable: true, get: function () { return index_js_2.NotFoundError; } });
 Object.defineProperty(exports, "QuotaExceededError", { enumerable: true, get: function () { return index_js_2.QuotaExceededError; } });
+Object.defineProperty(exports, "RateLimitedError", { enumerable: true, get: function () { return index_js_2.RateLimitedError; } });
+Object.defineProperty(exports, "ResultExpiredError", { enumerable: true, get: function () { return index_js_2.ResultExpiredError; } });
 Object.defineProperty(exports, "TooLargeError", { enumerable: true, get: function () { return index_js_2.TooLargeError; } });
 const sdk_js_2 = require("./sdk.js");
 const index_js_3 = require("./rules/countries/index.js");

package/dist/cjs/platform.browser.js

@@ -0,0 +1,98 @@
+"use strict";
+/**
+ * `platform.ts` for browsers: no `node:` imports, so the package bundles for a
+ * page. Selected by the `browser` field in package.json (rules-engine#56).
+ *
+ * The cache key is computed synchronously and must stay collision-resistant
+ * (see `ResultCache.key`), and Web Crypto's `subtle.digest` is asynchronous, so
+ * SHA-256 is implemented here. A test checks it against `node:crypto` byte for
+ * byte, astral characters and lone surrogates included.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sha256Hex = sha256Hex;
+exports.randomIndex = randomIndex;
+exports.defaultBatchStore = defaultBatchStore;
+exports.gzip = gzip;
+const K = new Uint32Array([
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+/** Hex SHA-256 of the UTF-8 encoding of `parts`, joined with nothing between. */
+function sha256Hex(parts) {
+    // TextEncoder replaces a lone surrogate with U+FFFD, as Node's hash.update does.
+    const bytes = new TextEncoder().encode(parts.join(""));
+    const bitLength = bytes.length * 8;
+    const padded = new Uint8Array(((bytes.length + 9 + 63) >> 6) << 6);
+    padded.set(bytes);
+    padded[bytes.length] = 0x80;
+    const view = new DataView(padded.buffer);
+    view.setUint32(padded.length - 8, Math.floor(bitLength / 0x100000000));
+    view.setUint32(padded.length - 4, bitLength >>> 0);
+    const h = new Uint32Array([
+        0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
+    ]);
+    const w = new Uint32Array(64);
+    for (let offset = 0; offset < padded.length; offset += 64) {
+        for (let i = 0; i < 16; i++)
+            w[i] = view.getUint32(offset + i * 4);
+        for (let i = 16; i < 64; i++) {
+            const a = w[i - 15], b = w[i - 2];
+            const s0 = ((a >>> 7) | (a << 25)) ^ ((a >>> 18) | (a << 14)) ^ (a >>> 3);
+            const s1 = ((b >>> 17) | (b << 15)) ^ ((b >>> 19) | (b << 13)) ^ (b >>> 10);
+            w[i] = (w[i - 16] + s0 + w[i - 7] + s1) >>> 0;
+        }
+        let [a, b, c, d, e, f, g, hh] = h;
+        for (let i = 0; i < 64; i++) {
+            const S1 = ((e >>> 6) | (e << 26)) ^ ((e >>> 11) | (e << 21)) ^ ((e >>> 25) | (e << 7));
+            const ch = (e & f) ^ (~e & g);
+            const t1 = (hh + S1 + ch + K[i] + w[i]) >>> 0;
+            const S0 = ((a >>> 2) | (a << 30)) ^ ((a >>> 13) | (a << 19)) ^ ((a >>> 22) | (a << 10));
+            const maj = (a & b) ^ (a & c) ^ (b & c);
+            const t2 = (S0 + maj) >>> 0;
+            hh = g;
+            g = f;
+            f = e;
+            e = (d + t1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (t1 + t2) >>> 0;
+        }
+        h[0] = (h[0] + a) >>> 0;
+        h[1] = (h[1] + b) >>> 0;
+        h[2] = (h[2] + c) >>> 0;
+        h[3] = (h[3] + d) >>> 0;
+        h[4] = (h[4] + e) >>> 0;
+        h[5] = (h[5] + f) >>> 0;
+        h[6] = (h[6] + g) >>> 0;
+        h[7] = (h[7] + hh) >>> 0;
+    }
+    return Array.from(h, x => x.toString(16).padStart(8, "0")).join("");
+}
+/**
+ * A uniformly random integer in `[0, n)`, from `crypto.getRandomValues`.
+ * Rejection sampling: a plain modulo would favour the low residues.
+ */
+function randomIndex(n) {
+    const limit = Math.floor(0x100000000 / n) * n;
+    const buf = new Uint32Array(1);
+    for (;;) {
+        globalThis.crypto.getRandomValues(buf);
+        if (buf[0] < limit)
+            return buf[0] % n;
+    }
+}
+/** A page has no filesystem: the caller passes `store` to `Batches`. */
+function defaultBatchStore(_directory) {
+    return null;
+}
+/** No synchronous gzip in a page; the batch is uploaded uncompressed. */
+function gzip(_data) {
+    return null;
+}

package/dist/cjs/platform.js

@@ -0,0 +1,140 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sha256Hex = sha256Hex;
+exports.randomIndex = randomIndex;
+exports.defaultBatchStore = defaultBatchStore;
+exports.gzip = gzip;
+/**
+ * The two things the SDK needs from a crypto library: a SHA-256 digest for the
+ * result-cache key and a uniform random index for token suffixes.
+ *
+ * This is the Node implementation, on `node:crypto`. A browser bundle gets
+ * `platform.browser.ts` instead, through the `browser` field in package.json,
+ * because `node:crypto` does not exist there and importing it from `cache.ts`
+ * and `sdk.ts` made the package unbundleable for a page (rules-engine#56).
+ * Every other module imports these two functions from here and nothing from
+ * `node:`; a test holds the source tree to that.
+ */
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const node_zlib_1 = require("node:zlib");
+/** Hex SHA-256 of the UTF-8 encoding of `parts`, joined with nothing between. */
+function sha256Hex(parts) {
+    const hash = (0, node_crypto_1.createHash)("sha256");
+    for (const part of parts)
+        hash.update(part);
+    return hash.digest("hex");
+}
+/** A uniformly random integer in `[0, n)`. */
+function randomIndex(n) {
+    return (0, node_crypto_1.randomInt)(n);
+}
+/**
+ * `<dir>/<batchId>.json`, directory `0700`, files `0600`, the default local
+ * batch store. Writes go to a temporary file in the same directory, created
+ * `0600` before any byte is written, then renamed over the old one.
+ */
+function defaultBatchStore(directory) {
+    const dir = directory ?? path.join(os.homedir(), ".euredact", "batches");
+    const fileFor = (batchId) => {
+        if (!batchId || /[/\\]/.test(batchId) || batchId === "." || batchId === "..") {
+            throw new Error(`not a batch id: ${JSON.stringify(batchId)}`);
+        }
+        return path.join(dir, `${batchId}.json`);
+    };
+    return {
+        async read(batchId) {
+            try {
+                return new Uint8Array(fs.readFileSync(fileFor(batchId)));
+            }
+            catch (err) {
+                if (err.code === "ENOENT")
+                    return null;
+                throw err;
+            }
+        },
+        async write(batchId, data) {
+            const target = fileFor(batchId);
+            fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+            try {
+                fs.chmodSync(dir, 0o700);
+            }
+            catch { /* not ours to change */ }
+            const tmp = path.join(dir, `.${batchId}.${process.pid}.${Date.now()}.tmp`);
+            const fd = fs.openSync(tmp, "wx", 0o600);
+            try {
+                fs.writeSync(fd, data);
+                fs.fsyncSync(fd);
+            }
+            finally {
+                fs.closeSync(fd);
+            }
+            try {
+                fs.renameSync(tmp, target);
+            }
+            catch (err) {
+                try {
+                    fs.unlinkSync(tmp);
+                }
+                catch { /* already gone */ }
+                throw err;
+            }
+        },
+        async delete(batchId) {
+            try {
+                fs.unlinkSync(fileFor(batchId));
+            }
+            catch (err) {
+                if (err.code !== "ENOENT")
+                    throw err;
+            }
+        },
+        async list() {
+            if (!fs.existsSync(dir))
+                return [];
+            return fs.readdirSync(dir)
+                .filter(name => name.endsWith(".json") && !name.startsWith("."))
+                .map(name => name.slice(0, -".json".length))
+                .sort();
+        },
+    };
+}
+/** Gzip, for the batch upload. */
+function gzip(data) {
+    return new Uint8Array((0, node_zlib_1.gzipSync)(data));
+}