euredact 0.5.1 → 0.7.0

package/dist/cjs/rules/validators.js

@@ -32,7 +32,10 @@ exports.validateSpanishDni = validateSpanishDni;
 exports.validateSpanishNie = validateSpanishNie;
 exports.validatePortugueseNif = validatePortugueseNif;
 exports.validatePolishPesel = validatePolishPesel;
+exports.validatePolishNrb = validatePolishNrb;
 exports.validatePolishNip = validatePolishNip;
+exports.validatePolishIdCard = validatePolishIdCard;
+exports.validatePolishRegon = validatePolishRegon;
 exports.validateCzechBirthNumber = validateCzechBirthNumber;
 exports.validateRomanianCnp = validateRomanianCnp;
 exports.validateHungarianTaj = validateHungarianTaj;
@@ -513,10 +516,24 @@ function validatePortugueseNif(candidate) {
     const check = remainder < 2 ? 0 : 11 - remainder;
     return parseInt(c[8]) === check;
 }
+// PESEL carries the century in the month field: +0 is the 1900s, +20 the 2000s,
+// +40 the 2100s, +60 the 2200s, +80 the 1800s. Without a date check this
+// accepted 80666603210 -- day 66 -- as NATIONAL_ID at high confidence
+// (rules-engine#43).
 function validatePolishPesel(candidate) {
     const c = candidate.replace(/[\s\-]/g, "");
     if (c.length !== 11 || !/^\d{11}$/.test(c))
         return false;
+    const rawMonth = parseInt(c.slice(2, 4), 10);
+    let month = null;
+    for (const off of [0, 20, 40, 60, 80]) {
+        if (rawMonth - off >= 1 && rawMonth - off <= 12) {
+            month = rawMonth - off;
+            break;
+        }
+    }
+    if (month === null || !isRealDay(month, parseInt(c.slice(4, 6), 10)))
+        return false;
     const d = c.split("").map(Number);
     const weights = [1, 3, 7, 9, 1, 3, 7, 9, 1, 3];
     let total = 0;
@@ -524,6 +541,13 @@ function validatePolishPesel(candidate) {
         total += d[i] * weights[i];
     return d[10] === (10 - (total % 10)) % 10;
 }
+/** Polish domestic account number (NRB): the PL IBAN without its "PL", so the IBAN's mod-97 decides it (rules-engine#93). */
+function validatePolishNrb(candidate) {
+    const c = candidate.replace(/[\s\-]/g, "");
+    if (!/^\d{26}$/.test(c))
+        return false;
+    return validateIban("PL" + c);
+}
 function validatePolishNip(candidate) {
     const c = candidate.replace(/[\s\-]/g, "");
     if (c.length !== 10 || !/^\d{10}$/.test(c))
@@ -535,18 +559,90 @@ function validatePolishNip(candidate) {
         total += d[i] * weights[i];
     return total % 11 === d[9];
 }
+/**
+ * Polish identity card (dowód osobisty): 3 letters + 6 digits, the first digit
+ * a check digit. Letters A=10 … Z=35, weights 7,3,1,9,7,3,1,7,3: the weighted
+ * sum of all nine is 0 mod 10 exactly when the check digit is right (rules-engine#75).
+ */
+function validatePolishIdCard(candidate) {
+    const c = candidate.replace(/\s/g, "").toUpperCase();
+    if (!/^[A-Z]{3}\d{6}$/.test(c))
+        return false;
+    const weights = [7, 3, 1, 9, 7, 3, 1, 7, 3];
+    let total = 0;
+    for (let i = 0; i < 9; i++) {
+        const ch = c[i];
+        total += (/[A-Z]/.test(ch) ? ch.charCodeAt(0) - 55 : Number(ch)) * weights[i];
+    }
+    return total % 10 === 0;
+}
+/**
+ * Polish REGON: 9 digits, or 14 for a local unit, each with a mod-11 check (a
+ * remainder of 10 counts as 0). A 14-digit REGON begins with its parent's valid
+ * 9-digit REGON (rules-engine#76).
+ */
+function validatePolishRegon(candidate) {
+    const c = candidate.replace(/[\s\-]/g, "");
+    if (!/^\d+$/.test(c) || (c.length !== 9 && c.length !== 14))
+        return false;
+    const check = (digits, weights) => {
+        let total = 0;
+        for (let i = 0; i < weights.length; i++)
+            total += Number(digits[i]) * weights[i];
+        const rest = total % 11;
+        return (rest === 10 ? 0 : rest) === Number(digits[weights.length]);
+    };
+    if (!check(c.slice(0, 9), [8, 9, 2, 3, 4, 5, 6, 7]))
+        return false;
+    return c.length === 9 || check(c, [2, 4, 8, 5, 0, 9, 7, 3, 6, 1, 2, 4, 8]);
+}
+// Days per month for the rodné číslo date check. February is 29 because the
+// century is not recoverable from a two-digit year, so a leap year cannot be
+// ruled out -- being permissive by one day is the right direction here.
+const RC_DAYS = [31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+// The calendar month a rodné číslo month field encodes, or null. Four ranges
+// are legal: 1-12 is a man, +50 a woman, and since 2004 +20 marks a birth on a
+// day whose sequence numbers were exhausted (so +70 is a woman on such a day).
+// Whether `day` exists in `month`, February permissive at 29 because a
+// two-digit year does not reveal the century.
+function isRealDay(month, day) {
+    return month >= 1 && month <= 12 && day >= 1 && day <= RC_DAYS[month - 1];
+}
+function czechMonth(raw) {
+    for (const offset of [0, 20, 50, 70]) {
+        if (raw - offset >= 1 && raw - offset <= 12)
+            return raw - offset;
+    }
+    return null;
+}
+// The date is checked, not only the checksum. Without it the validator accepted
+// an impossible month, and a Czech mobile number is the same shape -- nine
+// digits opening 6 or 7 -- so any mobile that happened to pass mod 11 was typed
+// NATIONAL_ID at high confidence: 606666032 (MM=66), 778836400 (MM=88),
+// 728990603 (MM=89). 284 per corpus pass, the largest single false-positive
+// bucket in the evaluation (rules-engine#37).
 function validateCzechBirthNumber(candidate) {
     const c = candidate.replace(/[/\s]/g, "");
     if (!/^\d+$/.test(c) || (c.length !== 9 && c.length !== 10))
         return false;
+    const month = czechMonth(parseInt(c.slice(2, 4), 10));
+    if (month === null)
+        return false;
+    const day = parseInt(c.slice(4, 6), 10);
+    if (day < 1 || day > RC_DAYS[month - 1])
+        return false;
     if (c.length === 10)
         return parseInt(c) % 11 === 0;
     return true;
 }
+// S YY MM DD JJ NNN C -- the leading S carries the century, so the month needs
+// no offset convention here (rules-engine#43).
 function validateRomanianCnp(candidate) {
     const c = candidate.replace(/[\s\-]/g, "");
     if (c.length !== 13 || !/^\d{13}$/.test(c) || !"12345678".includes(c[0]))
         return false;
+    if (!isRealDay(parseInt(c.slice(3, 5), 10), parseInt(c.slice(5, 7), 10)))
+        return false;
     const key = "279146358279";
     let total = 0;
     for (let i = 0; i < 12; i++)
@@ -593,10 +689,14 @@ function validateCroatianOib(candidate) {
     const check = (11 - product) % 10;
     return check === parseInt(c[10]);
 }
+// DD MM YYY RR BBB K -- note EMSO opens with the *day*, where the Czech, Polish
+// and Romanian forms open with the year or a century digit (rules-engine#43).
 function validateSlovenianEmso(candidate) {
     const c = candidate.replace(/[\s\-]/g, "");
     if (c.length !== 13 || !/^\d{13}$/.test(c))
         return false;
+    if (!isRealDay(parseInt(c.slice(2, 4), 10), parseInt(c.slice(0, 2), 10)))
+        return false;
     const d = c.split("").map(Number);
     const weights = [7, 6, 5, 4, 3, 2, 7, 6, 5, 4, 3, 2];
     let total = 0;
@@ -746,6 +846,9 @@ exports.VALIDATORS = {
     portuguese_nif: validatePortugueseNif,
     polish_pesel: validatePolishPesel,
     polish_nip: validatePolishNip,
+    polish_nrb: validatePolishNrb,
+    polish_id_card: validatePolishIdCard,
+    polish_regon: validatePolishRegon,
     czech_birth_number: validateCzechBirthNumber,
     romanian_cnp: validateRomanianCnp,
     hungarian_taj: validateHungarianTaj,

package/dist/cjs/sdk.js

@@ -35,8 +35,10 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EuRedact = exports.TokenMapper = exports.TOKEN_SUFFIX_LENGTH = exports.TOKEN_ALPHABET = void 0;
 exports.applyReplacements = applyReplacements;
+exports.maskForCloud = maskForCloud;
+exports.ontoOriginal = ontoOriginal;
 exports.restore = restore;
-const node_crypto_1 = require("node:crypto");
+const platform_js_1 = require("./platform.js");
 const cache_js_1 = require("./cache.js");
 const normalizer_js_1 = require("./normalizer.js");
 const engine_js_1 = require("./rules/engine.js");
@@ -87,11 +89,104 @@ function applyReplacements(text, detections, labelFor) {
     return parts.join("");
 }
 /**
- * Characters a token suffix is drawn from. No vowels, so a suffix never spells
- * a word; no 0/1/I/O, so it survives being read back by a person; no
- * underscore, so the type prefix stays unambiguous.
+ * Bracket-mask `text` and record where each label landed.
+ *
+ * Returns what is sent to the cloud tier, plus one `WireLabel` per label.
+ * Everything between labels is copied unchanged, so the labels are all it
+ * takes to carry an offset from the masked text back to the original.
+ *
+ * Always `[TYPE]`, whatever label scheme the caller asked for. That is the
+ * syntax the model was trained on, where a placeholder means "already handled,
+ * do not list it". A token or a numbered label would be read as ordinary text,
+ * so the format on the wire is a model contract and not an output option.
+ */
+/** @internal Shared with cloud/batches.ts. */
+function maskForCloud(text, detections) {
+    const parts = [];
+    const labels = [];
+    let pos = 0;
+    let out = 0;
+    for (const det of detections) {
+        const start = Math.max(det.start, pos);
+        if (det.end <= start)
+            continue;
+        const label = `[${det.entityType}]`;
+        out += start - pos;
+        parts.push(text.slice(pos, start), label);
+        labels.push([out, out + label.length, start, det.end]);
+        out += label.length;
+        pos = det.end;
+    }
+    parts.push(text.slice(pos));
+    return [parts.join(""), labels];
+}
+/** Index of the last label starting at or before `offset` — strictly before
+ *  when `strict` — or -1. */
+function labelBefore(labels, offset, strict) {
+    let lo = 0;
+    let hi = labels.length;
+    while (lo < hi) {
+        const mid = (lo + hi) >>> 1;
+        if (strict ? labels[mid][0] < offset : labels[mid][0] <= offset)
+            lo = mid + 1;
+        else
+            hi = mid;
+    }
+    return lo - 1;
+}
+/**
+ * Carry the service's spans from the masked text onto the original.
+ *
+ * The service only ever saw `masked`, so its offsets index that. An offset in
+ * copied text shifts by whatever the labels before it added or removed. An
+ * offset inside a label has no counterpart in the original, so it snaps
+ * outward to the edge of the value the label replaced: an address the model
+ * reports around `[POSTAL_CODE]` covers the postal code, never half of it.
+ * Over-masking is the safe direction.
+ *
+ * A span lying wholly inside one label describes the label, not the document.
+ * It is dropped; the local detection behind the label stands.
+ *
+ * Throws `Unplaceable` when a span does not match the text that was sent. Such
+ * a span cannot be placed, and masking where it points would cover the wrong
+ * characters and leave the right ones in the clear.
+ */
+/** @internal Shared with cloud/batches.ts. */
+function ontoOriginal(spans, masked, text, labels, Unplaceable) {
+    const placed = [];
+    for (const span of spans) {
+        if (!(0 <= span.start && span.start <= span.end && span.end <= masked.length) ||
+            masked.slice(span.start, span.end) !== span.text) {
+            throw new Unplaceable("span offsets do not match the text that was sent; cannot place the " +
+                "service's detections in the document");
+        }
+        if (span.start === span.end)
+            continue;
+        let start = span.start;
+        let at = labelBefore(labels, span.start, false);
+        if (at >= 0) {
+            const [, maskedEnd, origStart, origEnd] = labels[at];
+            if (span.end <= maskedEnd)
+                continue;
+            start = span.start < maskedEnd ? origStart : origEnd + span.start - maskedEnd;
+        }
+        let end = span.end;
+        at = labelBefore(labels, span.end, true);
+        if (at >= 0) {
+            const [, maskedEnd, , origEnd] = labels[at];
+            end = origEnd + Math.max(0, span.end - maskedEnd);
+        }
+        placed.push({ ...span, start, end, text: text.slice(start, end) });
+    }
+    return placed;
+}
+/**
+ * Characters a token suffix is drawn from. No vowels (and no Y), so a suffix
+ * never spells a word; no 0/1/I/O, so it survives being read back by a person;
+ * no underscore, so the type prefix stays unambiguous. A, E, U and Y were in it
+ * until rules-engine#55, against this comment.
  */
-exports.TOKEN_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+exports.TOKEN_ALPHABET = "BCDFGHJKLMNPQRSTVWXZ23456789";
 exports.TOKEN_SUFFIX_LENGTH = 4;
 const TOKEN_MAX_DRAWS = 100;
 function escapeRegExp(s) {
@@ -139,7 +234,7 @@ class TokenMapper {
                 }
                 let suffix = "";
                 for (let i = 0; i < exports.TOKEN_SUFFIX_LENGTH; i++) {
-                    suffix += exports.TOKEN_ALPHABET[(0, node_crypto_1.randomInt)(exports.TOKEN_ALPHABET.length)];
+                    suffix += exports.TOKEN_ALPHABET[(0, platform_js_1.randomIndex)(exports.TOKEN_ALPHABET.length)];
                 }
                 token = prefix + suffix;
             } while (this.taken.has(token));
@@ -425,7 +520,16 @@ class EuRedact {
         return (det) => `[${det.entityType}]`;
     }
     /**
-     * Send a document to the cloud tier.
+     * Run the rules here, then send what they left to the cloud tier.
+     *
+     * Local-first: the rules engine masks everything it can find on the caller's
+     * machine, and only that masked text is sent. The service looks for what has
+     * no shape to match on — names, employers, diagnoses — and answers with
+     * spans relative to the text it received, which are mapped back onto the
+     * original here.
+     *
+     * This is minimisation, not an exemption: what the rules miss, and the names
+     * and diagnoses the model is there to find, still travel.
      *
      * Options the service cannot honour throw rather than being ignored. Silently
      * dropping one would mean returning a result that does not match what was
@@ -434,6 +538,7 @@ class EuRedact {
      */
     async redactViaCloud(text, options) {
         const { CloudClient } = await Promise.resolve().then(() => __importStar(require("./cloud/client.js")));
+        const { CloudError } = await Promise.resolve().then(() => __importStar(require("./cloud/errors.js")));
         const countries = options.countries ?? null;
         if (!countries || countries.length !== 1) {
             throw new Error('cloud mode needs exactly one country, e.g. { countries: ["BE"] }. The ' +
@@ -451,43 +556,37 @@ class EuRedact {
         if (options.referentialIntegrity) {
             throw new Error("referentialIntegrity is not supported in cloud mode");
         }
-        // detectDates is deliberately NOT forwarded. The service always runs its
-        // rules engine with dates on, because that is what the model was trained
-        // against; the caller's value cannot change that. It is the one ignored
-        // option that is safe to ignore — it can only cause MORE to be detected,
-        // never less, so it cannot produce under-redaction.
         const allowed = this.allowedFor(options);
         const domains = this.domainsFor(options);
-        const result = await new CloudClient().redact(text, { country: countries[0] });
-        if (options.tokenize || allowed.size > 0 || domains.size > 0) {
-            await this.remaskCloudResult(result, text, { tokenize: options.tokenize ?? false, allowed, domains });
-        }
-        return result;
-    }
-    /**
-     * Rebuild the masked text from the service's spans, in place.
-     *
-     * The service masks with bracketed labels only. Any other output option is
-     * applied here, from its spans: the service builds its `redacted_text` from
-     * exactly the spans it returns (entities it reports but cannot place are
-     * listed separately and never applied), so nothing it masked is lost by
-     * masking again from the same spans.
-     *
-     * The service reports offsets in code points and this SDK slices UTF-16
-     * units, so the slice check is what stands between an emoji in the document
-     * and a rebuilt text with the wrong characters masked.
-     */
-    async remaskCloudResult(result, text, opts) {
-        const { CloudError } = await Promise.resolve().then(() => __importStar(require("./cloud/errors.js")));
-        for (const det of result.detections) {
-            if (text.slice(det.start, det.end) !== det.text) {
-                throw new CloudError("span offsets do not match the document; cannot apply tokenize/allowlist locally");
-            }
-        }
-        [result.detections, result.exempted] = applyAllowlist(text, result.detections, opts.allowed, opts.domains);
-        const tokenMapper = opts.tokenize ? new TokenMapper(text, result.detections) : null;
-        result.redactedText = applyReplacements(text, result.detections, this.labelFor(false, tokenMapper));
-        result.tokens = tokenMapper ? tokenMapper.tokens : {};
+        const client = new CloudClient();
+        // Dates are always on, whatever detectDates says: that is the rules output
+        // the model was trained against, and a date of birth the rules can place
+        // has no reason to travel. It is the one ignored option that is safe to
+        // ignore — it can only cause MORE to be detected, never less.
+        //
+        // No allowlist and no tokens on this pass. An exemption says what the
+        // caller wants back, not what may leave; both are applied below, after the
+        // response, to the merged spans.
+        const local = this.redactRules(text, { countries, detectDates: true, cache: options.cache }, new Map(), new Map());
+        const [masked, labels] = maskForCloud(text, local.detections);
+        // The client converts the service's code-point offsets to UTF-16 units of
+        // the text it sent, so everything from here on is in one unit.
+        const remote = await client.redact(masked, {
+            country: countries[0], idempotencyKey: options.idempotencyKey,
+        });
+        // A new array throughout: `local` may be the cached rules result.
+        const [detections, exempted] = applyAllowlist(text, [...local.detections, ...ontoOriginal(remote.detections, masked, text, labels, CloudError)], allowed, domains);
+        detections.sort((a, b) => a.start - b.start || b.end - a.end);
+        const tokenMapper = options.tokenize ? new TokenMapper(text, detections) : null;
+        return {
+            ...local,
+            redactedText: applyReplacements(text, detections, this.labelFor(false, tokenMapper)),
+            detections,
+            source: "cloud",
+            tokens: tokenMapper ? tokenMapper.tokens : {},
+            exempted,
+            ...(remote.cloud ? { cloud: remote.cloud } : {}),
+        };
     }
     redact(text, options = {}) {
         checkCountryArg(options.countries, "countries");
@@ -508,12 +607,19 @@ class EuRedact {
         if (requestedMode !== "rules") {
             throw new Error(`unknown mode ${JSON.stringify(requestedMode)}: expected "rules" or "cloud"`);
         }
+        if (options.idempotencyKey !== undefined) {
+            throw new Error('idempotencyKey applies to mode: "cloud" only: a rules-only redaction makes no request to deduplicate');
+        }
+        return this.redactRules(text, options, allowed, domains);
+    }
+    /** The local pipeline: normalise, detect, exempt, mask. */
+    redactRules(text, options, allowed, domains) {
         if (text.length > this.maxInputLength) {
             throw new Error(`Input text length (${text.length.toLocaleString()} chars) exceeds the maximum ` +
                 `(${this.maxInputLength.toLocaleString()} chars). Split the input or ` +
                 `increase maxInputLength when constructing EuRedact.`);
         }
-        const { countries = null, countryHint = null, context = null, chunkOffset = 0, mode = "rules", referentialIntegrity = false, tokenize = false, detectDates = false, } = options;
+        const { countries = null, countryHint = null, context = null, chunkOffset = 0, referentialIntegrity = false, tokenize = false, detectDates = false, } = options;
         // A context makes the result depend on evidence from other chunks, so the
         // text no longer identifies the result. Caching is disabled rather than
         // keyed on the context, whose contents change as chunks arrive.
@@ -531,7 +637,7 @@ class EuRedact {
         // separator, and two different lists must never share a key.
         const allowKey = (allowed.size ? JSON.stringify([...allowed.keys()].sort()) : "")
             + (domains.size ? "|dom=" + JSON.stringify([...domains.keys()].sort()) : "");
-        const cacheMode = `${mode}|dates=${detectDates}|hint=${hintKey}|ri=${referentialIntegrity}|tok=${tokenize}|allow=${allowKey}`;
+        const cacheMode = `rules|dates=${detectDates}|hint=${hintKey}|ri=${referentialIntegrity}|tok=${tokenize}|allow=${allowKey}`;
         let cacheKey;
         if (cache) {
             cacheKey = this.cache.key(normalizedText, countriesTuple, cacheMode);

package/dist/cjs/types.js

@@ -79,7 +79,8 @@ var EntityType;
     EntityType["BIOMETRIC_REF"] = "BIOMETRIC_REF";
     EntityType["FINANCIAL_AMOUNT"] = "FINANCIAL_AMOUNT";
     EntityType["QUASI_IDENTIFIER"] = "QUASI_IDENTIFIER";
-    EntityType["CREDENTIAL"] = "CREDENTIAL";
+    /** Legacy alias of SECRET: every credential, the model's included, is SECRET (rules-engine#111). */
+    EntityType["CREDENTIAL"] = "SECRET";
     EntityType["URL"] = "URL";
     EntityType["OTHER"] = "OTHER";
 })(EntityType || (exports.EntityType = EntityType = {}));
@@ -93,6 +94,8 @@ exports.LEGACY_TYPE_ALIASES = {
     NAME: "PERSON_NAME",
     STREET_ADDRESS: "ADDRESS",
     NATIONALITY_ETHNICITY: "SENSITIVE_ATTRIBUTE",
+    // The model labels prose credentials CREDENTIAL; the SDK reports every credential as SECRET (rules-engine#111).
+    CREDENTIAL: "SECRET",
 };
 /**
  * Resolve a possibly-legacy type name to its canonical form.

package/dist/esm/cache.js

@@ -1,4 +1,4 @@
-import { createHash } from "node:crypto";
+import { sha256Hex } from "./platform.js";
 // Default ceiling on retained characters, not entries. A count-only cap of
 // 1024 entries says nothing about memory: 1024 cached 1 MB documents is a
 // gigabyte of PII-bearing text held live. ~16M characters is a few tens of MB.
@@ -33,13 +33,7 @@ export class ResultCache {
         // deployment an attacker who can guess a victim's document could submit a
         // same-length colliding one and be served the victim's cached result,
         // detections and raw matched PII included.
-        return createHash("sha256")
-            .update(text)
-            .update("|")
-            .update(sorted.join("|"))
-            .update("|")
-            .update(mode)
-            .digest("hex");
+        return sha256Hex([text, "|", sorted.join("|"), "|", mode]);
     }
     get(key) {
         if (!this.enabled)

package/dist/esm/cloud/account.d.ts

@@ -0,0 +1,155 @@
+/**
+ * [CLOUD EXTENSION] The account and job endpoints an API key may call.
+ *
+ * Everything a customer's key can do on the service is reachable from the SDK
+ * (rules-engine#89): redaction (`CloudClient`, `redactAsync`), batches
+ * (`Batches`), a past job (`Jobs`) and the account itself (`Account`). What
+ * needs a signed-in person -- logging in, minting keys, changing settings,
+ * members, accepting terms -- is not here, because a key cannot do it.
+ *
+ * Every typed value carries `raw`, the service's JSON, so a field the SDK does
+ * not know yet is still reachable.
+ */
+import { type CloudConfig } from "./config.js";
+import type { RedactResult } from "../types.js";
+type Json = Record<string, unknown>;
+/** `GET /v1/account`: plan limits, retention and usage against quota. */
+export interface AccountSummary {
+    tenantId: string | null;
+    tenantName: string | null;
+    active: boolean | null;
+    memberSince: string | null;
+    role: string | null;
+    /** `"ttl"`, or `"none"` when text is discarded on delivery. */
+    retentionMode: string | null;
+    payloadTtlHours: number | null;
+    documentsToday: number | null;
+    documentsThisMonth: number | null;
+    tokensThisMonth: number | null;
+    failures24h: number | null;
+    /** `null` for an account without a daily quota. */
+    dailyQuota: number | null;
+    quotaRemaining: number | null;
+    activeKeys: number | null;
+    batchesAvailable: boolean | null;
+    raw: Json;
+}
+/** `GET /v1/account/credits`: the balance, in credits. */
+export interface Credits {
+    balance: number | null;
+    granted: number | null;
+    spent: number | null;
+    unit: string | null;
+    raw: Json;
+}
+/** One line of the credit history: movements rolled up per minute, reason and direction, newest first. */
+export interface CreditEntry {
+    at: string | null;
+    /** Negative for a debit. */
+    delta: number | null;
+    reason: string | null;
+    count: number | null;
+    jobId: string | null;
+    sourceRef: string | null;
+    raw: Json;
+}
+/** One day of `GET /v1/account/usage`, or of one key's series. */
+export interface UsageDay {
+    day: string | null;
+    documents: number | null;
+    tokens: number | null;
+    failures: number | null;
+    rulesOnly: number | null;
+    raw: Json;
+}
+/** One key of `GET /v1/account/usage/by-key`; the rest are rolled into one with `keyId` null. */
+export interface KeyUsage {
+    keyId: number | null;
+    name: string | null;
+    documents: number | null;
+    tokens: number | null;
+    failures: number | null;
+    series: UsageDay[];
+    raw: Json;
+}
+/** One key of `GET /v1/account/keys`. Never its secret. */
+export interface ApiKey {
+    id: number | null;
+    name: string | null;
+    createdBy: string | null;
+    createdAt: string | null;
+    lastUsedAt: string | null;
+    revokedAt: string | null;
+    active: boolean | null;
+    raw: Json;
+}
+/** The answer to `POST /v1/account/keys/{id}/revoke`. */
+export interface KeyRevocation {
+    id: number | null;
+    keysRemaining: number | null;
+    /** True when no active key is left: nothing can call the service until a person mints one. */
+    lockedOut: boolean | null;
+    /** True when the key revoked is the one that made this call. */
+    selfRevoked: boolean | null;
+    raw: Json;
+}
+/** `GET /v1/jobs/{id}`: a job's state, and its result once it has one. */
+export interface Job {
+    jobId: string;
+    /** `queued`, `running` or `succeeded`. A failed or rejected job throws instead. */
+    status: string;
+    createdAt: string | null;
+    /**
+     * Set when the job succeeded. Its text and offsets are those of the text the
+     * service received -- under the local-first cloud mode, the locally masked
+     * text, not the caller's original.
+     */
+    result: RedactResult | null;
+    raw: Json;
+}
+export interface ApiClientOptions {
+    /** Injectable for tests. Defaults to the platform `fetch`. */
+    fetchImpl?: typeof fetch;
+}
+/** A JSON client: GETs are retried like the redact call; writes are sent once. */
+declare class ApiClient {
+    readonly config: CloudConfig;
+    private readonly fetchImpl?;
+    constructor(config?: CloudConfig | null, options?: ApiClientOptions);
+    protected call(method: "GET" | "POST", path: string, params?: Record<string, number>, retry?: boolean): Promise<Json>;
+}
+/**
+ * The account an API key belongs to: summary, credits, usage and keys.
+ *
+ * These calls pass with an API key while the service accepts account calls
+ * without a browser `Origin` (its `EUREDACT_CONSOLE_REQUIRE_ORIGIN=0`); a
+ * refusal arrives as a `CloudError` with status 403.
+ */
+export declare class Account extends ApiClient {
+    summary(): Promise<AccountSummary>;
+    credits(): Promise<Credits>;
+    /** Recent credit movements, newest first (1-500). */
+    creditHistory(limit?: number): Promise<CreditEntry[]>;
+    /** Documents, tokens and failures per day over the last `days`. */
+    usage(days?: number): Promise<UsageDay[]>;
+    /** The same window, split by the key that submitted the work. */
+    usageByKey(days?: number): Promise<KeyUsage[]>;
+    keys(): Promise<ApiKey[]>;
+    /**
+     * Revoke a key, e.g. one that leaked: the one write a key may make. Sent once,
+     * never retried. Already revoked throws a `CloudError` with status 409; a key
+     * that does not exist, or is another account's, throws `NotFoundError`.
+     * Revoking the key this client uses works, and is reported by `selfRevoked`.
+     */
+    revokeKey(keyId: number): Promise<KeyRevocation>;
+}
+/** Past jobs, by id. */
+export declare class Jobs extends ApiClient {
+    /**
+     * A job's state, and its result if it has one. Throws `ResultExpiredError`
+     * when the job succeeded but its result is no longer retained, and
+     * `NotFoundError` for an unknown job (or another account's).
+     */
+    retrieve(jobId: string): Promise<Job>;
+}
+export {};