gavio 0.1.0

package/dist/cjs/interceptors/audit/sinks/stdout.js

@@ -0,0 +1,33 @@
+"use strict";
+/** stdoutSink — human-readable audit output for development (F-OBS-05). */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stdoutSink = stdoutSink;
+/** Print each audit record to stdout. Zero dependencies. */
+function stdoutSink(options = {}) {
+    const pretty = options.pretty ?? true;
+    // eslint-disable-next-line no-console
+    const emit = options.write ?? ((line) => console.log(line));
+    return {
+        async write(record) {
+            const data = record.toJSON();
+            emit(pretty ? formatPretty(data) : JSON.stringify(data));
+        },
+    };
+}
+function formatPretty(data) {
+    const usage = data['tokenUsage'];
+    const piiTypes = data['piiEntityTypes'];
+    const pii = piiTypes.length > 0 ? piiTypes : ['none'];
+    const interceptors = data['interceptorsFired'];
+    const traceId = String(data['traceId']);
+    const cost = Number(data['costUsd']);
+    return ('[gavio:audit] ' +
+        `trace=${traceId.slice(0, 18)}… ` +
+        `${String(data['provider'])}/${String(data['model'])} ` +
+        `tokens=${usage.totalTokens} ` +
+        `cost=$${cost.toFixed(6)} ` +
+        `latency=${String(data['latencyMs'])}ms ` +
+        `cache=${data['cacheHit'] ? 'HIT' : 'miss'} ` +
+        `pii=${pii.join(',')} ` +
+        `interceptors=[${interceptors.join(',')}]`);
+}

package/dist/cjs/interceptors/base.js

@@ -0,0 +1,7 @@
+"use strict";
+/** The Interceptor interface — the unit of composition in Gavio. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isExecutorPolicy = isExecutorPolicy;
+function isExecutorPolicy(i) {
+    return i.isExecutorPolicy === true;
+}

package/dist/cjs/interceptors/cache/backend.js

@@ -0,0 +1,9 @@
+"use strict";
+/**
+ * CacheBackend — the key/value contract behind the cache interceptors.
+ *
+ * The full SemanticCache interceptor lands in v0.2.0 (F-CACHE-01/02). v0.1.0
+ * ships the backend interface and the in-memory backend so dev mode has a
+ * working, dependency-free cache substrate.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/interceptors/cache/backends/index.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.memoryCacheBackend = void 0;
+var memory_js_1 = require("./memory.js");
+Object.defineProperty(exports, "memoryCacheBackend", { enumerable: true, get: function () { return memory_js_1.memoryCacheBackend; } });

package/dist/cjs/interceptors/cache/backends/memory.js

@@ -0,0 +1,53 @@
+"use strict";
+/** In-memory cache backend (F-CACHE-03) — default zero-dependency dev backend. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.memoryCacheBackend = memoryCacheBackend;
+/** LRU-bounded, optionally TTL'd in-process cache. Not shared across processes. */
+class MemoryBackend {
+    maxSize;
+    // Map preserves insertion order, which we use for LRU eviction.
+    store = new Map();
+    constructor(maxSize = 1000) {
+        this.maxSize = maxSize;
+    }
+    async get(key) {
+        const entry = this.store.get(key);
+        if (entry === undefined)
+            return null;
+        if (entry.expiresAt !== null && now() > entry.expiresAt) {
+            this.store.delete(key);
+            return null;
+        }
+        // Move to end (most-recently-used).
+        this.store.delete(key);
+        this.store.set(key, entry);
+        return entry.value;
+    }
+    async set(key, value, ttlSeconds) {
+        const expiresAt = ttlSeconds ? now() + ttlSeconds * 1000 : null;
+        this.store.delete(key);
+        this.store.set(key, { value, expiresAt });
+        while (this.store.size > this.maxSize) {
+            const oldest = this.store.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.store.delete(oldest);
+        }
+    }
+    async delete(key) {
+        this.store.delete(key);
+    }
+    async clear() {
+        this.store.clear();
+    }
+    get size() {
+        return this.store.size;
+    }
+}
+function now() {
+    return Date.now();
+}
+/** Factory: build an in-memory cache backend. */
+function memoryCacheBackend(options = {}) {
+    return new MemoryBackend(options.maxSize ?? 1000);
+}

package/dist/cjs/interceptors/cache/index.js

@@ -0,0 +1,9 @@
+"use strict";
+/**
+ * Caching substrate. The SemanticCache interceptor ships in v0.2.0; v0.1.0
+ * exposes the CacheBackend interface and the in-memory backend only.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.memoryCacheBackend = void 0;
+var memory_js_1 = require("./backends/memory.js");
+Object.defineProperty(exports, "memoryCacheBackend", { enumerable: true, get: function () { return memory_js_1.memoryCacheBackend; } });

package/dist/cjs/interceptors/chain.js

@@ -0,0 +1,57 @@
+"use strict";
+/** InterceptorChain — runs the pre/post pipeline around the provider call. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InterceptorChain = void 0;
+const dryRunSafe = (i) => i.dryRunSafe !== false;
+/**
+ * Ordered list of interceptors wrapping an executor.
+ *
+ * `before` hooks fire in order; the executor runs; `after` hooks fire in
+ * reverse order (onion model). If any stage throws, every interceptor's
+ * `onError` is invoked before the error propagates.
+ */
+class InterceptorChain {
+    interceptors;
+    constructor(interceptors) {
+        this.interceptors = [...interceptors];
+    }
+    async execute(request, ctx, executor) {
+        try {
+            let req = request;
+            for (const interceptor of this.interceptors) {
+                if (ctx.dryRun && !dryRunSafe(interceptor))
+                    continue;
+                if (interceptor.before) {
+                    req = await interceptor.before(req, ctx);
+                }
+                ctx.markFired(interceptor.name);
+            }
+            let response = await executor(req);
+            for (let i = this.interceptors.length - 1; i >= 0; i--) {
+                const interceptor = this.interceptors[i];
+                if (ctx.dryRun && !dryRunSafe(interceptor))
+                    continue;
+                if (interceptor.after) {
+                    response = await interceptor.after(response, ctx);
+                }
+            }
+            response.interceptorsFired = [...ctx.interceptorsFired];
+            return response;
+        }
+        catch (error) {
+            const err = error instanceof Error ? error : new Error(String(error));
+            for (const interceptor of this.interceptors) {
+                if (interceptor.onError) {
+                    try {
+                        await interceptor.onError(err, ctx);
+                    }
+                    catch {
+                        // on_error must never break the propagation of the original error.
+                    }
+                }
+            }
+            throw error;
+        }
+    }
+}
+exports.InterceptorChain = InterceptorChain;

package/dist/cjs/interceptors/index.js

@@ -0,0 +1,18 @@
+"use strict";
+/** Interceptor barrel. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.memoryCacheBackend = exports.fallbackChain = exports.timeoutPolicy = exports.retryInterceptor = exports.auditInterceptor = exports.piiGuard = exports.InterceptorChain = exports.isExecutorPolicy = void 0;
+var base_js_1 = require("./base.js");
+Object.defineProperty(exports, "isExecutorPolicy", { enumerable: true, get: function () { return base_js_1.isExecutorPolicy; } });
+var chain_js_1 = require("./chain.js");
+Object.defineProperty(exports, "InterceptorChain", { enumerable: true, get: function () { return chain_js_1.InterceptorChain; } });
+var index_js_1 = require("./pii/index.js");
+Object.defineProperty(exports, "piiGuard", { enumerable: true, get: function () { return index_js_1.piiGuard; } });
+var index_js_2 = require("./audit/index.js");
+Object.defineProperty(exports, "auditInterceptor", { enumerable: true, get: function () { return index_js_2.auditInterceptor; } });
+var index_js_3 = require("./reliability/index.js");
+Object.defineProperty(exports, "retryInterceptor", { enumerable: true, get: function () { return index_js_3.retryInterceptor; } });
+Object.defineProperty(exports, "timeoutPolicy", { enumerable: true, get: function () { return index_js_3.timeoutPolicy; } });
+Object.defineProperty(exports, "fallbackChain", { enumerable: true, get: function () { return index_js_3.fallbackChain; } });
+var index_js_4 = require("./cache/index.js");
+Object.defineProperty(exports, "memoryCacheBackend", { enumerable: true, get: function () { return index_js_4.memoryCacheBackend; } });

package/dist/cjs/interceptors/pii/context.js

@@ -0,0 +1,25 @@
+"use strict";
+/** ScanContext — per-request state shared across PII scanners. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScanContext = void 0;
+/**
+ * Context threaded through every scanner for one request.
+ *
+ * Tracks a monotonic per-entity-type index so repeated entities get stable,
+ * distinct placeholders (`[EMAIL_1]`, `[EMAIL_2]`).
+ */
+class ScanContext {
+    language;
+    locale;
+    counters = {};
+    constructor(language = 'en', locale = 'NL') {
+        this.language = language;
+        this.locale = locale;
+    }
+    /** Return the next 1-based index for an entity type. */
+    nextIndex(entityType) {
+        this.counters[entityType] = (this.counters[entityType] ?? 0) + 1;
+        return this.counters[entityType];
+    }
+}
+exports.ScanContext = ScanContext;

package/dist/cjs/interceptors/pii/guard.js

@@ -0,0 +1,161 @@
+"use strict";
+/**
+ * PiiGuard — the pre/post interceptor that detects and redacts PII.
+ *
+ * Pipeline rule (privacy): PII is scanned on every request before it reaches
+ * the provider. Detected entities are redacted/masked/tagged or blocked. In
+ * REDACT mode the original values are restored in the response.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveOverlaps = resolveOverlaps;
+exports.piiGuard = piiGuard;
+const errors_js_1 = require("../../errors.js");
+const types_js_1 = require("../../types.js");
+const context_js_1 = require("./context.js");
+const match_js_1 = require("./match.js");
+const scanner_js_1 = require("./scanner.js");
+const index_js_1 = require("./scanners/index.js");
+const STATE_KEY = 'pii_replacements';
+// Confidence floor per sensitivity level — matches below the floor are ignored.
+const CONFIDENCE_FLOOR = {
+    [types_js_1.Sensitivity.STRICT]: 0.0,
+    [types_js_1.Sensitivity.BALANCED]: 0.6,
+    [types_js_1.Sensitivity.PERMISSIVE]: 0.9,
+};
+class PiiGuard {
+    name = 'pii_guard';
+    dryRunSafe = true;
+    scanners;
+    sensitivity;
+    mode;
+    restoreOnResponse;
+    logEntityTypes;
+    ownDryRun;
+    locale;
+    language;
+    constructor(options = {}) {
+        this.scanners = options.scanners ?? (0, index_js_1.defaultScanners)();
+        this.sensitivity = options.sensitivity ?? types_js_1.Sensitivity.STRICT;
+        this.mode = options.mode ?? types_js_1.PiiMode.REDACT;
+        this.restoreOnResponse = options.restoreOnResponse ?? true;
+        this.logEntityTypes = options.logEntityTypes ?? true;
+        this.ownDryRun = options.dryRun ?? false;
+        this.locale = options.locale ?? 'NL';
+        this.language = options.language ?? 'en';
+    }
+    async before(request, ctx) {
+        const scanCtx = new context_js_1.ScanContext(this.language, this.locale);
+        const floor = CONFIDENCE_FLOOR[this.sensitivity];
+        const newMessages = [];
+        const allTypes = [];
+        const replacements = ctx.state[STATE_KEY] ?? {};
+        const isDryRun = this.ownDryRun || ctx.dryRun;
+        for (const message of request.messages) {
+            const content = message.content ?? '';
+            const matches = await this.scanText(content, scanCtx, floor);
+            for (const m of matches)
+                allTypes.push(m.entityType);
+            if (matches.length > 0 && this.mode === types_js_1.PiiMode.BLOCK) {
+                const types = matches.map((m) => m.entityType);
+                throw new errors_js_1.PiiBlockedError(types);
+            }
+            let redacted = content;
+            if (matches.length > 0 && !isDryRun) {
+                redacted = this.apply(content, matches, replacements);
+            }
+            newMessages.push({ ...message, content: redacted });
+        }
+        if (allTypes.length > 0) {
+            ctx.recordPii(allTypes);
+            if (this.logEntityTypes) {
+                const unique = Array.from(new Set(allTypes)).sort();
+                // eslint-disable-next-line no-console
+                console.info(`[gavio:pii] detected entity types: ${unique.join(', ')}`);
+            }
+        }
+        if (this.restoreOnResponse && Object.keys(replacements).length > 0) {
+            ctx.state[STATE_KEY] = replacements;
+        }
+        if (isDryRun)
+            return request;
+        return request.copyWithMessages(newMessages);
+    }
+    async after(response, ctx) {
+        if (!this.restoreOnResponse || this.mode !== types_js_1.PiiMode.REDACT)
+            return response;
+        const replacements = ctx.state[STATE_KEY];
+        if (!replacements || Object.keys(replacements).length === 0)
+            return response;
+        let content = response.content;
+        for (const [token, original] of Object.entries(replacements)) {
+            content = content.split(token).join(original);
+        }
+        if (content === response.content)
+            return response;
+        return response.copyWithContent(content);
+    }
+    async scanText(text, scanCtx, floor) {
+        const raw = [];
+        const ordered = [...this.scanners].sort((a, b) => (0, scanner_js_1.scannerTier)(a) - (0, scanner_js_1.scannerTier)(b));
+        for (const scanner of ordered) {
+            const found = await scanner.scan(text, scanCtx);
+            for (const match of found) {
+                if (match.confidence >= floor)
+                    raw.push(match);
+            }
+        }
+        return resolveOverlaps(raw);
+    }
+    apply(text, matches, replacements) {
+        // Replace right-to-left so earlier offsets stay valid.
+        const ordered = [...matches].sort((a, b) => b.start - a.start);
+        let out = text;
+        for (const match of ordered) {
+            const token = this.tokenFor(match);
+            if (this.mode === types_js_1.PiiMode.REDACT) {
+                replacements[token] = match.value;
+            }
+            out = out.slice(0, match.start) + token + out.slice(match.end);
+        }
+        return out;
+    }
+    tokenFor(match) {
+        if (this.mode === types_js_1.PiiMode.MASK) {
+            return '*'.repeat(Math.max((0, match_js_1.matchLength)(match), 1));
+        }
+        if (this.mode === types_js_1.PiiMode.TAG) {
+            return `<${match.entityType}>${match.value}</${match.entityType}>`;
+        }
+        // REDACT (default)
+        return match.replacement || `[${match.entityType}]`;
+    }
+}
+/**
+ * Drop lower-priority matches that overlap a kept one.
+ *
+ * Sort by start, then by descending span length (prefer the longer match),
+ * then by confidence. Greedily keep non-overlapping matches.
+ */
+function resolveOverlaps(matches) {
+    const ordered = [...matches].sort((a, b) => {
+        if (a.start !== b.start)
+            return a.start - b.start;
+        const lenDiff = (0, match_js_1.matchLength)(b) - (0, match_js_1.matchLength)(a);
+        if (lenDiff !== 0)
+            return lenDiff;
+        return b.confidence - a.confidence;
+    });
+    const kept = [];
+    let occupiedEnd = -1;
+    for (const match of ordered) {
+        if (match.start >= occupiedEnd) {
+            kept.push(match);
+            occupiedEnd = match.end;
+        }
+    }
+    return kept;
+}
+/** Factory: build a PiiGuard interceptor. */
+function piiGuard(options = {}) {
+    return new PiiGuard(options);
+}

package/dist/cjs/interceptors/pii/index.js

@@ -0,0 +1,28 @@
+"use strict";
+/** PII guard public surface. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultScanners = exports.ssnScanner = exports.secretScanner = exports.phoneScanner = exports.ipAddressScanner = exports.ibanScanner = exports.emailScanner = exports.creditCardScanner = exports.bsnScanner = exports.Sensitivity = exports.PiiMode = exports.matchLength = exports.makeMatch = exports.scannerTier = exports.ScannerRegistry = exports.ScanContext = exports.resolveOverlaps = exports.piiGuard = void 0;
+var guard_js_1 = require("./guard.js");
+Object.defineProperty(exports, "piiGuard", { enumerable: true, get: function () { return guard_js_1.piiGuard; } });
+Object.defineProperty(exports, "resolveOverlaps", { enumerable: true, get: function () { return guard_js_1.resolveOverlaps; } });
+var context_js_1 = require("./context.js");
+Object.defineProperty(exports, "ScanContext", { enumerable: true, get: function () { return context_js_1.ScanContext; } });
+var scanner_js_1 = require("./scanner.js");
+Object.defineProperty(exports, "ScannerRegistry", { enumerable: true, get: function () { return scanner_js_1.ScannerRegistry; } });
+Object.defineProperty(exports, "scannerTier", { enumerable: true, get: function () { return scanner_js_1.scannerTier; } });
+var match_js_1 = require("./match.js");
+Object.defineProperty(exports, "makeMatch", { enumerable: true, get: function () { return match_js_1.makeMatch; } });
+Object.defineProperty(exports, "matchLength", { enumerable: true, get: function () { return match_js_1.matchLength; } });
+var types_js_1 = require("../../types.js");
+Object.defineProperty(exports, "PiiMode", { enumerable: true, get: function () { return types_js_1.PiiMode; } });
+Object.defineProperty(exports, "Sensitivity", { enumerable: true, get: function () { return types_js_1.Sensitivity; } });
+var index_js_1 = require("./scanners/index.js");
+Object.defineProperty(exports, "bsnScanner", { enumerable: true, get: function () { return index_js_1.bsnScanner; } });
+Object.defineProperty(exports, "creditCardScanner", { enumerable: true, get: function () { return index_js_1.creditCardScanner; } });
+Object.defineProperty(exports, "emailScanner", { enumerable: true, get: function () { return index_js_1.emailScanner; } });
+Object.defineProperty(exports, "ibanScanner", { enumerable: true, get: function () { return index_js_1.ibanScanner; } });
+Object.defineProperty(exports, "ipAddressScanner", { enumerable: true, get: function () { return index_js_1.ipAddressScanner; } });
+Object.defineProperty(exports, "phoneScanner", { enumerable: true, get: function () { return index_js_1.phoneScanner; } });
+Object.defineProperty(exports, "secretScanner", { enumerable: true, get: function () { return index_js_1.secretScanner; } });
+Object.defineProperty(exports, "ssnScanner", { enumerable: true, get: function () { return index_js_1.ssnScanner; } });
+Object.defineProperty(exports, "defaultScanners", { enumerable: true, get: function () { return index_js_1.defaultScanners; } });

package/dist/cjs/interceptors/pii/match.js

@@ -0,0 +1,21 @@
+"use strict";
+/** PiiMatch — a single detected PII entity within a span of text. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.matchLength = matchLength;
+exports.makeMatch = makeMatch;
+function matchLength(m) {
+    return m.end - m.start;
+}
+function makeMatch(init) {
+    if (init.start < 0 || init.end < init.start) {
+        throw new Error(`Invalid PiiMatch span: start=${init.start}, end=${init.end}`);
+    }
+    return {
+        entityType: init.entityType,
+        start: init.start,
+        end: init.end,
+        value: init.value,
+        confidence: init.confidence ?? 1.0,
+        replacement: init.replacement,
+    };
+}

package/dist/cjs/interceptors/pii/scanner.js

@@ -0,0 +1,31 @@
+"use strict";
+/** PiiScanner interface and ScannerRegistry. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScannerRegistry = void 0;
+exports.scannerTier = scannerTier;
+function scannerTier(s) {
+    return s.tier ?? 1;
+}
+/** Registry of scanners, discoverable by entity type at runtime. */
+class ScannerRegistry {
+    scanners = [];
+    constructor(scanners) {
+        for (const s of scanners ?? [])
+            this.register(s);
+    }
+    register(scanner) {
+        this.scanners.push(scanner);
+        return this;
+    }
+    /** Return scanners sorted by tier (lowest first). */
+    all() {
+        return [...this.scanners].sort((a, b) => scannerTier(a) - scannerTier(b));
+    }
+    byEntityType(entityType) {
+        return this.scanners.filter((s) => s.entityType === entityType);
+    }
+    get size() {
+        return this.scanners.length;
+    }
+}
+exports.ScannerRegistry = ScannerRegistry;

package/dist/cjs/interceptors/pii/scanners/bsn.js

@@ -0,0 +1,41 @@
+"use strict";
+/** Dutch BSN scanner — regex + 11-proef (eleven-test) checksum. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validBsn = validBsn;
+exports.bsnScanner = bsnScanner;
+const match_js_1 = require("../match.js");
+// BSN is 8 or 9 digits; we validate the 9-digit form with the 11-proef.
+const BSN = /\b\d{9}\b/g;
+/** 11-proef: sum of digit*weight (9,8,...,2,-1) must be divisible by 11. */
+function validBsn(digits) {
+    if (digits.length !== 9)
+        return false;
+    const weights = [9, 8, 7, 6, 5, 4, 3, 2, -1];
+    let total = 0;
+    for (let i = 0; i < 9; i++) {
+        total += Number(digits[i]) * weights[i];
+    }
+    return total % 11 === 0;
+}
+function bsnScanner() {
+    return {
+        entityType: 'BSN',
+        tier: 1,
+        scan(text, ctx) {
+            const out = [];
+            for (const m of text.matchAll(BSN)) {
+                if (!validBsn(m[0]))
+                    continue;
+                const idx = ctx.nextIndex('BSN');
+                out.push((0, match_js_1.makeMatch)({
+                    entityType: 'BSN',
+                    start: m.index,
+                    end: m.index + m[0].length,
+                    value: m[0],
+                    replacement: `[BSN_${idx}]`,
+                }));
+            }
+            return out;
+        },
+    };
+}

package/dist/cjs/interceptors/pii/scanners/credit-card.js

@@ -0,0 +1,51 @@
+"use strict";
+/** Credit card scanner — regex candidate + Luhn checksum validation. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.luhnValid = luhnValid;
+exports.creditCardScanner = creditCardScanner;
+const match_js_1 = require("../match.js");
+// 13–19 digits, optionally separated by single spaces or hyphens.
+const CARD = /\b(?:\d[ -]?){12,18}\d\b/g;
+function luhnValid(number) {
+    const digits = [];
+    for (const c of number) {
+        if (c >= '0' && c <= '9')
+            digits.push(c.charCodeAt(0) - 48);
+    }
+    if (digits.length < 13 || digits.length > 19)
+        return false;
+    let checksum = 0;
+    const parity = digits.length % 2;
+    for (let i = 0; i < digits.length; i++) {
+        let d = digits[i];
+        if (i % 2 === parity) {
+            d *= 2;
+            if (d > 9)
+                d -= 9;
+        }
+        checksum += d;
+    }
+    return checksum % 10 === 0;
+}
+function creditCardScanner() {
+    return {
+        entityType: 'CREDIT_CARD',
+        tier: 1,
+        scan(text, ctx) {
+            const out = [];
+            for (const m of text.matchAll(CARD)) {
+                if (!luhnValid(m[0]))
+                    continue;
+                const idx = ctx.nextIndex('CREDIT_CARD');
+                out.push((0, match_js_1.makeMatch)({
+                    entityType: 'CREDIT_CARD',
+                    start: m.index,
+                    end: m.index + m[0].length,
+                    value: m[0],
+                    replacement: `[CREDIT_CARD_${idx}]`,
+                }));
+            }
+            return out;
+        },
+    };
+}

package/dist/cjs/interceptors/pii/scanners/email.js

@@ -0,0 +1,26 @@
+"use strict";
+/** Email address scanner (RFC 5322 pragmatic subset). */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.emailScanner = emailScanner;
+const match_js_1 = require("../match.js");
+const EMAIL = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
+function emailScanner() {
+    return {
+        entityType: 'EMAIL',
+        tier: 1,
+        scan(text, ctx) {
+            const out = [];
+            for (const m of text.matchAll(EMAIL)) {
+                const idx = ctx.nextIndex('EMAIL');
+                out.push((0, match_js_1.makeMatch)({
+                    entityType: 'EMAIL',
+                    start: m.index,
+                    end: m.index + m[0].length,
+                    value: m[0],
+                    replacement: `[EMAIL_${idx}]`,
+                }));
+            }
+            return out;
+        },
+    };
+}

package/dist/cjs/interceptors/pii/scanners/iban.js

@@ -0,0 +1,58 @@
+"use strict";
+/** IBAN scanner — regex candidate + ISO 13616 mod-97 checksum validation. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validIban = validIban;
+exports.ibanScanner = ibanScanner;
+const match_js_1 = require("../match.js");
+// Candidate: 2 letters, 2 check digits, 11–30 alphanumerics (optionally spaced).
+const IBAN = /\b[A-Z]{2}\d{2}(?:[ ]?[A-Z0-9]){11,30}\b/g;
+/** ISO 13616 mod-97: rearrange, convert letters to numbers, check %97 == 1. */
+function validIban(candidate) {
+    const cleaned = candidate.replace(/ /g, '').toUpperCase();
+    if (cleaned.length < 15)
+        return false;
+    const rearranged = cleaned.slice(4) + cleaned.slice(0, 4);
+    let digits = '';
+    for (const ch of rearranged) {
+        if (ch >= 'A' && ch <= 'Z') {
+            digits += (ch.charCodeAt(0) - 55).toString();
+        }
+        else if (ch >= '0' && ch <= '9') {
+            digits += ch;
+        }
+        else {
+            return false;
+        }
+    }
+    return mod97(digits) === 1;
+}
+/** Compute n % 97 over a large numeric string without BigInt overflow concerns. */
+function mod97(numeric) {
+    let remainder = 0;
+    for (const ch of numeric) {
+        remainder = (remainder * 10 + (ch.charCodeAt(0) - 48)) % 97;
+    }
+    return remainder;
+}
+function ibanScanner() {
+    return {
+        entityType: 'IBAN',
+        tier: 1,
+        scan(text, ctx) {
+            const out = [];
+            for (const m of text.matchAll(IBAN)) {
+                if (!validIban(m[0]))
+                    continue;
+                const idx = ctx.nextIndex('IBAN');
+                out.push((0, match_js_1.makeMatch)({
+                    entityType: 'IBAN',
+                    start: m.index,
+                    end: m.index + m[0].length,
+                    value: m[0],
+                    replacement: `[IBAN_${idx}]`,
+                }));
+            }
+            return out;
+        },
+    };
+}