glirastes 0.3.0 → 0.3.1

package/dist/cjs/server/lancer/types.d.ts

@@ -0,0 +1,201 @@
+/**
+ * Names of Glirastes services that can be called by the Lancer client.
+ * Used to identify which service failed in degradation callbacks.
+ */
+export type LancerServiceName = 'warden' | 'primus' | 'aegis' | 'proctor' | 'config' | 'approvals';
+/**
+ * What to do when a Glirastes service is unavailable:
+ * - 'fallback': Return the safe default value (calls onDegraded if set).
+ * - 'block':    Throw a ServiceBlockedError — use for critical guardrails.
+ * - 'silent':   Return the safe default value without calling onDegraded.
+ */
+export type DegradationAction = 'fallback' | 'block' | 'silent';
+/** Context passed to the onServiceUnavailable callback. */
+export interface DegradationContext {
+    /** Which Glirastes service could not be reached. */
+    service: LancerServiceName;
+    /** The underlying error from the failed API call. */
+    error: Error;
+    /** Arbitrary request context (e.g. ToolContext) forwarded by the caller, if available. */
+    requestContext?: Record<string, unknown>;
+}
+/**
+ * Static per-service degradation action overrides.
+ * Any service not listed falls back to the built-in default
+ * ('fallback' for all services except proctor, which defaults to 'silent').
+ */
+export interface DegradationDefaults {
+    warden?: DegradationAction;
+    primus?: DegradationAction;
+    aegis?: DegradationAction;
+    proctor?: DegradationAction;
+    config?: DegradationAction;
+    approvals?: DegradationAction;
+}
+/**
+ * Dynamic per-request degradation decision.
+ * Called after static defaults are resolved; its return value takes precedence.
+ * May be async (e.g. for remote policy lookups).
+ */
+export type OnServiceUnavailable = (ctx: DegradationContext) => DegradationAction | Promise<DegradationAction>;
+/** Configuration for creating a Lancer client instance. */
+export interface LancerConfig {
+    apiKey: string;
+    baseUrl?: string;
+    cache?: {
+        ttl: number;
+    };
+    retry?: {
+        maxRetries: number;
+    };
+    /** Called whenever any service falls back (action='fallback'). */
+    onDegraded?: () => void;
+    /**
+     * Static per-service degradation action overrides.
+     * Overrides the built-in defaults ('fallback' / 'silent') per service.
+     */
+    degradation?: DegradationDefaults;
+    /**
+     * Dynamic degradation callback. Invoked on every service failure;
+     * its return value overrides both built-in and static defaults.
+     */
+    onServiceUnavailable?: OnServiceUnavailable;
+    /** Identifies which agent is calling (e.g. "claude-code", "gpt-4o"). Sent as X-Agent-Id header. */
+    agentId?: string;
+    /** Broad agent category. Sent as X-Agent-Type header. */
+    agentType?: 'claude' | 'openai' | 'open-source' | 'custom';
+}
+export interface PromptOverride {
+    moduleId: string;
+    mode: 'replace' | 'patch';
+    systemPrompt: string | null;
+    promptPrefix: string | null;
+    promptSuffix: string | null;
+    modelTierOverride: string | null;
+}
+export interface ConfigResult {
+    modules: Record<string, unknown>;
+    prompts?: PromptOverride[];
+    models?: Record<string, string>;
+    etag?: string;
+}
+export interface ClassifyResult {
+    moduleId: string;
+    confidence: number;
+    modelTier: string;
+}
+export interface PiiEntity {
+    type: string;
+    value: string;
+    start: number;
+    end: number;
+    confidence?: number;
+}
+export interface AnalyzeResult {
+    entities: PiiEntity[];
+    anonymized: string;
+    mappingToken: string | null;
+    detector?: 'regex' | 'presidio';
+}
+export interface AnalyzeOptions {
+    locales?: string[];
+    mode?: 'anonymize' | 'pseudonymize';
+    sessionId?: string;
+}
+export interface LeakageResult {
+    leaked: boolean;
+    entities: PiiEntity[];
+    totalDetected: number;
+    filteredAsKnown: number;
+}
+export interface Violation {
+    rule: string;
+    severity: string;
+    message: string;
+}
+export interface CheckResult {
+    passed: boolean;
+    violations: Violation[];
+}
+export interface TelemetryEvent {
+    eventType: string;
+    traceId?: string;
+    toolId?: string;
+    tokensIn?: number;
+    tokensOut?: number;
+    latencyMs?: number;
+    modelId?: string;
+    modelTier?: string;
+    /** ISO-8601 timestamp of when the event occurred on the client. Used for accurate timeline ordering. */
+    timestamp?: string;
+    payload?: Record<string, unknown>;
+    actor?: Record<string, unknown>;
+}
+export interface PrimusNamespace {
+    classify(message: string, modules: {
+        moduleId: string;
+    }[]): Promise<ClassifyResult>;
+}
+export interface WardenNamespace {
+    check(input: string, policies: string[]): Promise<CheckResult>;
+}
+export interface AegisNamespace {
+    analyze(text: string, options?: AnalyzeOptions): Promise<AnalyzeResult>;
+    rehydrate(text: string, mappingToken: string): Promise<string>;
+    checkLeakage(text: string, mappingToken: string, locales?: string[]): Promise<LeakageResult>;
+}
+export interface ConfigNamespace {
+    fetch(modules: string[]): Promise<ConfigResult>;
+    /**
+     * Report the app's default model configuration to Glirastes.
+     * Fire-and-forget — errors are silently ignored.
+     * Called automatically by the SDK adapter on first request.
+     */
+    reportModels(models: Record<string, string>): Promise<void>;
+}
+export interface TelemetryNamespace {
+    emit(event: TelemetryEvent): void;
+    flush(): Promise<void>;
+}
+export interface ApprovalCheckResult {
+    required: boolean;
+    requestId?: string | null;
+    status?: string;
+}
+export interface ApprovalDecideResult {
+    ok: boolean;
+}
+export interface ApprovalResolveResult {
+    resolved: boolean;
+    requestId?: string;
+}
+export interface ApprovalsNamespace {
+    check(req: {
+        toolId: string;
+        inputHash: string;
+        /** Optional trace/session ID forwarded to Glirastes for approval audit correlation. */
+        traceId?: string;
+    }): Promise<ApprovalCheckResult>;
+    decide(requestId: string, decision: {
+        decision: 'approved' | 'denied';
+        decidedBy: string;
+    }): Promise<ApprovalDecideResult>;
+    /** Resolve a pending approval by toolId + inputHash (no requestId needed). */
+    resolve(req: {
+        toolId: string;
+        inputHash: string;
+        decision: 'approved' | 'denied';
+        decidedBy: string;
+    }): Promise<ApprovalResolveResult>;
+    hashInput(args: Record<string, unknown>): string;
+}
+export interface Lancer {
+    primus: PrimusNamespace;
+    warden: WardenNamespace;
+    aegis: AegisNamespace;
+    config: ConfigNamespace;
+    telemetry: TelemetryNamespace;
+    /** Approval flows managed by Glirastes. Optional — only present when the Glirastes API supports approvals. */
+    approvals?: ApprovalsNamespace;
+    destroy(): void;
+}

package/dist/cjs/server/lancer/types.js

@@ -0,0 +1,5 @@
+"use strict";
+// ---------------------------------------------------------------------------
+// Lancer SDK Types
+// ---------------------------------------------------------------------------
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/server/pii-shield/aegis-detector.d.ts

@@ -0,0 +1,26 @@
+import type { PiiDetector } from '../../types.js';
+/**
+ * Shape of an Aegis-compatible analyze method (duck-typed, no Lancer dep).
+ * Matches `lancer.aegis.analyze()`.
+ */
+export interface AegisLike {
+    analyze(text: string, locales: string[]): Promise<{
+        entities: Array<{
+            type: string;
+            start: number;
+            end: number;
+            value: string;
+            confidence?: number;
+        }>;
+    }>;
+}
+/**
+ * Creates a PiiDetector that delegates to a Lancer Aegis namespace.
+ *
+ * Usage:
+ * ```ts
+ * import { createAegisDetector } from './index.js';
+ * const detector = createAegisDetector(lancer.aegis);
+ * ```
+ */
+export declare function createAegisDetector(aegis: AegisLike): PiiDetector;

package/dist/cjs/server/pii-shield/aegis-detector.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAegisDetector = createAegisDetector;
+/**
+ * Creates a PiiDetector that delegates to a Lancer Aegis namespace.
+ *
+ * Usage:
+ * ```ts
+ * import { createAegisDetector } from './index.js';
+ * const detector = createAegisDetector(lancer.aegis);
+ * ```
+ */
+function createAegisDetector(aegis) {
+    return {
+        async detect(text, locales) {
+            const result = await aegis.analyze(text, locales ?? ['de', 'en']);
+            return result.entities.map((e) => ({
+                type: e.type,
+                start: e.start,
+                end: e.end,
+                score: e.confidence ?? 1.0,
+                text: e.value,
+            }));
+        },
+    };
+}

package/dist/cjs/server/pii-shield/create-pii-shield.d.ts

@@ -0,0 +1,2 @@
+import type { PiiShield, PiiShieldConfig } from '../../types.js';
+export declare function createPiiShield(config: PiiShieldConfig): PiiShield;

package/dist/cjs/server/pii-shield/create-pii-shield.js

@@ -0,0 +1,191 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createPiiShield = createPiiShield;
+const session_mapping_js_1 = require("./session-mapping.js");
+const deep_walk_js_1 = require("./deep-walk.js");
+const leakage_js_1 = require("./leakage.js");
+function createPiiShield(config) {
+    const store = (0, session_mapping_js_1.createSessionStore)(config.locale);
+    const auditLog = new Map();
+    const sessionStats = new Map();
+    function getStats(sessionId) {
+        let stats = sessionStats.get(sessionId);
+        if (!stats) {
+            stats = { startedAt: Date.now(), totalMessages: 0, totalToolCalls: 0, leakageDetected: 0 };
+            sessionStats.set(sessionId, stats);
+        }
+        return stats;
+    }
+    function addAuditEntry(entry) {
+        let entries = auditLog.get(entry.sessionId);
+        if (!entries) {
+            entries = [];
+            auditLog.set(entry.sessionId, entries);
+        }
+        entries.push(entry);
+        config.onAudit?.(entry);
+    }
+    function buildAuditEntry(sessionId, direction, entities, opts) {
+        return {
+            sessionId,
+            timestamp: new Date().toISOString(),
+            direction,
+            leakage: opts?.leakage,
+            detections: entities.map((e) => ({
+                type: e.type,
+                detector: 'pii-shield',
+                confidence: e.score,
+                position: { start: e.start, end: e.end },
+                length: e.text.length,
+            })),
+            totalDetected: entities.length,
+            totalAnonymized: entities.length,
+            mode: 'pseudonymize',
+            locale: config.locale,
+        };
+    }
+    async function outbound(text, sessionId) {
+        const session = store.getOrCreate(sessionId);
+        const stats = getStats(sessionId);
+        stats.totalMessages++;
+        const detected = await config.detector.detect(text, [config.locale]);
+        if (detected.length === 0) {
+            addAuditEntry(buildAuditEntry(sessionId, 'outbound', []));
+            return text;
+        }
+        // Sort by start descending so replacements don't shift indices
+        const sorted = [...detected].sort((a, b) => b.start - a.start);
+        let result = text;
+        for (const entity of sorted) {
+            const pseudonym = session.getOrCreatePseudonym(entity.text, entity.type);
+            result = result.slice(0, entity.start) + pseudonym + result.slice(entity.end);
+        }
+        addAuditEntry(buildAuditEntry(sessionId, 'outbound', detected));
+        return result;
+    }
+    function inbound(text, sessionId) {
+        const session = store.getOrCreate(sessionId);
+        // Check for leakage BEFORE de-pseudonymization
+        if (config.leakageDetection) {
+            const originals = session.allOriginals();
+            const leaked = (0, leakage_js_1.detectLeakage)(text, originals);
+            if (leaked.length > 0) {
+                const stats = getStats(sessionId);
+                stats.leakageDetected += leaked.length;
+                const leakEntities = leaked.map((l) => ({
+                    type: 'custom',
+                    start: text.indexOf(l),
+                    end: text.indexOf(l) + l.length,
+                    score: 1.0,
+                    text: l,
+                }));
+                addAuditEntry(buildAuditEntry(sessionId, 'inbound', leakEntities, { leakage: true }));
+            }
+        }
+        // Replace pseudonyms with originals
+        const originals = session.allOriginals();
+        let result = text;
+        for (const original of originals) {
+            const pseudonym = session.getPseudonym(original);
+            if (!pseudonym)
+                continue;
+            result = result.split(pseudonym).join(original);
+        }
+        return result;
+    }
+    function rehydrateArgs(args, sessionId) {
+        const session = store.getOrCreate(sessionId);
+        const result = (0, deep_walk_js_1.deepWalkReplace)(args, (s) => {
+            // Check if the entire string is a known pseudonym
+            const original = session.resolveOriginal(s);
+            if (original)
+                return original;
+            // Check if any known pseudonyms appear as substrings
+            const originals = session.allOriginals();
+            let replaced = s;
+            for (const orig of originals) {
+                const pseudonym = session.getPseudonym(orig);
+                if (!pseudonym)
+                    continue;
+                replaced = replaced.split(pseudonym).join(orig);
+            }
+            return replaced;
+        });
+        addAuditEntry(buildAuditEntry(sessionId, 'rehydrate-args', []));
+        return result;
+    }
+    async function anonymizeResult(result, sessionId) {
+        const session = store.getOrCreate(sessionId);
+        const stats = getStats(sessionId);
+        stats.totalToolCalls++;
+        // Detect PII in stringified result
+        const text = typeof result === 'string' ? result : JSON.stringify(result);
+        const detected = await config.detector.detect(text, [config.locale]);
+        // Ensure pseudonyms exist for all detected entities
+        for (const entity of detected) {
+            session.getOrCreatePseudonym(entity.text, entity.type);
+        }
+        // Deep-walk and replace originals with pseudonyms
+        const originals = session.allOriginals();
+        const anonymized = (0, deep_walk_js_1.deepWalkReplace)(result, (s) => {
+            let replaced = s;
+            for (const original of originals) {
+                const pseudonym = session.getPseudonym(original);
+                if (!pseudonym)
+                    continue;
+                replaced = replaced.split(original).join(pseudonym);
+            }
+            return replaced;
+        });
+        addAuditEntry(buildAuditEntry(sessionId, 'anonymize-result', detected));
+        return anonymized;
+    }
+    function getComplianceSummary(sessionId) {
+        const stats = getStats(sessionId);
+        const entries = auditLog.get(sessionId) ?? [];
+        const byType = {};
+        const byDetector = {};
+        const byDirection = {};
+        let totalDetected = 0;
+        for (const entry of entries) {
+            totalDetected += entry.totalDetected;
+            byDirection[entry.direction] = (byDirection[entry.direction] ?? 0) + entry.totalDetected;
+            for (const det of entry.detections) {
+                byType[det.type] = (byType[det.type] ?? 0) + 1;
+                byDetector[det.detector] = (byDetector[det.detector] ?? 0) + 1;
+            }
+        }
+        const durationMs = Date.now() - stats.startedAt;
+        const durationSec = Math.floor(durationMs / 1000);
+        const minutes = Math.floor(durationSec / 60);
+        const seconds = durationSec % 60;
+        return {
+            sessionId,
+            duration: `${minutes}m ${seconds}s`,
+            totalMessages: stats.totalMessages,
+            totalToolCalls: stats.totalToolCalls,
+            piiStats: {
+                totalDetected,
+                byType,
+                byDetector,
+                byDirection,
+            },
+            mode: 'pseudonymize',
+            leakageDetected: stats.leakageDetected,
+            verdict: stats.leakageDetected > 0 ? 'LEAKAGE_DETECTED' : 'COMPLIANT',
+        };
+    }
+    function clearSession(sessionId) {
+        store.clear(sessionId);
+        auditLog.delete(sessionId);
+        sessionStats.delete(sessionId);
+    }
+    return {
+        outbound,
+        inbound,
+        rehydrateArgs,
+        anonymizeResult,
+        getComplianceSummary,
+        clearSession,
+    };
+}

package/dist/cjs/server/pii-shield/deep-walk.d.ts

@@ -0,0 +1 @@
+export declare function deepWalkReplace(value: unknown, replacer: (s: string) => string): unknown;

package/dist/cjs/server/pii-shield/deep-walk.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deepWalkReplace = deepWalkReplace;
+function deepWalkReplace(value, replacer) {
+    if (typeof value === 'string') {
+        return replacer(value);
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => deepWalkReplace(item, replacer));
+    }
+    if (value !== null && typeof value === 'object') {
+        const result = {};
+        for (const [key, val] of Object.entries(value)) {
+            result[key] = deepWalkReplace(val, replacer);
+        }
+        return result;
+    }
+    return value;
+}

package/dist/cjs/server/pii-shield/fake-data.d.ts

@@ -0,0 +1,5 @@
+import type { PiiCategory } from '../../types.js';
+export interface FakeDataGenerator {
+    generate(category: PiiCategory | string): string;
+}
+export declare function createFakeDataGenerator(seed: number, locale: string): FakeDataGenerator;

package/dist/cjs/server/pii-shield/fake-data.js

@@ -0,0 +1,170 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createFakeDataGenerator = createFakeDataGenerator;
+// ---------------------------------------------------------------------------
+// xorshift32 PRNG — deterministic, seedable
+// ---------------------------------------------------------------------------
+function createPrng(seed) {
+    let state = seed | 0 || 1; // must not be 0
+    return {
+        next() {
+            state ^= state << 13;
+            state ^= state >> 17;
+            state ^= state << 5;
+            return (state >>> 0) / 0xffffffff; // [0, 1)
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Name pools
+// ---------------------------------------------------------------------------
+const DE_FIRST = ['Lukas', 'Anna', 'Felix', 'Marie', 'Jonas', 'Lena', 'Maximilian', 'Sophie', 'Tobias', 'Katharina'];
+const DE_LAST = ['Müller', 'Schmidt', 'Schneider', 'Fischer', 'Weber', 'Meyer', 'Wagner', 'Becker', 'Hoffmann', 'Schulz'];
+const EN_FIRST = ['James', 'Emily', 'Robert', 'Sarah', 'William', 'Jessica', 'Michael', 'Ashley', 'David', 'Jennifer'];
+const EN_LAST = ['Smith', 'Johnson', 'Williams', 'Brown', 'Jones', 'Garcia', 'Miller', 'Davis', 'Wilson', 'Taylor'];
+// ---------------------------------------------------------------------------
+// Address pools
+// ---------------------------------------------------------------------------
+const DE_STREETS = ['Berliner Str.', 'Hauptstr.', 'Bahnhofstr.', 'Gartenstr.', 'Schillerstr.', 'Goethestr.', 'Mozartstr.', 'Lindenstr.', 'Rosenweg', 'Waldstr.'];
+const DE_CITIES = ['Berlin', 'München', 'Hamburg', 'Köln', 'Frankfurt', 'Stuttgart', 'Düsseldorf', 'Leipzig', 'Dresden', 'Hannover'];
+const EN_STREETS = ['Main St', 'Oak Ave', 'Maple Dr', 'Cedar Ln', 'Elm St', 'Pine Rd', 'Birch Way', 'Park Blvd', 'Lake Dr', 'Hill Rd'];
+const EN_CITIES = ['New York', 'Los Angeles', 'Chicago', 'Houston', 'Phoenix', 'Philadelphia', 'San Antonio', 'San Diego', 'Dallas', 'Austin'];
+// ---------------------------------------------------------------------------
+// Email domains
+// ---------------------------------------------------------------------------
+const EMAIL_DOMAINS = ['example.com', 'mail.test', 'demo.org', 'sample.net', 'test.de'];
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function transliterateDE(s) {
+    return s
+        .toLowerCase()
+        .replace(/[äöüß]/g, (c) => {
+        const map = { ä: 'ae', ö: 'oe', ü: 'ue', ß: 'ss' };
+        return map[c] ?? c;
+    });
+}
+function createFakeDataGenerator(seed, locale) {
+    const prng = createPrng(seed);
+    const pick = (arr) => arr[Math.floor(prng.next() * arr.length)];
+    const randInt = (min, max) => min + Math.floor(prng.next() * (max - min + 1));
+    const pad = (n, w = 2) => String(n).padStart(w, '0');
+    const isDE = locale.startsWith('de');
+    const firstPool = isDE ? DE_FIRST : EN_FIRST;
+    const lastPool = isDE ? DE_LAST : EN_LAST;
+    // Track last generated person for coherent email
+    let lastFirst = '';
+    let lastLast = '';
+    const generators = {
+        person() {
+            lastFirst = pick(firstPool);
+            lastLast = pick(lastPool);
+            return `${lastFirst} ${lastLast}`;
+        },
+        email() {
+            const first = lastFirst || pick(firstPool);
+            const last = lastLast || pick(lastPool);
+            const domain = pick(EMAIL_DOMAINS);
+            const f = transliterateDE(first);
+            const l = transliterateDE(last);
+            return `${f}.${l}@${domain}`;
+        },
+        phone() {
+            if (isDE) {
+                const area = randInt(30, 89);
+                const num = randInt(1000000, 9999999);
+                return `+49 ${area} ${num}`;
+            }
+            const area = randInt(200, 999);
+            const prefix = randInt(200, 999);
+            const line = randInt(1000, 9999);
+            return `+1 (${area}) ${prefix}-${line}`;
+        },
+        iban() {
+            if (isDE) {
+                const check = pad(randInt(10, 99));
+                const bankCode = pad(randInt(1000, 9999), 4);
+                const bankCode2 = pad(randInt(1000, 9999), 4);
+                const acct1 = pad(randInt(1000, 9999), 4);
+                const acct2 = pad(randInt(1000, 9999), 4);
+                const acct3 = pad(randInt(10, 99));
+                return `DE${check} ${bankCode} ${bankCode2} ${acct1} ${acct2} ${acct3}`;
+            }
+            // GB fallback
+            const check = pad(randInt(10, 99));
+            const sort = pad(randInt(100000, 999999), 6);
+            const acct = pad(randInt(10000000, 99999999), 8);
+            return `GB${check} ${sort} ${acct}`;
+        },
+        credit_card() {
+            const last4 = pad(randInt(1000, 9999), 4);
+            return `XXXX-XXXX-XXXX-${last4}`;
+        },
+        ip_address() {
+            return `10.${randInt(0, 255)}.${randInt(0, 255)}.${randInt(1, 254)}`;
+        },
+        date_of_birth() {
+            const year = randInt(1950, 2005);
+            const month = randInt(1, 12);
+            const day = randInt(1, 28);
+            if (isDE) {
+                return `${pad(day)}.${pad(month)}.${year}`;
+            }
+            return `${pad(month)}/${pad(day)}/${year}`;
+        },
+        address() {
+            const streets = isDE ? DE_STREETS : EN_STREETS;
+            const cities = isDE ? DE_CITIES : EN_CITIES;
+            const street = pick(streets);
+            const num = randInt(1, 200);
+            const city = pick(cities);
+            if (isDE) {
+                const zip = pad(randInt(10000, 99999), 5);
+                return `${street} ${num}, ${zip} ${city}`;
+            }
+            const zip = pad(randInt(10000, 99999), 5);
+            const state = pick(['CA', 'TX', 'NY', 'FL', 'IL', 'PA', 'OH', 'GA', 'NC', 'MI']);
+            return `${num} ${street}, ${city}, ${state} ${zip}`;
+        },
+        tax_id() {
+            if (isDE) {
+                // German Steuer-ID format: 11 digits
+                const digits = Array.from({ length: 11 }, () => randInt(0, 9)).join('');
+                return digits;
+            }
+            // US EIN format: XX-XXXXXXX
+            return `${pad(randInt(10, 99))}-${pad(randInt(1000000, 9999999), 7)}`;
+        },
+        ssn() {
+            if (isDE) {
+                // German Sozialversicherungsnummer: 12 chars
+                const digits = Array.from({ length: 12 }, () => randInt(0, 9)).join('');
+                return digits;
+            }
+            // US SSN format: XXX-XX-XXXX
+            return `${pad(randInt(100, 999), 3)}-${pad(randInt(10, 99))}-${pad(randInt(1000, 9999), 4)}`;
+        },
+        url() {
+            const tld = isDE ? '.de' : '.com';
+            const words = ['example', 'demo', 'test', 'sample', 'mock', 'fake', 'placeholder'];
+            return `https://${pick(words)}${tld}/${randInt(1000, 9999)}`;
+        },
+        cvv() {
+            return pad(randInt(100, 999), 3);
+        },
+        card_expiry() {
+            const month = pad(randInt(1, 12));
+            const year = randInt(26, 32);
+            return `${month}/${year}`;
+        },
+    };
+    return {
+        generate(category) {
+            const gen = generators[category];
+            if (gen)
+                return gen();
+            // Unknown / custom category: fallback
+            return `[REDACTED_${pad(randInt(1000, 9999), 4)}]`;
+        },
+    };
+}

package/dist/cjs/server/pii-shield/index.d.ts

@@ -0,0 +1,4 @@
+export { createPiiShield } from './create-pii-shield.js';
+export { createAegisDetector } from './aegis-detector.js';
+export type { AegisLike } from './aegis-detector.js';
+export type { PiiCategory, PiiEntity, PiiDetector, PiiShield, PiiShieldConfig, PiiAuditEntry, ComplianceSummary, MappingEntry, } from '../../types.js';

package/dist/cjs/server/pii-shield/index.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAegisDetector = exports.createPiiShield = void 0;
+// Factory
+var create_pii_shield_js_1 = require("./create-pii-shield.js");
+Object.defineProperty(exports, "createPiiShield", { enumerable: true, get: function () { return create_pii_shield_js_1.createPiiShield; } });
+// Aegis (Pro) detector adapter
+var aegis_detector_js_1 = require("./aegis-detector.js");
+Object.defineProperty(exports, "createAegisDetector", { enumerable: true, get: function () { return aegis_detector_js_1.createAegisDetector; } });

package/dist/cjs/server/pii-shield/leakage.d.ts

@@ -0,0 +1 @@
+export declare function detectLeakage(text: string, knownOriginals: string[]): string[];