observability-toolkit 2.0.0 → 2.1.1

package/dist/lib/privacy/content-redaction.js

@@ -0,0 +1,210 @@
+/**
+ * Content Redaction for LLM Observability Telemetry (R10)
+ *
+ * Tier 1 (irreversible) regex-based PII redaction for span attributes and log event bodies
+ * before export. Designed for pre-export hook in the OTel SDK span processor.
+ *
+ * Architecture:
+ * - Attribute redaction: allowlist/blocklist on structured key-value span attributes
+ * - Body redaction: pattern-based replacement on free-text log event body content
+ * - Customizable via RedactionConfig: override patterns, add custom rules, disable categories
+ *
+ * @see docs/roadmap/r10-content-redaction-pipelines.md
+ */
+import { MAX_SANITIZE_LENGTH } from '../errors/error-sanitizer.js';
+// ============================================================================
+// Constants
+// ============================================================================
+/** Placeholder used for irreversible redaction (Tier 1) */
+export const REDACTION_PLACEHOLDER = '[REDACTED]';
+/** Appended when input was truncated before redaction — signals incomplete sanitization */
+export const REDACTION_TRUNCATION_SENTINEL = '[TRUNCATED—REDACTION INCOMPLETE]';
+/** Category-specific placeholders for human-readable audit trails */
+export const REDACTION_PLACEHOLDERS = {
+    email: '[EMAIL]',
+    phone: '[PHONE]',
+    ssn: '[SSN]',
+    creditCard: '[CREDIT_CARD]',
+    ipAddress: '[IP_ADDRESS]',
+    apiKey: '[API_KEY]',
+    generic: '[REDACTED]',
+};
+/**
+ * Span attribute keys that contain LLM prompt/completion content.
+ * These keys are blocked by default when attribute-level redaction is enabled.
+ */
+export const GENAI_CONTENT_ATTRIBUTE_KEYS = new Set([
+    'gen_ai.prompt',
+    'gen_ai.completion',
+    'gen_ai.user.message',
+    'gen_ai.assistant.message',
+    'gen_ai.tool.message',
+    'gen_ai.system.message',
+]);
+/**
+ * Span attribute keys that are safe to pass through without redaction.
+ * Structural/metadata attributes that contain no user content.
+ *
+ * Reviewed against OTel GenAI semantic conventions v1.29.0.
+ * Re-audit this set on semconv upgrade — some keys (e.g. gen_ai.system) may
+ * carry user-supplied content in certain instrumentation libraries.
+ *
+ * @see https://opentelemetry.io/docs/specs/semconv/gen-ai/ (v1.29.0)
+ */
+export const GENAI_SAFE_ATTRIBUTE_KEYS = new Set([
+    'gen_ai.system',
+    'gen_ai.request.model',
+    'gen_ai.usage.input_tokens',
+    'gen_ai.usage.output_tokens',
+    'gen_ai.response.finish_reasons',
+    'gen_ai.response.id',
+    'gen_ai.operation.name',
+]);
+// ============================================================================
+// Built-in PII Patterns
+// ============================================================================
+/** Email address pattern */
+const EMAIL_PATTERN = /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g;
+/** US phone number patterns (various formats) */
+const PHONE_PATTERN = /(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b/g;
+/** US Social Security Number */
+const SSN_PATTERN = /\b\d{3}-\d{2}-\d{4}\b/g;
+/** Credit card numbers (Visa, MC, Amex, Discover) — Luhn not checked */
+const CREDIT_CARD_PATTERN = /\b(?:4\d{3}|5[1-5]\d{2}|6011|3[47]\d{2})[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b/g;
+/** IPv4 addresses */
+const IPV4_PATTERN = /\b(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\b/g;
+/** IPv6 addresses (full and abbreviated) */
+const IPV6_PATTERN = /\b(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}\b|\b(?:[0-9a-fA-F]{1,4}:)*::(?:[0-9a-fA-F]{1,4}:)*[0-9a-fA-F]{1,4}\b/g;
+/** API keys and tokens (common patterns: Bearer tokens, sk-*, pk-*, etc.) */
+const API_KEY_PATTERN = /(?:sk|pk|api|tok|key)-[A-Za-z0-9_-]{16,}|Bearer\s+[A-Za-z0-9._-]{16,}/g;
+/** Default built-in pattern set with co-located category for filtering */
+const BUILT_IN_PATTERNS = [
+    { pattern: EMAIL_PATTERN, placeholder: REDACTION_PLACEHOLDERS.email, category: 'email' },
+    { pattern: PHONE_PATTERN, placeholder: REDACTION_PLACEHOLDERS.phone, category: 'phone' },
+    { pattern: SSN_PATTERN, placeholder: REDACTION_PLACEHOLDERS.ssn, category: 'ssn' },
+    { pattern: CREDIT_CARD_PATTERN, placeholder: REDACTION_PLACEHOLDERS.creditCard, category: 'creditCard' },
+    { pattern: IPV4_PATTERN, placeholder: REDACTION_PLACEHOLDERS.ipAddress, category: 'ipAddress' },
+    { pattern: IPV6_PATTERN, placeholder: REDACTION_PLACEHOLDERS.ipAddress, category: 'ipAddress' },
+    { pattern: API_KEY_PATTERN, placeholder: REDACTION_PLACEHOLDERS.apiKey, category: 'apiKey' },
+];
+// ============================================================================
+// Body Redaction (free-text)
+// ============================================================================
+/**
+ * Build the active pattern list from config.
+ * Filters out disabled categories and adds custom rules.
+ */
+function buildActivePatterns(config) {
+    const active = [];
+    if (!config.disableBuiltins) {
+        const disabledSet = new Set(config.disabledCategories ?? []);
+        for (const entry of BUILT_IN_PATTERNS) {
+            if (!disabledSet.has(entry.category)) {
+                active.push(entry);
+            }
+        }
+    }
+    for (const rule of config.customRules ?? []) {
+        active.push({
+            pattern: rule.pattern,
+            placeholder: rule.placeholder ?? REDACTION_PLACEHOLDER,
+        });
+    }
+    return active;
+}
+/**
+ * Redact PII from a free-text string using the configured pattern set.
+ *
+ * - Input is truncated at MAX_SANITIZE_LENGTH before regex processing (ReDoS guard).
+ * - Returns the original value unchanged if it is not a string.
+ * - Patterns are applied sequentially; each uses a freshly reset lastIndex.
+ *
+ * @param text - Input text to redact
+ * @param config - Redaction configuration
+ * @returns Redacted text with PII replaced by placeholders
+ */
+export function redactText(text, config = {}) {
+    if (typeof text !== 'string' || text.length === 0)
+        return text;
+    // ReDoS guard: truncate excessively long inputs
+    const truncated = text.length > MAX_SANITIZE_LENGTH;
+    const safe = truncated ? text.slice(0, MAX_SANITIZE_LENGTH) : text;
+    const patterns = buildActivePatterns(config);
+    let result = safe;
+    for (const { pattern, placeholder } of patterns) {
+        result = result.replace(pattern, placeholder);
+    }
+    return truncated ? `${result} ${REDACTION_TRUNCATION_SENTINEL}` : result;
+}
+// ============================================================================
+// Attribute Redaction (structured key-value)
+// ============================================================================
+/**
+ * Redact PII from a span attribute value.
+ *
+ * - If the key is in GENAI_CONTENT_ATTRIBUTE_KEYS and redactContentAttributes is enabled,
+ *   the value is replaced wholesale with REDACTION_PLACEHOLDER.
+ * - Otherwise, applies text redaction to string values.
+ * - Non-string attribute values (numbers, booleans, arrays) pass through unchanged.
+ *
+ * @param key - Span attribute key
+ * @param value - Span attribute value
+ * @param config - Redaction configuration
+ * @returns Redacted attribute value
+ */
+export function redactAttributeValue(key, value, config = {}) {
+    // Wholesale redaction of known content attributes
+    if (config.redactContentAttributes && GENAI_CONTENT_ATTRIBUTE_KEYS.has(key)) {
+        return REDACTION_PLACEHOLDER;
+    }
+    // Only process string values
+    if (typeof value !== 'string')
+        return value;
+    return redactText(value, config);
+}
+/**
+ * Redact PII from all attributes in a span attribute map.
+ *
+ * Returns a new object — does not mutate the input.
+ *
+ * @param attributes - Span attribute map (key → value)
+ * @param config - Redaction configuration
+ * @returns New attribute map with PII redacted
+ */
+export function redactAttributes(attributes, config = {}) {
+    const result = {};
+    for (const [key, value] of Object.entries(attributes)) {
+        result[key] = redactAttributeValue(key, value, config);
+    }
+    return result;
+}
+/**
+ * Redact PII from a single span (attributes + body).
+ *
+ * Returns a new object — does not mutate the input.
+ *
+ * @param span - Span to redact
+ * @param config - Redaction configuration
+ * @returns New span with PII redacted from attributes and body
+ */
+export function redactSpan(span, config = {}) {
+    const result = { ...span };
+    if (span.attributes) {
+        result.attributes = redactAttributes(span.attributes, config);
+    }
+    if (typeof span.body === 'string') {
+        result.body = redactText(span.body, config);
+    }
+    return result;
+}
+/**
+ * Redact PII from an array of spans in one pass.
+ *
+ * @param spans - Array of spans to redact
+ * @param config - Redaction configuration
+ * @returns New array of spans with PII redacted
+ */
+export function redactSpans(spans, config = {}) {
+    return spans.map(span => redactSpan(span, config));
+}
+//# sourceMappingURL=content-redaction.js.map

package/dist/lib/privacy/content-redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-redaction.js","sourceRoot":"","sources":["../../../src/lib/privacy/content-redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAEnE,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,2DAA2D;AAC3D,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAElD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,6BAA6B,GAAG,kCAAkC,CAAC;AAEhF,qEAAqE;AACrE,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,KAAK,EAAE,SAAS;IAChB,KAAK,EAAE,SAAS;IAChB,GAAG,EAAE,OAAO;IACZ,UAAU,EAAE,eAAe;IAC3B,SAAS,EAAE,cAAc;IACzB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;CACb,CAAC;AAIX;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAC;IACvE,eAAe;IACf,mBAAmB;IACnB,qBAAqB;IACrB,0BAA0B;IAC1B,qBAAqB;IACrB,uBAAuB;CACxB,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC;IACpE,eAAe;IACf,sBAAsB;IACtB,2BAA2B;IAC3B,4BAA4B;IAC5B,gCAAgC;IAChC,oBAAoB;IACpB,uBAAuB;CACxB,CAAC,CAAC;AAEH,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E,4BAA4B;AAC5B,MAAM,aAAa,GAAG,qDAAqD,CAAC;AAE5E,iDAAiD;AACjD,MAAM,aAAa,GAAG,wDAAwD,CAAC;AAE/E,gCAAgC;AAChC,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAE7C,wEAAwE;AACxE,MAAM,mBAAmB,GAAG,8EAA8E,CAAC;AAE3G,qBAAqB;AACrB,MAAM,YAAY,GAAG,yIAAyI,CAAC;AAE/J,4CAA4C;AAC5C,MAAM,YAAY,GAAG,kHAAkH,CAAC;AAExI,6EAA6E;AAC7E,MAAM,eAAe,GAAG,wEAAwE,CAAC;AAEjG,0EAA0E;AAC1E,MAAM,iBAAiB,GAAiF;IACtG,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,sBAAsB,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE;IACxF,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,sBAAsB,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE;IACxF,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,sBAAsB,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE;IAClF,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,sBAAsB,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE;IACxG,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,sBAAsB,CAAC,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE;IAC/F,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,sBAAsB,CAAC,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE;IAC/F,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,sBAAsB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE;CAC7F,CAAC;AAuCF,+EAA+E;AAC/E,6BAA6B;AAC7B,+EAA+E;AAE/E;;;GAGG;AACH,SAAS,mBAAmB,CAC1B,MAAuB;IAEvB,MAAM,MAAM,GAAoD,EAAE,CAAC;IAEnE,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;QAE7D,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;YACtC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,qBAAqB;SACvD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,SAA0B,EAAE;IACnE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/D,gDAAgD;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,mBAAmB,CAAC;IACpD,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEnE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,MAAM,GAAG,IAAI,CAAC;IAElB,KAAK,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,SAAS,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,6BAA6B,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAC3E,CAAC;AAED,+EAA+E;AAC/E,6CAA6C;AAC7C,+EAA+E;AAE/E;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,KAAc,EACd,SAA0B,EAAE;IAE5B,kDAAkD;IAClD,IAAI,MAAM,CAAC,uBAAuB,IAAI,4BAA4B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5E,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAED,6BAA6B;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE5C,OAAO,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAAmC,EACnC,SAA0B,EAAE;IAE5B,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAkBD;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,IAAoB,EAAE,SAA0B,EAAE;IAC3E,MAAM,MAAM,GAAmB,EAAE,GAAG,IAAI,EAAE,CAAC;IAE3C,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,CAAC,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,KAAuB,EAAE,SAA0B,EAAE;IAC/E,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AACrD,CAAC"}

package/dist/lib/privacy/content-redaction.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=content-redaction.test.d.ts.map

package/dist/lib/privacy/content-redaction.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-redaction.test.d.ts","sourceRoot":"","sources":["../../../src/lib/privacy/content-redaction.test.ts"],"names":[],"mappings":""}

package/dist/lib/privacy/content-redaction.test.js

@@ -0,0 +1,302 @@
+import { describe, it } from 'vitest';
+import assert from 'node:assert/strict';
+import { redactText, redactAttributeValue, redactAttributes, redactSpan, redactSpans, REDACTION_PLACEHOLDER, REDACTION_PLACEHOLDERS, REDACTION_TRUNCATION_SENTINEL, GENAI_CONTENT_ATTRIBUTE_KEYS, GENAI_SAFE_ATTRIBUTE_KEYS, } from './content-redaction.js';
+// ============================================================================
+// redactText — built-in patterns
+// ============================================================================
+describe('redactText — email', () => {
+    it('redacts a standalone email address', () => {
+        const result = redactText('Contact us at user@example.com for support.');
+        assert.equal(result, `Contact us at ${REDACTION_PLACEHOLDERS.email} for support.`);
+    });
+    it('redacts multiple email addresses', () => {
+        const result = redactText('From: alice@a.com, To: bob@b.org');
+        assert.ok(!result.includes('alice@a.com'));
+        assert.ok(!result.includes('bob@b.org'));
+    });
+    it('does not redact plain words without @', () => {
+        const result = redactText('no email here');
+        assert.equal(result, 'no email here');
+    });
+});
+describe('redactText — phone', () => {
+    it('redacts US phone (dashes)', () => {
+        const result = redactText('Call 555-867-5309 now');
+        assert.ok(!result.includes('555-867-5309'));
+        assert.ok(result.includes(REDACTION_PLACEHOLDERS.phone));
+    });
+    it('redacts US phone (dots)', () => {
+        const result = redactText('Phone: 555.867.5309');
+        assert.ok(!result.includes('555.867.5309'));
+    });
+    it('redacts US phone with country code', () => {
+        const result = redactText('+1-800-555-1234');
+        assert.ok(!result.includes('800-555-1234'));
+    });
+});
+describe('redactText — SSN', () => {
+    it('redacts SSN format NNN-NN-NNNN', () => {
+        const result = redactText('SSN: 123-45-6789');
+        assert.ok(!result.includes('123-45-6789'));
+        assert.ok(result.includes(REDACTION_PLACEHOLDERS.ssn));
+    });
+    it('does not redact partial SSN-like patterns', () => {
+        // 12-34-5678 is not a valid SSN format (2-digit middle group required)
+        const result = redactText('code 12-34-5678');
+        // This should not redact since pattern requires NNN-NN-NNNN
+        assert.ok(!result.includes(REDACTION_PLACEHOLDERS.ssn));
+    });
+});
+describe('redactText — credit card', () => {
+    it('redacts Visa card number', () => {
+        const result = redactText('Card: 4111 1111 1111 1111');
+        assert.ok(!result.includes('4111'));
+        assert.ok(result.includes(REDACTION_PLACEHOLDERS.creditCard));
+    });
+    it('redacts MC card number with dashes', () => {
+        const result = redactText('MC: 5500-0000-0000-0004');
+        assert.ok(!result.includes('5500'));
+    });
+});
+describe('redactText — IP address', () => {
+    it('redacts IPv4 address', () => {
+        const result = redactText('Connected from 192.168.1.100');
+        assert.ok(!result.includes('192.168.1.100'));
+        assert.ok(result.includes(REDACTION_PLACEHOLDERS.ipAddress));
+    });
+    it('redacts IPv6 address', () => {
+        const result = redactText('IPv6: 2001:0db8:85a3:0000:0000:8a2e:0370:7334');
+        assert.ok(!result.includes('2001:0db8'));
+        assert.ok(result.includes(REDACTION_PLACEHOLDERS.ipAddress));
+    });
+    it('redacts loopback address', () => {
+        const result = redactText('server at 127.0.0.1');
+        assert.ok(!result.includes('127.0.0.1'));
+    });
+});
+describe('redactText — API key', () => {
+    it('redacts sk-prefixed API key', () => {
+        const result = redactText('key=sk-abcdefghijklmnopqrstuvwx');
+        assert.ok(!result.includes('sk-abcdefghijklmnopqrstuvwx'));
+        assert.ok(result.includes(REDACTION_PLACEHOLDERS.apiKey));
+    });
+    it('redacts Bearer token', () => {
+        const result = redactText('Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9');
+        assert.ok(!result.includes('eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9'));
+    });
+    it('does not redact short tokens below 16 chars', () => {
+        const result = redactText('sk-short');
+        // "sk-short" is 8 chars after prefix — below 16-char threshold
+        assert.ok(result.includes('sk-short'));
+    });
+});
+// ============================================================================
+// redactText — config options
+// ============================================================================
+describe('redactText — disabledCategories', () => {
+    it('passes email through when email category disabled', () => {
+        const result = redactText('user@example.com', { disabledCategories: ['email'] });
+        assert.ok(result.includes('user@example.com'));
+    });
+    it('still redacts other categories when email is disabled', () => {
+        const result = redactText('user@example.com 123-45-6789', { disabledCategories: ['email'] });
+        assert.ok(result.includes('user@example.com'));
+        assert.ok(!result.includes('123-45-6789'));
+    });
+});
+describe('redactText — customRules', () => {
+    it('applies a custom rule', () => {
+        const result = redactText('patient: John Doe, dob: 1990-01-15', {
+            customRules: [{ id: 'dob', pattern: /\b\d{4}-\d{2}-\d{2}\b/g, placeholder: '[DOB]' }],
+        });
+        assert.ok(!result.includes('1990-01-15'));
+        assert.ok(result.includes('[DOB]'));
+    });
+    it('uses generic placeholder when rule has no placeholder', () => {
+        const result = redactText('secret word: xyzzy', {
+            customRules: [{ id: 'magic', pattern: /\bxyzzy\b/g }],
+        });
+        assert.ok(!result.includes('xyzzy'));
+        assert.ok(result.includes(REDACTION_PLACEHOLDER));
+    });
+});
+describe('redactText — disableBuiltins', () => {
+    it('skips all built-in patterns when disableBuiltins is true', () => {
+        const result = redactText('user@example.com 123-45-6789', { disableBuiltins: true });
+        assert.ok(result.includes('user@example.com'));
+        assert.ok(result.includes('123-45-6789'));
+    });
+    it('still applies custom rules when disableBuiltins is true', () => {
+        const result = redactText('user@example.com token=MY_TOKEN', {
+            disableBuiltins: true,
+            customRules: [{ id: 'custom-token', pattern: /MY_TOKEN/g, placeholder: '[TOKEN]' }],
+        });
+        assert.ok(result.includes('user@example.com'));
+        assert.ok(!result.includes('MY_TOKEN'));
+        assert.ok(result.includes('[TOKEN]'));
+    });
+});
+describe('redactText — edge cases', () => {
+    it('returns empty string unchanged', () => {
+        assert.equal(redactText(''), '');
+    });
+    it('returns plain text with no PII unchanged', () => {
+        const plain = 'The quick brown fox jumps over the lazy dog.';
+        assert.equal(redactText(plain), plain);
+    });
+    it('truncates input longer than MAX_SANITIZE_LENGTH and appends sentinel', () => {
+        const long = 'a'.repeat(200_001);
+        const result = redactText(long);
+        assert.ok(result.includes(REDACTION_TRUNCATION_SENTINEL));
+    });
+    it('handles null-like values gracefully (non-string)', () => {
+        // @ts-expect-error intentional wrong type for test
+        assert.equal(redactText(null), null);
+    });
+});
+// ============================================================================
+// redactAttributeValue
+// ============================================================================
+describe('redactAttributeValue', () => {
+    it('redacts string attribute value containing email', () => {
+        const result = redactAttributeValue('custom.field', 'contact user@example.com');
+        assert.ok(typeof result === 'string' && !result.includes('user@example.com'));
+    });
+    it('passes through numeric attribute unchanged', () => {
+        assert.equal(redactAttributeValue('gen_ai.usage.input_tokens', 1234), 1234);
+    });
+    it('passes through boolean attribute unchanged', () => {
+        assert.equal(redactAttributeValue('feature.enabled', true), true);
+    });
+    it('passes through null unchanged', () => {
+        assert.equal(redactAttributeValue('field', null), null);
+    });
+    it('wholesale-redacts content attribute key when redactContentAttributes is true', () => {
+        const result = redactAttributeValue('gen_ai.prompt', 'User: What is my SSN 123-45-6789?', { redactContentAttributes: true });
+        assert.equal(result, REDACTION_PLACEHOLDER);
+    });
+    it('does not wholesale-redact content attribute key when redactContentAttributes is false', () => {
+        const result = redactAttributeValue('gen_ai.prompt', 'User: Hello world', { redactContentAttributes: false });
+        assert.equal(result, 'User: Hello world');
+    });
+    it('applies text redaction to content attribute when redactContentAttributes is false but value has PII', () => {
+        const result = redactAttributeValue('gen_ai.prompt', 'email me at user@example.com', { redactContentAttributes: false });
+        assert.ok(typeof result === 'string' && !result.includes('user@example.com'));
+    });
+});
+// ============================================================================
+// redactAttributes
+// ============================================================================
+describe('redactAttributes', () => {
+    it('redacts string values containing PII', () => {
+        const attrs = {
+            'user.email': 'alice@example.com',
+            'gen_ai.usage.input_tokens': 100,
+        };
+        const result = redactAttributes(attrs);
+        assert.ok(!result['user.email']?.toString().includes('alice@example.com'));
+        assert.equal(result['gen_ai.usage.input_tokens'], 100);
+    });
+    it('does not mutate the input object', () => {
+        const attrs = { 'user.email': 'alice@example.com' };
+        redactAttributes(attrs);
+        assert.equal(attrs['user.email'], 'alice@example.com');
+    });
+    it('wholesale-redacts content keys when redactContentAttributes is true', () => {
+        const attrs = {
+            'gen_ai.prompt': 'You are a helpful assistant.',
+            'gen_ai.request.model': 'gpt-4',
+        };
+        const result = redactAttributes(attrs, { redactContentAttributes: true });
+        assert.equal(result['gen_ai.prompt'], REDACTION_PLACEHOLDER);
+        assert.equal(result['gen_ai.request.model'], 'gpt-4');
+    });
+});
+// ============================================================================
+// redactSpan
+// ============================================================================
+describe('redactSpan', () => {
+    it('redacts PII in span attributes', () => {
+        const span = {
+            traceId: 'abc123',
+            attributes: { 'http.user_agent': 'Mozilla user@test.com' },
+        };
+        const result = redactSpan(span);
+        assert.ok(typeof result.attributes?.['http.user_agent'] === 'string' &&
+            !result.attributes['http.user_agent'].includes('user@test.com'));
+    });
+    it('redacts PII in span body', () => {
+        const span = {
+            traceId: 'abc123',
+            body: 'User called from 555-123-4567',
+        };
+        const result = redactSpan(span);
+        assert.ok(typeof result.body === 'string' && !result.body.includes('555-123-4567'));
+    });
+    it('passes through span body unchanged when no PII', () => {
+        const span = { traceId: 'abc123', body: 'No PII here' };
+        const result = redactSpan(span);
+        assert.equal(result.body, 'No PII here');
+    });
+    it('does not mutate the input span', () => {
+        const original = 'user@example.com in body';
+        const span = { traceId: 'x', body: original };
+        redactSpan(span);
+        assert.equal(span.body, original);
+    });
+    it('preserves non-redacted span fields', () => {
+        const span = { traceId: 'abc', spanId: 'def', name: 'http.request' };
+        const result = redactSpan(span);
+        assert.equal(result.traceId, 'abc');
+        assert.equal(result.spanId, 'def');
+        assert.equal(result.name, 'http.request');
+    });
+    it('handles span with no attributes or body', () => {
+        const span = { traceId: 'abc' };
+        const result = redactSpan(span);
+        assert.deepEqual(result, span);
+    });
+});
+// ============================================================================
+// redactSpans
+// ============================================================================
+describe('redactSpans', () => {
+    it('redacts PII across all spans in array', () => {
+        const spans = [
+            { traceId: 'a', body: 'email: alice@example.com' },
+            { traceId: 'b', body: 'phone: 555-867-5309' },
+        ];
+        const result = redactSpans(spans);
+        assert.ok(!result[0].body?.includes('alice@example.com'));
+        assert.ok(!result[1].body?.includes('555-867-5309'));
+    });
+    it('returns empty array for empty input', () => {
+        assert.deepEqual(redactSpans([]), []);
+    });
+    it('does not mutate input array', () => {
+        const spans = [{ traceId: 'x', body: 'alice@example.com' }];
+        redactSpans(spans);
+        assert.equal(spans[0].body, 'alice@example.com');
+    });
+});
+// ============================================================================
+// GENAI_CONTENT_ATTRIBUTE_KEYS / GENAI_SAFE_ATTRIBUTE_KEYS
+// ============================================================================
+describe('attribute key sets', () => {
+    it('GENAI_CONTENT_ATTRIBUTE_KEYS contains known content keys', () => {
+        assert.ok(GENAI_CONTENT_ATTRIBUTE_KEYS.has('gen_ai.prompt'));
+        assert.ok(GENAI_CONTENT_ATTRIBUTE_KEYS.has('gen_ai.completion'));
+        assert.ok(GENAI_CONTENT_ATTRIBUTE_KEYS.has('gen_ai.user.message'));
+    });
+    it('GENAI_SAFE_ATTRIBUTE_KEYS contains known safe keys', () => {
+        assert.ok(GENAI_SAFE_ATTRIBUTE_KEYS.has('gen_ai.system'));
+        assert.ok(GENAI_SAFE_ATTRIBUTE_KEYS.has('gen_ai.request.model'));
+        assert.ok(GENAI_SAFE_ATTRIBUTE_KEYS.has('gen_ai.usage.input_tokens'));
+    });
+    it('content and safe key sets are disjoint', () => {
+        for (const key of GENAI_CONTENT_ATTRIBUTE_KEYS) {
+            assert.ok(!GENAI_SAFE_ATTRIBUTE_KEYS.has(key), `Key "${key}" appears in both content and safe sets`);
+        }
+    });
+});
+//# sourceMappingURL=content-redaction.test.js.map

package/dist/lib/privacy/content-redaction.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-redaction.test.js","sourceRoot":"","sources":["../../../src/lib/privacy/content-redaction.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,qBAAqB,EACrB,sBAAsB,EACtB,6BAA6B,EAC7B,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAEhC,+EAA+E;AAC/E,iCAAiC;AACjC,+EAA+E;AAE/E,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,6CAA6C,CAAC,CAAC;QACzE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,sBAAsB,CAAC,KAAK,eAAe,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,kCAAkC,CAAC,CAAC;QAC9D,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,MAAM,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,MAAM,GAAG,UAAU,CAAC,uBAAuB,CAAC,CAAC;QACnD,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,MAAM,GAAG,UAAU,CAAC,qBAAqB,CAAC,CAAC;QACjD,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;QAC7C,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,MAAM,GAAG,UAAU,CAAC,kBAAkB,CAAC,CAAC;QAC9C,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,uEAAuE;QACvE,MAAM,MAAM,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;QAC7C,4DAA4D;QAC5D,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,2BAA2B,CAAC,CAAC;QACvD,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,yBAAyB,CAAC,CAAC;QACrD,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,MAAM,GAAG,UAAU,CAAC,8BAA8B,CAAC,CAAC;QAC1D,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,MAAM,GAAG,UAAU,CAAC,+CAA+C,CAAC,CAAC;QAC3E,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,qBAAqB,CAAC,CAAC;QACjD,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,MAAM,GAAG,UAAU,CAAC,iCAAiC,CAAC,CAAC;QAC7D,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,MAAM,GAAG,UAAU,CAAC,4DAA4D,CAAC,CAAC;QACxF,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,sCAAsC,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACtC,+DAA+D;QAC/D,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAC/E,8BAA8B;AAC9B,+EAA+E;AAE/E,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,MAAM,GAAG,UAAU,CAAC,kBAAkB,EAAE,EAAE,kBAAkB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjF,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,MAAM,GAAG,UAAU,CAAC,8BAA8B,EAAE,EAAE,kBAAkB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7F,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,MAAM,GAAG,UAAU,CAAC,oCAAoC,EAAE;YAC9D,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,wBAAwB,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;SACtF,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,MAAM,GAAG,UAAU,CAAC,oBAAoB,EAAE;YAC9C,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;SACtD,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,MAAM,GAAG,UAAU,CAAC,8BAA8B,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,MAAM,GAAG,UAAU,CAAC,iCAAiC,EAAE;YAC3D,eAAe,EAAE,IAAI;YACrB,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;SACpF,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,KAAK,GAAG,8CAA8C,CAAC;QAC7D,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,mDAAmD;QACnD,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,MAAM,GAAG,oBAAoB,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;QAChF,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,2BAA2B,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,iBAAiB,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACtF,MAAM,MAAM,GAAG,oBAAoB,CACjC,eAAe,EACf,mCAAmC,EACnC,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAClC,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE;QAC/F,MAAM,MAAM,GAAG,oBAAoB,CACjC,eAAe,EACf,mBAAmB,EACnB,EAAE,uBAAuB,EAAE,KAAK,EAAE,CACnC,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qGAAqG,EAAE,GAAG,EAAE;QAC7G,MAAM,MAAM,GAAG,oBAAoB,CACjC,eAAe,EACf,8BAA8B,EAC9B,EAAE,uBAAuB,EAAE,KAAK,EAAE,CACnC,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,KAAK,GAAG;YACZ,YAAY,EAAE,mBAAmB;YACjC,2BAA2B,EAAE,GAAG;SACjC,CAAC;QACF,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC3E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,2BAA2B,CAAC,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,KAAK,GAAG,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC;QACpD,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,KAAK,GAAG;YACZ,eAAe,EAAE,8BAA8B;YAC/C,sBAAsB,EAAE,OAAO;SAChC,CAAC;QACF,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAC,CAAC;QAC7D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,IAAI,GAAG;YACX,OAAO,EAAE,QAAQ;YACjB,UAAU,EAAE,EAAE,iBAAiB,EAAE,uBAAuB,EAAE;SAC3D,CAAC;QACF,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,EAAE,CACP,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC,iBAAiB,CAAC,KAAK,QAAQ;YAC1D,CAAC,MAAM,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAChE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,IAAI,GAAG;YACX,OAAO,EAAE,QAAQ;YACjB,IAAI,EAAE,+BAA+B;SACtC,CAAC;QACF,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,QAAQ,GAAG,0BAA0B,CAAC;QAC5C,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC9C,UAAU,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QACrE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,KAAK,GAAG;YACZ,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,0BAA0B,EAAE;YAClD,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,qBAAqB,EAAE;SAC9C,CAAC;QACF,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,KAAK,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5D,WAAW,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAC/E,2DAA2D;AAC3D,+EAA+E;AAE/E,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,EAAE,CAAC,4BAA4B,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QAC7D,MAAM,CAAC,EAAE,CAAC,4BAA4B,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACjE,MAAM,CAAC,EAAE,CAAC,4BAA4B,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,EAAE,CAAC,yBAAyB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,EAAE,CAAC,yBAAyB,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACjE,MAAM,CAAC,EAAE,CAAC,yBAAyB,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,KAAK,MAAM,GAAG,IAAI,4BAA4B,EAAE,CAAC;YAC/C,MAAM,CAAC,EAAE,CACP,CAAC,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,EACnC,QAAQ,GAAG,yCAAyC,CACrD,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lib/quality/bucket-utils.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Shared helpers for fixed-width bucketing.
+ */
+export interface EvenBucketBoundary {
+    start: number;
+    end: number;
+}
+/**
+ * Build fixed-width bucket boundaries across a numeric range.
+ */
+export declare function buildEvenBucketBoundaries(start: number, end: number, bucketCount: number): EvenBucketBoundary[];
+/**
+ * Compute a fixed-width bucket index for a value.
+ * Returns null when value is before the first bucket or cannot be indexed.
+ */
+export declare function getEvenBucketIndex(value: number, start: number, bucketWidth: number, bucketCount: number): number | null;
+//# sourceMappingURL=bucket-utils.d.ts.map

package/dist/lib/quality/bucket-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bucket-utils.d.ts","sourceRoot":"","sources":["../../../src/lib/quality/bucket-utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,GAClB,kBAAkB,EAAE,CAWtB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,GAClB,MAAM,GAAG,IAAI,CAKf"}

package/dist/lib/quality/bucket-utils.js

@@ -0,0 +1,31 @@
+/**
+ * Shared helpers for fixed-width bucketing.
+ */
+/**
+ * Build fixed-width bucket boundaries across a numeric range.
+ */
+export function buildEvenBucketBoundaries(start, end, bucketCount) {
+    const width = (end - start) / bucketCount;
+    const boundaries = [];
+    for (let i = 0; i < bucketCount; i++) {
+        const bucketStart = start + i * width;
+        boundaries.push({
+            start: bucketStart,
+            end: bucketStart + width,
+        });
+    }
+    return boundaries;
+}
+/**
+ * Compute a fixed-width bucket index for a value.
+ * Returns null when value is before the first bucket or cannot be indexed.
+ */
+export function getEvenBucketIndex(value, start, bucketWidth, bucketCount) {
+    const rawIndex = Math.floor((value - start) / bucketWidth);
+    if (!Number.isFinite(rawIndex) && rawIndex !== Infinity)
+        return null;
+    if (rawIndex < 0)
+        return null;
+    return Math.min(rawIndex, bucketCount - 1);
+}
+//# sourceMappingURL=bucket-utils.js.map

package/dist/lib/quality/bucket-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bucket-utils.js","sourceRoot":"","sources":["../../../src/lib/quality/bucket-utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH;;GAEG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAa,EACb,GAAW,EACX,WAAmB;IAEnB,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,WAAW,CAAC;IAC1C,MAAM,UAAU,GAAyB,EAAE,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC;YACd,KAAK,EAAE,WAAW;YAClB,GAAG,EAAE,WAAW,GAAG,KAAK;SACzB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,KAAa,EACb,WAAmB,EACnB,WAAmB;IAEnB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,WAAW,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC"}

package/dist/lib/quality/bucket-utils.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=bucket-utils.test.d.ts.map

package/dist/lib/quality/bucket-utils.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bucket-utils.test.d.ts","sourceRoot":"","sources":["../../../src/lib/quality/bucket-utils.test.ts"],"names":[],"mappings":""}