opencode-rehydar 0.14.1 → 0.14.3

package/dist/crypto/pii-map-crypto.d.ts

@@ -0,0 +1,114 @@
+/**
+ * PII Map Encryption
+ * AES-256-GCM encryption for the PII mapping
+ * Uses Web Crypto API for browser compatibility
+ */
+import { EncryptedPIIMap } from "../types/index.js";
+import type { RawPIIMap } from "../pipeline/tagger.js";
+/**
+ * Converts a Uint8Array to a Base64 string
+ */
+export declare function uint8ArrayToBase64(bytes: Uint8Array): string;
+/**
+ * Converts a Base64 string to a Uint8Array
+ */
+export declare function base64ToUint8Array(base64: string): Uint8Array;
+/**
+ * Encryption configuration
+ */
+export interface EncryptionConfig {
+    /** IV length in bytes (default: 12 for GCM) */
+    ivLength: number;
+    /** Auth tag length in bits (default: 128) */
+    authTagLength: number;
+}
+/**
+ * Default encryption configuration
+ */
+export declare const DEFAULT_ENCRYPTION_CONFIG: EncryptionConfig;
+/**
+ * Key generation options
+ */
+export interface KeyGenOptions {
+    /** Key length in bytes (default: 32 for AES-256) */
+    length: number;
+}
+/**
+ * Generates a random encryption key
+ * @returns Promise resolving to Uint8Array containing the key
+ */
+export declare function generateKey(options?: Partial<KeyGenOptions>): Uint8Array;
+/**
+ * Generates a random salt for key derivation
+ * @param length - Salt length in bytes (default: 16)
+ * @returns Uint8Array containing the salt
+ */
+export declare function generateSalt(length?: number): Uint8Array;
+/**
+ * Derives a key from a password using PBKDF2
+ * @param password - Password string
+ * @param salt - Salt Uint8Array (should be randomly generated and stored)
+ * @param iterations - Number of iterations (default: 100000)
+ * @returns Promise resolving to Uint8Array containing the derived key
+ */
+export declare function deriveKey(password: string, salt: Uint8Array, iterations?: number): Promise<Uint8Array>;
+/**
+ * Encrypts a PII map using AES-256-GCM
+ * @param piiMap - Raw PII map to encrypt
+ * @param key - 32-byte encryption key as Uint8Array
+ * @param config - Encryption configuration
+ * @returns Promise resolving to encrypted PII map
+ */
+export declare function encryptPIIMap(piiMap: RawPIIMap, key: Uint8Array, config?: Partial<EncryptionConfig>): Promise<EncryptedPIIMap>;
+/**
+ * Decrypts an encrypted PII map
+ * @param encrypted - Encrypted PII map
+ * @param key - 32-byte encryption key as Uint8Array
+ * @param config - Encryption configuration
+ * @returns Promise resolving to decrypted PII map
+ */
+export declare function decryptPIIMap(encrypted: EncryptedPIIMap, key: Uint8Array, config?: Partial<EncryptionConfig>): Promise<RawPIIMap>;
+/**
+ * Key provider interface for external key management
+ */
+export interface KeyProvider {
+    /** Gets the current encryption key */
+    getKey(): Promise<Uint8Array>;
+    /** Rotates to a new key (optional) */
+    rotateKey?(): Promise<Uint8Array>;
+}
+/**
+ * Simple in-memory key provider (for testing/development)
+ * WARNING: Not secure for production use
+ */
+export declare class InMemoryKeyProvider implements KeyProvider {
+    private key;
+    private initialKey?;
+    constructor(key?: Uint8Array);
+    getKey(): Promise<Uint8Array>;
+    rotateKey(): Promise<Uint8Array>;
+}
+/**
+ * Configuration-based key provider
+ * Accepts the key at construction time (platform-agnostic)
+ * Consumer is responsible for reading the key from environment variables or config
+ */
+export declare class ConfigKeyProvider implements KeyProvider {
+    private key;
+    /**
+     * Creates a new ConfigKeyProvider
+     * @param keyBase64 - Base64-encoded 32-byte encryption key
+     */
+    constructor(keyBase64: string);
+    getKey(): Promise<Uint8Array>;
+}
+/**
+ * Validates that a key is suitable for AES-256
+ */
+export declare function validateKey(key: Uint8Array): boolean;
+/**
+ * Securely compares two Uint8Arrays (constant-time)
+ * Prevents timing attacks by always comparing all bytes
+ */
+export declare function secureCompare(a: Uint8Array, b: Uint8Array): boolean;
+//# sourceMappingURL=pii-map-crypto.d.ts.map

package/dist/crypto/pii-map-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-map-crypto.d.ts","sourceRoot":"","sources":["../../src/crypto/pii-map-crypto.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAMvD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAG5D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAG7D;AAMD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB,EAAE,gBAGvC,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;CAChB;AAMD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,GAAE,OAAO,CAAC,aAAa,CAAM,GAAG,UAAU,CAK5E;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,GAAE,MAAW,GAAG,UAAU,CAI5D;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,UAAU,EAChB,UAAU,GAAE,MAAe,GAC1B,OAAO,CAAC,UAAU,CAAC,CA0BrB;AAMD;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,SAAS,EACjB,GAAG,EAAE,UAAU,EACf,MAAM,GAAE,OAAO,CAAC,gBAAgB,CAAM,GACrC,OAAO,CAAC,eAAe,CAAC,CAwD1B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,SAAS,EAAE,eAAe,EAC1B,GAAG,EAAE,UAAU,EACf,MAAM,GAAE,OAAO,CAAC,gBAAgB,CAAM,GACrC,OAAO,CAAC,SAAS,CAAC,CAiDpB;AAMD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,sCAAsC;IACtC,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9B,sCAAsC;IACtC,SAAS,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;CACnC;AAED;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,WAAW;IACrD,OAAO,CAAC,GAAG,CAA2B;IACtC,OAAO,CAAC,UAAU,CAAC,CAAa;gBAEpB,GAAG,CAAC,EAAE,UAAU;IAI5B,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC;IAO7B,SAAS,IAAI,OAAO,CAAC,UAAU,CAAC;CAIjC;AAED;;;;GAIG;AACH,qBAAa,iBAAkB,YAAW,WAAW;IACnD,OAAO,CAAC,GAAG,CAAa;IAExB;;;OAGG;gBACS,SAAS,EAAE,MAAM;IAa7B,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC;CAG9B;AAMD;;GAEG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAEpD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CASnE"}

package/dist/crypto/pii-map-crypto.js

@@ -0,0 +1,228 @@
+/**
+ * PII Map Encryption
+ * AES-256-GCM encryption for the PII mapping
+ * Uses Web Crypto API for browser compatibility
+ */
+// ============================================================================
+// Base64 Utility Functions
+// ============================================================================
+/**
+ * Converts a Uint8Array to a Base64 string
+ */
+export function uint8ArrayToBase64(bytes) {
+    const binString = Array.from(bytes, (b) => String.fromCodePoint(b)).join("");
+    return btoa(binString);
+}
+/**
+ * Converts a Base64 string to a Uint8Array
+ */
+export function base64ToUint8Array(base64) {
+    const binString = atob(base64);
+    return Uint8Array.from(binString, (c) => c.codePointAt(0));
+}
+/**
+ * Default encryption configuration
+ */
+export const DEFAULT_ENCRYPTION_CONFIG = {
+    ivLength: 12,
+    authTagLength: 128, // Web Crypto uses bits, not bytes
+};
+// ============================================================================
+// Core Crypto Functions
+// ============================================================================
+/**
+ * Generates a random encryption key
+ * @returns Promise resolving to Uint8Array containing the key
+ */
+export function generateKey(options = {}) {
+    const length = options.length ?? 32;
+    const key = new Uint8Array(length);
+    globalThis.crypto.getRandomValues(key);
+    return key;
+}
+/**
+ * Generates a random salt for key derivation
+ * @param length - Salt length in bytes (default: 16)
+ * @returns Uint8Array containing the salt
+ */
+export function generateSalt(length = 16) {
+    const salt = new Uint8Array(length);
+    globalThis.crypto.getRandomValues(salt);
+    return salt;
+}
+/**
+ * Derives a key from a password using PBKDF2
+ * @param password - Password string
+ * @param salt - Salt Uint8Array (should be randomly generated and stored)
+ * @param iterations - Number of iterations (default: 100000)
+ * @returns Promise resolving to Uint8Array containing the derived key
+ */
+export async function deriveKey(password, salt, iterations = 100000) {
+    const encoder = new TextEncoder();
+    const passwordBuffer = encoder.encode(password);
+    // Import password as a key
+    const baseKey = await globalThis.crypto.subtle.importKey("raw", passwordBuffer, "PBKDF2", false, ["deriveBits"]);
+    // Derive bits using PBKDF2
+    const derivedBits = await globalThis.crypto.subtle.deriveBits({
+        name: "PBKDF2",
+        salt: salt,
+        iterations: iterations,
+        hash: "SHA-256",
+    }, baseKey, 256 // 32 bytes * 8 bits
+    );
+    return new Uint8Array(derivedBits);
+}
+// ============================================================================
+// Encrypt / Decrypt Functions
+// ============================================================================
+/**
+ * Encrypts a PII map using AES-256-GCM
+ * @param piiMap - Raw PII map to encrypt
+ * @param key - 32-byte encryption key as Uint8Array
+ * @param config - Encryption configuration
+ * @returns Promise resolving to encrypted PII map
+ */
+export async function encryptPIIMap(piiMap, key, config = {}) {
+    const encConfig = { ...DEFAULT_ENCRYPTION_CONFIG, ...config };
+    // Validate key length
+    if (key.length !== 32) {
+        throw new Error(`Invalid key length: expected 32 bytes, got ${key.length}`);
+    }
+    // Convert map to JSON
+    const mapObject = {};
+    for (const [k, v] of piiMap) {
+        mapObject[k] = v;
+    }
+    const plaintext = JSON.stringify(mapObject);
+    // Generate random IV
+    const iv = new Uint8Array(encConfig.ivLength);
+    globalThis.crypto.getRandomValues(iv);
+    // Import key for AES-GCM
+    const cryptoKey = await globalThis.crypto.subtle.importKey("raw", key, { name: "AES-GCM" }, false, ["encrypt"]);
+    // Encrypt using AES-GCM
+    const encoder = new TextEncoder();
+    const plaintextBuffer = encoder.encode(plaintext);
+    const encryptedBuffer = await globalThis.crypto.subtle.encrypt({
+        name: "AES-GCM",
+        iv: iv,
+        tagLength: encConfig.authTagLength,
+    }, cryptoKey, plaintextBuffer);
+    // Web Crypto returns ciphertext + authTag concatenated
+    const encryptedArray = new Uint8Array(encryptedBuffer);
+    const authTagBytes = encConfig.authTagLength / 8;
+    const ciphertext = encryptedArray.slice(0, encryptedArray.length - authTagBytes);
+    const authTag = encryptedArray.slice(encryptedArray.length - authTagBytes);
+    return {
+        ciphertext: uint8ArrayToBase64(ciphertext),
+        iv: uint8ArrayToBase64(iv),
+        authTag: uint8ArrayToBase64(authTag),
+    };
+}
+/**
+ * Decrypts an encrypted PII map
+ * @param encrypted - Encrypted PII map
+ * @param key - 32-byte encryption key as Uint8Array
+ * @param config - Encryption configuration
+ * @returns Promise resolving to decrypted PII map
+ */
+export async function decryptPIIMap(encrypted, key, config = {}) {
+    const encConfig = { ...DEFAULT_ENCRYPTION_CONFIG, ...config };
+    // Validate key length
+    if (key.length !== 32) {
+        throw new Error(`Invalid key length: expected 32 bytes, got ${key.length}`);
+    }
+    // Decode base64
+    const ciphertext = base64ToUint8Array(encrypted.ciphertext);
+    const iv = base64ToUint8Array(encrypted.iv);
+    const authTag = base64ToUint8Array(encrypted.authTag);
+    // Web Crypto expects ciphertext + authTag concatenated
+    const encryptedData = new Uint8Array(ciphertext.length + authTag.length);
+    encryptedData.set(ciphertext, 0);
+    encryptedData.set(authTag, ciphertext.length);
+    // Import key for AES-GCM
+    const cryptoKey = await globalThis.crypto.subtle.importKey("raw", key, { name: "AES-GCM" }, false, ["decrypt"]);
+    // Decrypt using AES-GCM
+    const decryptedBuffer = await globalThis.crypto.subtle.decrypt({
+        name: "AES-GCM",
+        iv: iv,
+        tagLength: encConfig.authTagLength,
+    }, cryptoKey, encryptedData);
+    // Parse JSON back to map
+    const decoder = new TextDecoder();
+    const decryptedText = decoder.decode(decryptedBuffer);
+    const mapObject = JSON.parse(decryptedText);
+    const piiMap = new Map();
+    for (const [k, v] of Object.entries(mapObject)) {
+        piiMap.set(k, v);
+    }
+    return piiMap;
+}
+/**
+ * Simple in-memory key provider (for testing/development)
+ * WARNING: Not secure for production use
+ */
+export class InMemoryKeyProvider {
+    key = null;
+    initialKey;
+    constructor(key) {
+        this.initialKey = key;
+    }
+    getKey() {
+        if (this.key === null) {
+            this.key = this.initialKey ?? generateKey();
+        }
+        return Promise.resolve(this.key);
+    }
+    rotateKey() {
+        this.key = generateKey();
+        return Promise.resolve(this.key);
+    }
+}
+/**
+ * Configuration-based key provider
+ * Accepts the key at construction time (platform-agnostic)
+ * Consumer is responsible for reading the key from environment variables or config
+ */
+export class ConfigKeyProvider {
+    key;
+    /**
+     * Creates a new ConfigKeyProvider
+     * @param keyBase64 - Base64-encoded 32-byte encryption key
+     */
+    constructor(keyBase64) {
+        if (!keyBase64 || keyBase64.length === 0) {
+            throw new Error("Encryption key must be provided");
+        }
+        this.key = base64ToUint8Array(keyBase64);
+        if (this.key.length !== 32) {
+            throw new Error(`Invalid key length: expected 32 bytes, got ${this.key.length}`);
+        }
+    }
+    getKey() {
+        return Promise.resolve(this.key);
+    }
+}
+// ============================================================================
+// Utility Functions
+// ============================================================================
+/**
+ * Validates that a key is suitable for AES-256
+ */
+export function validateKey(key) {
+    return key.length === 32;
+}
+/**
+ * Securely compares two Uint8Arrays (constant-time)
+ * Prevents timing attacks by always comparing all bytes
+ */
+export function secureCompare(a, b) {
+    if (a.length !== b.length) {
+        return false;
+    }
+    let result = 0;
+    for (let i = 0; i < a.length; i++) {
+        result |= a[i] ^ b[i];
+    }
+    return result === 0;
+}
+//# sourceMappingURL=pii-map-crypto.js.map

package/dist/crypto/pii-map-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-map-crypto.js","sourceRoot":"","sources":["../../src/crypto/pii-map-crypto.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,+EAA+E;AAC/E,2BAA2B;AAC3B,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAiB;IAClD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,CAAC;AAC9D,CAAC;AAgBD;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAqB;IACzD,QAAQ,EAAE,EAAE;IACZ,aAAa,EAAE,GAAG,EAAE,kCAAkC;CACvD,CAAC;AAUF,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,UAAkC,EAAE;IAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE;IAC9C,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAAgB,EAChB,IAAgB,EAChB,aAAqB,MAAM;IAE3B,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEhD,2BAA2B;IAC3B,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CACtD,KAAK,EACL,cAAc,EACd,QAAQ,EACR,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC;IAEF,2BAA2B;IAC3B,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAC3D;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,IAAoB;QAC1B,UAAU,EAAE,UAAU;QACtB,IAAI,EAAE,SAAS;KAChB,EACD,OAAO,EACP,GAAG,CAAC,oBAAoB;KACzB,CAAC;IAEF,OAAO,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;AACrC,CAAC;AAED,+EAA+E;AAC/E,8BAA8B;AAC9B,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAiB,EACjB,GAAe,EACf,SAAoC,EAAE;IAEtC,MAAM,SAAS,GAAG,EAAE,GAAG,yBAAyB,EAAE,GAAG,MAAM,EAAE,CAAC;IAE9D,sBAAsB;IACtB,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,8CAA8C,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,sBAAsB;IACtB,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;QAC5B,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAE5C,qBAAqB;IACrB,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC9C,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAEtC,yBAAyB;IACzB,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CACxD,KAAK,EACL,GAAmB,EACnB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;IAEF,wBAAwB;IACxB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAElD,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5D;QACE,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,EAAE;QACN,SAAS,EAAE,SAAS,CAAC,aAAa;KACnC,EACD,SAAS,EACT,eAAe,CAChB,CAAC;IAEF,uDAAuD;IACvD,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,SAAS,CAAC,aAAa,GAAG,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CACrC,CAAC,EACD,cAAc,CAAC,MAAM,GAAG,YAAY,CACrC,CAAC;IACF,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC;IAE3E,OAAO;QACL,UAAU,EAAE,kBAAkB,CAAC,UAAU,CAAC;QAC1C,EAAE,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC;KACrC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,SAA0B,EAC1B,GAAe,EACf,SAAoC,EAAE;IAEtC,MAAM,SAAS,GAAG,EAAE,GAAG,yBAAyB,EAAE,GAAG,MAAM,EAAE,CAAC;IAE9D,sBAAsB;IACtB,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,8CAA8C,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,gBAAgB;IAChB,MAAM,UAAU,GAAG,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC5D,MAAM,EAAE,GAAG,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAEtD,uDAAuD;IACvD,MAAM,aAAa,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzE,aAAa,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACjC,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAE9C,yBAAyB;IACzB,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CACxD,KAAK,EACL,GAAmB,EACnB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;IAEF,wBAAwB;IACxB,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5D;QACE,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,EAAkB;QACtB,SAAS,EAAE,SAAS,CAAC,aAAa;KACnC,EACD,SAAS,EACT,aAAa,CACd,CAAC;IAEF,yBAAyB;IACzB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAA2B,CAAC;IACtE,MAAM,MAAM,GAAc,IAAI,GAAG,EAAE,CAAC;IAEpC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAgBD;;;GAGG;AACH,MAAM,OAAO,mBAAmB;IACtB,GAAG,GAAsB,IAAI,CAAC;IAC9B,UAAU,CAAc;IAEhC,YAAY,GAAgB;QAC1B,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC;IACxB,CAAC;IAED,MAAM;QACJ,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,UAAU,IAAI,WAAW,EAAE,CAAC;QAC9C,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,SAAS;QACP,IAAI,CAAC,GAAG,GAAG,WAAW,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,iBAAiB;IACpB,GAAG,CAAa;IAExB;;;OAGG;IACH,YAAY,SAAiB;QAC3B,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,GAAG,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,8CAA8C,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAChE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM;QACJ,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;CACF;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,GAAe;IACzC,OAAO,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,CAAa,EAAE,CAAa;IACxD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,KAAK,CAAC,CAAC;AACtB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Rehydra Module
+ * Main entry point for on-device PII anonymization
+ */
+export * from "./types/index.js";
+export type { Recognizer } from "./recognizers/index.js";
+export { RegexRecognizer, RecognizerRegistry, createDefaultRegistry, createRegistry, getGlobalRegistry, emailRecognizer, phoneRecognizer, ukPostalCodeRecognizer, streetAddressRecognizer, UK_POSTAL_CODE_PATTERN, isValidUKPostalCode, normalizeUKPostalCode, ibanRecognizer, bicSwiftRecognizer, creditCardRecognizer, ipAddressRecognizer, urlRecognizer, createCustomIdRecognizer, createCaseIdRecognizer, createCustomerIdRecognizer, } from "./recognizers/index.js";
+export { NERModel, NERModelStub, createNERModel, createNERModelStub, WordPieceTokenizer, loadVocabFromFile, parseVocab, loadRuntime, detectRuntime, getRuntimeType, type INERModel, type NERModelConfig, type NERPrediction, type NERModelMode, type DownloadProgressCallback, type OrtSessionOptions, MODEL_REGISTRY, getModelCacheDir, isModelDownloaded, downloadModel, ensureModel, clearModelCache, listDownloadedModels, } from "./ner/index.js";
+export { prenormalize, resolveEntities, tagEntities, validateOutput, generateTag, parseTag, rehydrate, enrichSemantics, inferGender, classifyLocation, getDatabaseStats, hasName, hasLocation, isSemanticDataAvailable, isSemanticDataDownloaded, getSemanticDataCacheDir, getDataDirectory, downloadSemanticData, ensureSemanticData, initializeSemanticData, loadSemanticData, clearSemanticData, clearSemanticDataCache, getSemanticDataInfo, SEMANTIC_DATA_FILES, extractTitle, extractTitlesFromSpans, mergeAdjacentTitleSpans, getTitlesForLanguage, getAllTitles, startsWithTitle, isOnlyTitle, type SemanticDataFileInfo, type EnricherConfig, type GenderResult, type LocationResult, type TitleExtractionResult, } from "./pipeline/index.js";
+export type { KeyProvider } from "./crypto/index.js";
+export { encryptPIIMap, decryptPIIMap, generateKey, deriveKey, generateSalt, InMemoryKeyProvider, ConfigKeyProvider, validateKey, secureCompare, uint8ArrayToBase64, base64ToUint8Array, } from "./crypto/index.js";
+export { getStorageProvider, isNode, isBrowser, resetStorageProvider, setStorageProvider, type StorageProvider, } from "#storage";
+export { type PIIStorageProvider, type PIIMapMetadata, type StoredPIIMap, type ListOptions, type AnonymizerSession, InMemoryPIIStorageProvider, SQLitePIIStorageProvider, IndexedDBPIIStorageProvider, } from "./storage/index.js";
+export { join as pathJoin, dirname as pathDirname, basename as pathBasename, normalize as pathNormalize, extname as pathExtname, isAbsolute as pathIsAbsolute, } from "./utils/path.js";
+import { Anonymizer as AnonymizerCore, anonymize as anonymizeCore, anonymizeRegexOnly as anonymizeRegexOnlyCore, anonymizeWithNER as anonymizeWithNERCore, type AnonymizerConfig, type NERConfig } from "./core/index.js";
+export type { AnonymizerConfig, NERConfig };
+export type { SecretsConfig } from "./types/index.js";
+export { createSecretRecognizers } from "./recognizers/secrets/index.js";
+/**
+ * Anonymizer instance
+ * Main class for performing PII anonymization
+ */
+export declare class Anonymizer extends AnonymizerCore {
+    constructor(config?: AnonymizerConfig);
+}
+/**
+ * Creates an anonymizer with the specified configuration
+ *
+ * @example
+ * ```typescript
+ * // Regex-only (no NER)
+ * const anonymizer = createAnonymizer();
+ *
+ * // With NER (auto-downloads model on first use)
+ * const anonymizer = createAnonymizer({
+ *   ner: { mode: 'quantized' }
+ * });
+ *
+ * // With NER and progress callback
+ * const anonymizer = createAnonymizer({
+ *   ner: {
+ *     mode: 'standard',
+ *     onStatus: (status) => console.log(status),
+ *     onDownloadProgress: (p) => console.log(`${p.file}: ${p.percent}%`)
+ *   }
+ * });
+ * ```
+ */
+export declare function createAnonymizer(config?: AnonymizerConfig): Anonymizer;
+export declare const anonymize: typeof anonymizeCore;
+export declare const anonymizeRegexOnly: typeof anonymizeRegexOnlyCore;
+export declare const anonymizeWithNER: typeof anonymizeWithNERCore;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,cAAc,kBAAkB,CAAC;AAGjC,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,wBAAwB,EACxB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,UAAU,EACV,WAAW,EACX,aAAa,EACb,cAAc,EACd,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,eAAe,EACf,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,YAAY,EACZ,eAAe,EACf,WAAW,EACX,cAAc,EACd,WAAW,EACX,QAAQ,EACR,SAAS,EACT,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,OAAO,EACP,WAAW,EAEX,uBAAuB,EACvB,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EAEnB,YAAY,EACZ,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,WAAW,EACX,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC;AAG7B,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EACL,aAAa,EACb,aAAa,EACb,WAAW,EACX,SAAS,EACT,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,kBAAkB,EAClB,MAAM,EACN,SAAS,EACT,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,eAAe,GACrB,MAAM,UAAU,CAAC;AAIlB,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,IAAI,IAAI,QAAQ,EAChB,OAAO,IAAI,WAAW,EACtB,QAAQ,IAAI,YAAY,EACxB,SAAS,IAAI,aAAa,EAC1B,OAAO,IAAI,WAAW,EACtB,UAAU,IAAI,cAAc,GAC7B,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,UAAU,IAAI,cAAc,EAC5B,SAAS,IAAI,aAAa,EAC1B,kBAAkB,IAAI,sBAAsB,EAC5C,gBAAgB,IAAI,oBAAoB,EACxC,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACf,MAAM,iBAAiB,CAAC;AAMzB,YAAY,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC;AAC5C,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAEzE;;;GAGG;AACH,qBAAa,UAAW,SAAQ,cAAc;gBAChC,MAAM,GAAE,gBAAqB;CAU1C;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,UAAU,CAEtE;AAGD,eAAO,MAAM,SAAS,sBAAgB,CAAC;AACvC,eAAO,MAAM,kBAAkB,+BAAyB,CAAC;AACzD,eAAO,MAAM,gBAAgB,6BAAuB,CAAC"}

package/dist/index.js

@@ -0,0 +1,72 @@
+/**
+ * Rehydra Module
+ * Main entry point for on-device PII anonymization
+ */
+// Re-export types
+export * from "./types/index.js";
+export { RegexRecognizer, RecognizerRegistry, createDefaultRegistry, createRegistry, getGlobalRegistry, emailRecognizer, phoneRecognizer, ukPostalCodeRecognizer, streetAddressRecognizer, UK_POSTAL_CODE_PATTERN, isValidUKPostalCode, normalizeUKPostalCode, ibanRecognizer, bicSwiftRecognizer, creditCardRecognizer, ipAddressRecognizer, urlRecognizer, createCustomIdRecognizer, createCaseIdRecognizer, createCustomerIdRecognizer, } from "./recognizers/index.js";
+// Re-export NER components
+export { NERModel, NERModelStub, createNERModel, createNERModelStub, WordPieceTokenizer, loadVocabFromFile, parseVocab, loadRuntime, detectRuntime, getRuntimeType, MODEL_REGISTRY, getModelCacheDir, isModelDownloaded, downloadModel, ensureModel, clearModelCache, listDownloadedModels, } from "./ner/index.js";
+// Re-export pipeline components
+export { prenormalize, resolveEntities, tagEntities, validateOutput, generateTag, parseTag, rehydrate, enrichSemantics, inferGender, classifyLocation, getDatabaseStats, hasName, hasLocation, 
+// Semantic data loader exports
+isSemanticDataAvailable, isSemanticDataDownloaded, getSemanticDataCacheDir, getDataDirectory, downloadSemanticData, ensureSemanticData, initializeSemanticData, loadSemanticData, clearSemanticData, clearSemanticDataCache, getSemanticDataInfo, SEMANTIC_DATA_FILES, 
+// Title extractor exports
+extractTitle, extractTitlesFromSpans, mergeAdjacentTitleSpans, getTitlesForLanguage, getAllTitles, startsWithTitle, isOnlyTitle, } from "./pipeline/index.js";
+export { encryptPIIMap, decryptPIIMap, generateKey, deriveKey, generateSalt, InMemoryKeyProvider, ConfigKeyProvider, validateKey, secureCompare, uint8ArrayToBase64, base64ToUint8Array, } from "./crypto/index.js";
+// Re-export storage utilities (file system abstraction)
+export { getStorageProvider, isNode, isBrowser, resetStorageProvider, setStorageProvider, } from "#storage";
+// Re-export PII storage providers (for persisting encrypted PII maps)
+// This includes SQLitePIIStorageProvider for Node.js
+export { InMemoryPIIStorageProvider, SQLitePIIStorageProvider, IndexedDBPIIStorageProvider, } from "./storage/index.js";
+// Re-export path utilities
+export { join as pathJoin, dirname as pathDirname, basename as pathBasename, normalize as pathNormalize, extname as pathExtname, isAbsolute as pathIsAbsolute, } from "./utils/path.js";
+// Import core anonymizer components
+import { Anonymizer as AnonymizerCore, anonymize as anonymizeCore, anonymizeRegexOnly as anonymizeRegexOnlyCore, anonymizeWithNER as anonymizeWithNERCore, } from "./core/index.js";
+// Import session implementation
+import { AnonymizerSessionImpl } from "./storage/session.js";
+export { createSecretRecognizers } from "./recognizers/secrets/index.js";
+/**
+ * Anonymizer instance
+ * Main class for performing PII anonymization
+ */
+export class Anonymizer extends AnonymizerCore {
+    constructor(config = {}) {
+        super(config, (anonymizer, sessionId, storage, keyProvider) => {
+            return new AnonymizerSessionImpl(anonymizer, sessionId, storage, keyProvider);
+        });
+    }
+}
+/**
+ * Creates an anonymizer with the specified configuration
+ *
+ * @example
+ * ```typescript
+ * // Regex-only (no NER)
+ * const anonymizer = createAnonymizer();
+ *
+ * // With NER (auto-downloads model on first use)
+ * const anonymizer = createAnonymizer({
+ *   ner: { mode: 'quantized' }
+ * });
+ *
+ * // With NER and progress callback
+ * const anonymizer = createAnonymizer({
+ *   ner: {
+ *     mode: 'standard',
+ *     onStatus: (status) => console.log(status),
+ *     onDownloadProgress: (p) => console.log(`${p.file}: ${p.percent}%`)
+ *   }
+ * });
+ * ```
+ */
+export function createAnonymizer(config) {
+    return new Anonymizer(config);
+}
+// Re-export standalone functions from core
+export const anonymize = anonymizeCore;
+export const anonymizeRegexOnly = anonymizeRegexOnlyCore;
+export const anonymizeWithNER = anonymizeWithNERCore;
+// Note: Streaming and proxy modules are Node.js/Bun only.
+// Import from 'rehydra/streaming' or 'rehydra/proxy' subpaths.
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,kBAAkB;AAClB,cAAc,kBAAkB,CAAC;AAIjC,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,wBAAwB,EACxB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAEhC,2BAA2B;AAC3B,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,UAAU,EACV,WAAW,EACX,aAAa,EACb,cAAc,EAOd,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,eAAe,EACf,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,gCAAgC;AAChC,OAAO,EACL,YAAY,EACZ,eAAe,EACf,WAAW,EACX,cAAc,EACd,WAAW,EACX,QAAQ,EACR,SAAS,EACT,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,OAAO,EACP,WAAW;AACX,+BAA+B;AAC/B,uBAAuB,EACvB,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB;AACnB,0BAA0B;AAC1B,YAAY,EACZ,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,WAAW,GAMZ,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EACL,aAAa,EACb,aAAa,EACb,WAAW,EACX,SAAS,EACT,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,wDAAwD;AACxD,OAAO,EACL,kBAAkB,EAClB,MAAM,EACN,SAAS,EACT,oBAAoB,EACpB,kBAAkB,GAEnB,MAAM,UAAU,CAAC;AAElB,sEAAsE;AACtE,qDAAqD;AACrD,OAAO,EAML,0BAA0B,EAC1B,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAE5B,2BAA2B;AAC3B,OAAO,EACL,IAAI,IAAI,QAAQ,EAChB,OAAO,IAAI,WAAW,EACtB,QAAQ,IAAI,YAAY,EACxB,SAAS,IAAI,aAAa,EAC1B,OAAO,IAAI,WAAW,EACtB,UAAU,IAAI,cAAc,GAC7B,MAAM,iBAAiB,CAAC;AAEzB,oCAAoC;AACpC,OAAO,EACL,UAAU,IAAI,cAAc,EAC5B,SAAS,IAAI,aAAa,EAC1B,kBAAkB,IAAI,sBAAsB,EAC5C,gBAAgB,IAAI,oBAAoB,GAGzC,MAAM,iBAAiB,CAAC;AAEzB,gCAAgC;AAChC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAK7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAEzE;;;GAGG;AACH,MAAM,OAAO,UAAW,SAAQ,cAAc;IAC5C,YAAY,SAA2B,EAAE;QACvC,KAAK,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE;YAC5D,OAAO,IAAI,qBAAqB,CAC9B,UAAU,EACV,SAAS,EACT,OAAO,EACP,WAAW,CACZ,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAyB;IACxD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,2CAA2C;AAC3C,MAAM,CAAC,MAAM,SAAS,GAAG,aAAa,CAAC;AACvC,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAErD,0DAA0D;AAC1D,+DAA+D"}

package/dist/ner/bio-decoder.d.ts

@@ -0,0 +1,64 @@
+/**
+ * BIO Tag Decoder
+ * Converts BIO-tagged token sequences to entity spans
+ */
+import { SpanMatch } from '../types/index.js';
+import type { Token } from './tokenizer.js';
+/**
+ * BIO tag types
+ */
+export declare enum BIOTag {
+    /** Beginning of an entity */
+    B = "B",
+    /** Inside an entity (continuation) */
+    I = "I",
+    /** Outside any entity */
+    O = "O"
+}
+/**
+ * Parsed BIO label
+ */
+export interface ParsedBIOLabel {
+    /** BIO tag type */
+    tag: BIOTag;
+    /** Entity type (null for O tag) */
+    entityType: string | null;
+}
+/**
+ * Raw entity span from NER (before conversion to SpanMatch)
+ */
+export interface RawNEREntity {
+    /** Entity type string from model */
+    type: string;
+    /** Start character offset */
+    start: number;
+    /** End character offset */
+    end: number;
+    /** Combined confidence score */
+    confidence: number;
+    /** Raw text */
+    text: string;
+    /** Token indices that make up this entity */
+    tokenIndices: number[];
+}
+/**
+ * Parses a BIO label string (e.g., "B-PER", "I-ORG", "O")
+ */
+export declare function parseBIOLabel(label: string): ParsedBIOLabel;
+/**
+ * Decodes BIO-tagged tokens into entity spans
+ */
+export declare function decodeBIOTags(tokens: Token[], labels: string[], confidences: number[], originalText: string): RawNEREntity[];
+/**
+ * Converts raw NER entities to SpanMatch format
+ */
+export declare function convertToSpanMatches(rawEntities: RawNEREntity[], confidenceThreshold?: number): SpanMatch[];
+/**
+ * Post-processes NER spans to clean up boundaries
+ */
+export declare function cleanupSpanBoundaries(spans: SpanMatch[], originalText: string): SpanMatch[];
+/**
+ * Merges adjacent spans of the same type
+ */
+export declare function mergeAdjacentSpans(spans: SpanMatch[], originalText: string, maxGap?: number): SpanMatch[];
+//# sourceMappingURL=bio-decoder.d.ts.map

package/dist/ner/bio-decoder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bio-decoder.d.ts","sourceRoot":"","sources":["../../src/ner/bio-decoder.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAW,SAAS,EAAmB,MAAM,mBAAmB,CAAC;AAExE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAE5C;;GAEG;AACH,oBAAY,MAAM;IAChB,6BAA6B;IAC7B,CAAC,MAAM;IACP,sCAAsC;IACtC,CAAC,MAAM;IACP,yBAAyB;IACzB,CAAC,MAAM;CACR;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,mBAAmB;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,mCAAmC;IACnC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,gCAAgC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe;IACf,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,CAyB3D;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,KAAK,EAAE,EACf,MAAM,EAAE,MAAM,EAAE,EAChB,WAAW,EAAE,MAAM,EAAE,EACrB,YAAY,EAAE,MAAM,GACnB,YAAY,EAAE,CAkFhB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,YAAY,EAAE,EAC3B,mBAAmB,GAAE,MAAY,GAChC,SAAS,EAAE,CA0Bb;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,SAAS,EAAE,EAClB,YAAY,EAAE,MAAM,GACnB,SAAS,EAAE,CAoCb;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,SAAS,EAAE,EAClB,YAAY,EAAE,MAAM,EACpB,MAAM,GAAE,MAAU,GACjB,SAAS,EAAE,CAmCb"}