opencode-rehydar 0.14.1 → 0.14.3

package/dist/storage/sqlite.d.ts

@@ -0,0 +1,80 @@
+/**
+ * SQLite PII Storage Provider
+ * Server-side persistence with dual-runtime support (Node.js + Bun)
+ */
+import type { EncryptedPIIMap } from "../types/index.js";
+import type { PIIStorageProvider, PIIMapMetadata, StoredPIIMap, ListOptions } from "./types.js";
+/**
+ * SQLite implementation of PIIStorageProvider
+ *
+ * Works on both Node.js (using better-sqlite3) and Bun (using bun:sqlite).
+ * The runtime is auto-detected, so no configuration is needed.
+ *
+ * @example
+ * ```typescript
+ * // Create with file path (works on both Node.js and Bun)
+ * const storage = new SQLitePIIStorageProvider('./pii-maps.db');
+ * await storage.initialize();
+ *
+ * // Or use in-memory database for testing
+ * const storage = new SQLitePIIStorageProvider(':memory:');
+ * await storage.initialize();
+ *
+ * await storage.save('conv-123', encryptedPiiMap, {
+ *   createdAt: Date.now(),
+ *   entityCounts: { PERSON: 2 }
+ * });
+ * ```
+ */
+export declare class SQLitePIIStorageProvider implements PIIStorageProvider {
+    private db;
+    private readonly dbPath;
+    private initialized;
+    /**
+     * Create a new SQLite storage provider
+     * @param dbPath - Path to SQLite database file, or ':memory:' for in-memory
+     */
+    constructor(dbPath: string);
+    /**
+     * Initialize the database connection and create tables
+     * Must be called before using other methods
+     */
+    initialize(): Promise<void>;
+    /**
+     * Ensure database is initialized
+     */
+    private ensureInitialized;
+    /**
+     * Save an encrypted PII map
+     */
+    save(conversationId: string, piiMap: EncryptedPIIMap, metadata?: Partial<PIIMapMetadata>): Promise<void>;
+    /**
+     * Load an encrypted PII map
+     */
+    load(conversationId: string): Promise<StoredPIIMap | null>;
+    /**
+     * Delete a PII map
+     */
+    delete(conversationId: string): Promise<boolean>;
+    /**
+     * Check if a PII map exists
+     */
+    exists(conversationId: string): Promise<boolean>;
+    /**
+     * List stored conversation IDs
+     */
+    list(options?: ListOptions): Promise<string[]>;
+    /**
+     * Delete entries older than the specified date
+     */
+    cleanup(olderThan: Date): Promise<number>;
+    /**
+     * Close the database connection
+     */
+    close(): void;
+    /**
+     * Check if the provider is initialized
+     */
+    get isInitialized(): boolean;
+}
+//# sourceMappingURL=sqlite.d.ts.map

package/dist/storage/sqlite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite.d.ts","sourceRoot":"","sources":["../../src/storage/sqlite.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EACV,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,WAAW,EACZ,MAAM,YAAY,CAAC;AAwFpB;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,wBAAyB,YAAW,kBAAkB;IACjE,OAAO,CAAC,EAAE,CAA+B;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,WAAW,CAAS;IAE5B;;;OAGG;gBACS,MAAM,EAAE,MAAM;IAI1B;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA2BjC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAQzB;;OAEG;IACH,IAAI,CACF,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,eAAe,EACvB,QAAQ,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GACjC,OAAO,CAAC,IAAI,CAAC;IAyChB;;OAEG;IACH,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAgC1D;;OAEG;IACH,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAchD;;OAEG;IACH,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAehD;;OAEG;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA6B9C;;OAEG;IACH,OAAO,CAAC,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IAczC;;OAEG;IACH,KAAK,IAAI,IAAI;IAQb;;OAEG;IACH,IAAI,aAAa,IAAI,OAAO,CAE3B;CACF"}

package/dist/storage/sqlite.js

@@ -0,0 +1,255 @@
+/**
+ * SQLite PII Storage Provider
+ * Server-side persistence with dual-runtime support (Node.js + Bun)
+ */
+// ============================================================================
+// Runtime Detection
+// ============================================================================
+/**
+ * Check if running in Bun runtime
+ */
+function isBun() {
+    return typeof globalThis.Bun !== "undefined";
+}
+/**
+ * Load the appropriate SQLite driver based on runtime
+ */
+async function loadSQLiteDriver(dbPath) {
+    if (isBun()) {
+        // Bun: use built-in bun:sqlite
+        // Use dynamic import with string to avoid TypeScript trying to resolve the module
+        const bunSqlite = "bun:sqlite";
+        const bunModule = (await import(/* @vite-ignore */ bunSqlite));
+        return new bunModule.Database(dbPath);
+    }
+    else {
+        // Node.js: use better-sqlite3
+        try {
+            const betterSqlite3 = await import(/* @vite-ignore */ "better-sqlite3");
+            const Database = betterSqlite3.default;
+            return new Database(dbPath);
+        }
+        catch (error) {
+            if (error instanceof Error &&
+                (error.message.includes("Cannot find module") ||
+                    error.message.includes("MODULE_NOT_FOUND"))) {
+                throw new Error("SQLitePIIStorageProvider requires 'better-sqlite3' package on Node.js.\n" +
+                    "Install it with: npm install better-sqlite3\n" +
+                    "Note: On Bun, the built-in bun:sqlite is used automatically.");
+            }
+            throw error;
+        }
+    }
+}
+// ============================================================================
+// SQLite Storage Provider
+// ============================================================================
+/**
+ * SQLite implementation of PIIStorageProvider
+ *
+ * Works on both Node.js (using better-sqlite3) and Bun (using bun:sqlite).
+ * The runtime is auto-detected, so no configuration is needed.
+ *
+ * @example
+ * ```typescript
+ * // Create with file path (works on both Node.js and Bun)
+ * const storage = new SQLitePIIStorageProvider('./pii-maps.db');
+ * await storage.initialize();
+ *
+ * // Or use in-memory database for testing
+ * const storage = new SQLitePIIStorageProvider(':memory:');
+ * await storage.initialize();
+ *
+ * await storage.save('conv-123', encryptedPiiMap, {
+ *   createdAt: Date.now(),
+ *   entityCounts: { PERSON: 2 }
+ * });
+ * ```
+ */
+export class SQLitePIIStorageProvider {
+    db = null;
+    dbPath;
+    initialized = false;
+    /**
+     * Create a new SQLite storage provider
+     * @param dbPath - Path to SQLite database file, or ':memory:' for in-memory
+     */
+    constructor(dbPath) {
+        this.dbPath = dbPath;
+    }
+    /**
+     * Initialize the database connection and create tables
+     * Must be called before using other methods
+     */
+    async initialize() {
+        if (this.initialized)
+            return;
+        this.db = await loadSQLiteDriver(this.dbPath);
+        // Create table and index
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS pii_maps (
+        conversation_id TEXT PRIMARY KEY,
+        ciphertext TEXT NOT NULL,
+        iv TEXT NOT NULL,
+        auth_tag TEXT NOT NULL,
+        entity_counts TEXT,
+        model_version TEXT,
+        created_at INTEGER NOT NULL,
+        updated_at INTEGER
+      )
+    `);
+        this.db.exec(`
+      CREATE INDEX IF NOT EXISTS idx_pii_maps_created_at 
+      ON pii_maps(created_at)
+    `);
+        this.initialized = true;
+    }
+    /**
+     * Ensure database is initialized
+     */
+    ensureInitialized() {
+        if (!this.initialized || this.db === null) {
+            throw new Error("SQLitePIIStorageProvider not initialized. Call initialize() first.");
+        }
+    }
+    /**
+     * Save an encrypted PII map
+     */
+    save(conversationId, piiMap, metadata) {
+        try {
+            this.ensureInitialized();
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+        const now = Date.now();
+        // Check if entry exists to preserve createdAt
+        // bun:sqlite returns null, better-sqlite3 returns undefined for no results
+        const existing = this.db.prepare("SELECT created_at, entity_counts, model_version FROM pii_maps WHERE conversation_id = ?").get(conversationId);
+        const createdAt = existing?.created_at ?? metadata?.createdAt ?? now;
+        const existingEntityCounts = existing?.entity_counts;
+        const entityCounts = metadata?.entityCounts ??
+            (typeof existingEntityCounts === "string" && existingEntityCounts.length > 0
+                ? JSON.parse(existingEntityCounts)
+                : {});
+        const modelVersion = metadata?.modelVersion ?? existing?.model_version ?? null;
+        this.db.prepare(`
+      INSERT OR REPLACE INTO pii_maps 
+      (conversation_id, ciphertext, iv, auth_tag, entity_counts, model_version, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(conversationId, piiMap.ciphertext, piiMap.iv, piiMap.authTag, JSON.stringify(entityCounts), modelVersion, createdAt, now);
+        return Promise.resolve();
+    }
+    /**
+     * Load an encrypted PII map
+     */
+    load(conversationId) {
+        try {
+            this.ensureInitialized();
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+        const row = this.db.prepare("SELECT * FROM pii_maps WHERE conversation_id = ?").get(conversationId);
+        // bun:sqlite returns null, better-sqlite3 returns undefined for no results
+        if (row == null)
+            return Promise.resolve(null);
+        const entityCountsRaw = row.entity_counts;
+        return Promise.resolve({
+            piiMap: {
+                ciphertext: row.ciphertext,
+                iv: row.iv,
+                authTag: row.auth_tag,
+            },
+            metadata: {
+                createdAt: row.created_at,
+                updatedAt: row.updated_at ?? undefined,
+                entityCounts: typeof entityCountsRaw === "string" && entityCountsRaw.length > 0
+                    ? JSON.parse(entityCountsRaw)
+                    : {},
+                modelVersion: row.model_version ?? undefined,
+            },
+        });
+    }
+    /**
+     * Delete a PII map
+     */
+    delete(conversationId) {
+        try {
+            this.ensureInitialized();
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+        const result = this.db.prepare("DELETE FROM pii_maps WHERE conversation_id = ?").run(conversationId);
+        return Promise.resolve(result.changes > 0);
+    }
+    /**
+     * Check if a PII map exists
+     */
+    exists(conversationId) {
+        try {
+            this.ensureInitialized();
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+        const row = this.db.prepare("SELECT 1 FROM pii_maps WHERE conversation_id = ?").get(conversationId);
+        // bun:sqlite returns null, better-sqlite3 returns undefined for no results
+        return Promise.resolve(row != null);
+    }
+    /**
+     * List stored conversation IDs
+     */
+    list(options) {
+        try {
+            this.ensureInitialized();
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+        let sql = "SELECT conversation_id FROM pii_maps";
+        const params = [];
+        if (options?.olderThan !== undefined) {
+            sql += " WHERE created_at < ?";
+            params.push(options.olderThan.getTime());
+        }
+        sql += " ORDER BY created_at DESC";
+        if (options?.limit !== undefined && options.limit > 0) {
+            sql += " LIMIT ?";
+            params.push(options.limit);
+        }
+        const rows = this.db.prepare(sql).all(...params);
+        return Promise.resolve(rows.map((row) => row.conversation_id));
+    }
+    /**
+     * Delete entries older than the specified date
+     */
+    cleanup(olderThan) {
+        try {
+            this.ensureInitialized();
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+        const result = this.db.prepare("DELETE FROM pii_maps WHERE created_at < ?").run(olderThan.getTime());
+        return Promise.resolve(result.changes);
+    }
+    /**
+     * Close the database connection
+     */
+    close() {
+        if (this.db !== null) {
+            this.db.close();
+            this.db = null;
+            this.initialized = false;
+        }
+    }
+    /**
+     * Check if the provider is initialized
+     */
+    get isInitialized() {
+        return this.initialized;
+    }
+}
+//# sourceMappingURL=sqlite.js.map

package/dist/storage/sqlite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite.js","sourceRoot":"","sources":["../../src/storage/sqlite.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAgDH,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;GAEG;AACH,SAAS,KAAK;IACZ,OAAO,OAAQ,UAAgC,CAAC,GAAG,KAAK,WAAW,CAAC;AACtE,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,gBAAgB,CAAC,MAAc;IAC5C,IAAI,KAAK,EAAE,EAAE,CAAC;QACZ,+BAA+B;QAC/B,kFAAkF;QAClF,MAAM,SAAS,GAAG,YAAY,CAAC;QAC/B,MAAM,SAAS,GAAG,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAuD,CAAC;QACrH,OAAO,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,8BAA8B;QAC9B,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;YACxE,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC;YACvC,OAAO,IAAI,QAAQ,CAAC,MAAM,CAA8B,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,KAAK,YAAY,KAAK;gBACtB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC;oBAC3C,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAC7C,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,0EAA0E;oBACxE,+CAA+C;oBAC/C,8DAA8D,CACjE,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAO,wBAAwB;IAC3B,EAAE,GAA0B,IAAI,CAAC;IACxB,MAAM,CAAS;IACxB,WAAW,GAAG,KAAK,CAAC;IAE5B;;;OAGG;IACH,YAAY,MAAc;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAE7B,IAAI,CAAC,EAAE,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE9C,yBAAyB;QACzB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;KAWZ,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;KAGZ,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED;;OAEG;IACK,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,IAAI,CACF,cAAsB,EACtB,MAAuB,EACvB,QAAkC;QAElC,IAAI,CAAC;YACH,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,8CAA8C;QAC9C,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAG,CAAC,OAAO,CAC/B,yFAAyF,CAC1F,CAAC,GAAG,CAAC,cAAc,CAAyF,CAAC;QAE9G,MAAM,SAAS,GAAG,QAAQ,EAAE,UAAU,IAAI,QAAQ,EAAE,SAAS,IAAI,GAAG,CAAC;QACrE,MAAM,oBAAoB,GAAG,QAAQ,EAAE,aAAa,CAAC;QACrD,MAAM,YAAY,GAAG,QAAQ,EAAE,YAAY;YACzC,CAAC,OAAO,oBAAoB,KAAK,QAAQ,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC;gBAC1E,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAA4B;gBAC9D,CAAC,CAAC,EAAE,CAAC,CAAC;QACV,MAAM,YAAY,GAAG,QAAQ,EAAE,YAAY,IAAI,QAAQ,EAAE,aAAa,IAAI,IAAI,CAAC;QAE/E,IAAI,CAAC,EAAG,CAAC,OAAO,CAAC;;;;KAIhB,CAAC,CAAC,GAAG,CACJ,cAAc,EACd,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,EAAE,EACT,MAAM,CAAC,OAAO,EACd,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAC5B,YAAY,EACZ,SAAS,EACT,GAAG,CACJ,CAAC;QAEF,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,cAAsB;QACzB,IAAI,CAAC;YACH,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,EAAG,CAAC,OAAO,CAC1B,kDAAkD,CACnD,CAAC,GAAG,CAAC,cAAc,CAAiC,CAAC;QAEtD,2EAA2E;QAC3E,IAAI,GAAG,IAAI,IAAI;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE9C,MAAM,eAAe,GAAG,GAAG,CAAC,aAAa,CAAC;QAC1C,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE;gBACN,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,OAAO,EAAE,GAAG,CAAC,QAAQ;aACtB;YACD,QAAQ,EAAE;gBACR,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,SAAS;gBACtC,YAAY,EAAE,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC;oBAC7E,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAA4B;oBACzD,CAAC,CAAC,EAAE;gBACN,YAAY,EAAE,GAAG,CAAC,aAAa,IAAI,SAAS;aAC7C;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,cAAsB;QAC3B,IAAI,CAAC;YACH,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,EAAG,CAAC,OAAO,CAC7B,gDAAgD,CACjD,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAEtB,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,cAAsB;QAC3B,IAAI,CAAC;YACH,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,EAAG,CAAC,OAAO,CAC1B,kDAAkD,CACnD,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAEtB,2EAA2E;QAC3E,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,OAAqB;QACxB,IAAI,CAAC;YACH,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,GAAG,GAAG,sCAAsC,CAAC;QACjD,MAAM,MAAM,GAAc,EAAE,CAAC;QAE7B,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YACrC,GAAG,IAAI,uBAAuB,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3C,CAAC;QAED,GAAG,IAAI,2BAA2B,CAAC;QAEnC,IAAI,OAAO,EAAE,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACtD,GAAG,IAAI,UAAU,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,EAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAE9C,CAAC;QAEH,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,SAAe;QACrB,IAAI,CAAC;YACH,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,EAAG,CAAC,OAAO,CAC7B,2CAA2C,CAC5C,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QAE3B,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;YACf,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QAC3B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF"}

package/dist/storage/types.d.ts

@@ -0,0 +1,208 @@
+/**
+ * PII Storage Provider Types
+ * Interfaces and types for persisting encrypted PII maps
+ */
+export { EncryptedPIIMap } from "../types/index.js";
+import type { EncryptedPIIMap, AnonymizationResult, AnonymizationPolicy } from "../types/index.js";
+/**
+ * Metadata associated with a stored PII map
+ */
+export interface PIIMapMetadata {
+    /** Unix timestamp when the PII map was created */
+    createdAt: number;
+    /** Unix timestamp when the PII map was last updated */
+    updatedAt?: number;
+    /** Count of entities by type (e.g., { PERSON: 2, EMAIL: 1 }) */
+    entityCounts: Record<string, number>;
+    /** Version of the model used for detection */
+    modelVersion?: string;
+}
+/**
+ * A stored PII map with its metadata
+ */
+export interface StoredPIIMap {
+    /** The encrypted PII map data */
+    piiMap: EncryptedPIIMap;
+    /** Associated metadata */
+    metadata: PIIMapMetadata;
+}
+/**
+ * Options for listing stored PII maps
+ */
+export interface ListOptions {
+    /** Maximum number of conversation IDs to return */
+    limit?: number;
+    /** Only return entries older than this date */
+    olderThan?: Date;
+}
+/**
+ * Storage provider interface for persisting encrypted PII maps
+ *
+ * Implementations:
+ * - InMemoryPIIStorageProvider: For development/testing
+ * - SQLitePIIStorageProvider: For server-side persistence (Node.js/Bun)
+ * - IndexedDBPIIStorageProvider: For browser-side persistence
+ *
+ * @example
+ * ```typescript
+ * const storage = new InMemoryPIIStorageProvider();
+ *
+ * // Save a PII map
+ * await storage.save('conv-123', encryptedPiiMap, {
+ *   createdAt: Date.now(),
+ *   entityCounts: { PERSON: 2, EMAIL: 1 }
+ * });
+ *
+ * // Load it back
+ * const stored = await storage.load('conv-123');
+ *
+ * // Cleanup old entries (optional)
+ * const deleted = await storage.cleanup(new Date(Date.now() - 7 * 24 * 60 * 60 * 1000));
+ * ```
+ */
+export interface PIIStorageProvider {
+    /**
+     * Save an encrypted PII map
+     * @param conversationId - Unique conversation identifier
+     * @param piiMap - Encrypted PII map (ciphertext, iv, authTag)
+     * @param metadata - Optional metadata (createdAt, entityCounts, etc.)
+     *                   If not provided, createdAt defaults to current time
+     */
+    save(conversationId: string, piiMap: EncryptedPIIMap, metadata?: Partial<PIIMapMetadata>): Promise<void>;
+    /**
+     * Load an encrypted PII map
+     * @param conversationId - Unique conversation identifier
+     * @returns The stored PII map with metadata, or null if not found
+     */
+    load(conversationId: string): Promise<StoredPIIMap | null>;
+    /**
+     * Delete a PII map
+     * @param conversationId - Unique conversation identifier
+     * @returns true if deleted, false if not found
+     */
+    delete(conversationId: string): Promise<boolean>;
+    /**
+     * Check if a PII map exists
+     * @param conversationId - Unique conversation identifier
+     * @returns true if exists, false otherwise
+     */
+    exists(conversationId: string): Promise<boolean>;
+    /**
+     * List stored conversation IDs
+     * @param options - Optional filtering/limiting options
+     * @returns Array of conversation IDs
+     */
+    list(options?: ListOptions): Promise<string[]>;
+    /**
+     * Delete entries older than the specified date
+     * This is a manual cleanup operation - entries persist forever by default
+     * @param olderThan - Delete entries with createdAt before this date
+     * @returns Number of entries deleted
+     */
+    cleanup(olderThan: Date): Promise<number>;
+}
+/**
+ * Session-bound interface for anonymization with automatic storage
+ *
+ * A session wraps an Anonymizer instance with a specific session ID,
+ * automatically saving PII maps on anonymize and loading them on rehydrate.
+ *
+ * @example
+ * ```typescript
+ * const session = anonymizer.session('chat-123');
+ *
+ * // Anonymize - auto-saves to storage
+ * const result = await session.anonymize('Hello John Smith!');
+ *
+ * // Rehydrate - auto-loads and decrypts
+ * const original = await session.rehydrate(translatedText);
+ * ```
+ */
+export interface AnonymizerSession {
+    /** The session identifier */
+    readonly sessionId: string;
+    /**
+     * Anonymize text and automatically save the encrypted PII map
+     * @param text - Input text to anonymize
+     * @param locale - Optional locale hint (e.g., 'de-DE', 'en-US')
+     * @param policy - Optional policy override
+     * @returns Anonymization result (same as Anonymizer.anonymize)
+     */
+    anonymize(text: string, locale?: string, policy?: Partial<AnonymizationPolicy>): Promise<AnonymizationResult>;
+    /**
+     * Rehydrate anonymized text by loading and decrypting the stored PII map
+     * @param text - Anonymized text with PII placeholders
+     * @returns Original text with PII values restored
+     * @throws Error if no PII map found for this session
+     */
+    rehydrate(text: string): Promise<string>;
+    /**
+     * Load the stored PII map for this session (without decrypting)
+     * @returns The stored PII map with metadata, or null if not found
+     */
+    load(): Promise<StoredPIIMap | null>;
+    /**
+     * Delete the stored PII map for this session
+     * @returns true if deleted, false if not found
+     */
+    delete(): Promise<boolean>;
+    /**
+     * Check if a PII map exists for this session
+     * @returns true if exists, false otherwise
+     */
+    exists(): Promise<boolean>;
+    /**
+     * Recursively anonymize all string values in a JSON-serializable structure.
+     * Returns a deep copy with every string leaf anonymized via session.anonymize().
+     *
+     * Useful for anonymizing tool call results or arbitrary JSON payloads
+     * in multi-round LLM tool execution loops.
+     *
+     * @param value - Any JSON-serializable value (object, array, string, number, boolean, null)
+     * @param locale - Optional locale hint (e.g., 'de-DE', 'en-US')
+     * @param policy - Optional policy override
+     * @returns Deep copy with all strings anonymized
+     *
+     * @example
+     * ```typescript
+     * const result = await session.anonymizeJson({
+     *   name: "John Smith",
+     *   email: "john@example.com",
+     *   age: 30,
+     * });
+     * // { name: '<PII type="PERSON" id="1"/>', email: '<PII type="EMAIL" id="2"/>', age: 30 }
+     * ```
+     */
+    anonymizeJson<T>(value: T, locale?: string, policy?: Partial<AnonymizationPolicy>): Promise<T>;
+    /**
+     * Recursively rehydrate all string values in a JSON-serializable structure.
+     * Returns a deep copy with every string leaf rehydrated via session.rehydrate().
+     *
+     * @param value - Any JSON-serializable value
+     * @returns Deep copy with all strings rehydrated (PII tags replaced with original values)
+     *
+     * @example
+     * ```typescript
+     * const original = await session.rehydrateJson(anonymizedResult);
+     * // { name: "John Smith", email: "john@example.com", age: 30 }
+     * ```
+     */
+    rehydrateJson<T>(value: T): Promise<T>;
+    /**
+     * Create a streaming anonymizer bound to this session.
+     * The stream automatically uses this session's ID, storage, and key provider.
+     * Node.js/Bun only — not available in browser builds.
+     *
+     * @param config - Optional stream configuration overrides
+     * @returns A Transform stream that anonymizes text chunk-by-chunk
+     *
+     * @example
+     * ```typescript
+     * const session = anonymizer.session('chat-123');
+     * const stream = await session.createStream();
+     * input.pipe(stream).pipe(output);
+     * ```
+     */
+    createStream?(config?: Record<string, unknown>): Promise<NodeJS.ReadWriteStream>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/storage/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/storage/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,mBAAmB,CAAC;AAE3B;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,MAAM,EAAE,eAAe,CAAC;IACxB,0BAA0B;IAC1B,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;;OAMG;IACH,IAAI,CACF,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,eAAe,EACvB,QAAQ,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GACjC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;OAIG;IACH,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAE3D;;;;OAIG;IACH,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEjD;;;;OAIG;IACH,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEjD;;;;OAIG;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE/C;;;;;OAKG;IACH,OAAO,CAAC,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,iBAAiB;IAChC,6BAA6B;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B;;;;;;OAMG;IACH,SAAS,CACP,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,GACpC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEhC;;;;;OAKG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;;OAGG;IACH,IAAI,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAErC;;;OAGG;IACH,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE3B;;;OAGG;IACH,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE3B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,aAAa,CAAC,CAAC,EACb,KAAK,EAAE,CAAC,EACR,MAAM,CAAC,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,GACpC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEd;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAEvC;;;;;;;;;;;;;;OAcG;IACH,YAAY,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;CAClF"}

package/dist/storage/types.js

@@ -0,0 +1,6 @@
+/**
+ * PII Storage Provider Types
+ * Interfaces and types for persisting encrypted PII maps
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/storage/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/storage/types.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/streaming/anonymizer-stream.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Anonymizer Stream
+ * Node.js Transform stream that anonymizes text chunk-by-chunk
+ * using sentence buffering for NER context.
+ */
+import { Transform, type TransformCallback } from "node:stream";
+import type { RawPIIMap } from "../pipeline/tagger.js";
+import type { StreamConfig } from "./types.js";
+import type { IAnonymizer } from "../storage/session.js";
+/**
+ * Transform stream that anonymizes text passing through it.
+ *
+ * Uses a SentenceBuffer to accumulate text and flush at sentence
+ * boundaries, maintaining overlap for NER context.
+ *
+ * @example
+ * ```typescript
+ * const stream = await createAnonymizerStream({
+ *   anonymizer: { ner: { mode: 'quantized' } },
+ *   sessionId: 'chat-123',
+ *   piiStorageProvider: storage,
+ *   keyProvider: keyProvider,
+ * });
+ *
+ * createReadStream('input.txt')
+ *   .pipe(stream)
+ *   .pipe(createWriteStream('anonymized.txt'));
+ * ```
+ */
+export declare class AnonymizerStream extends Transform {
+    private readonly sentenceBuffer;
+    private readonly keyProvider;
+    private readonly piiStorageProvider;
+    private readonly sessionId;
+    private readonly onChunkCallback?;
+    private readonly onFinishCallback?;
+    private readonly saveIntervalMs;
+    private lastSaveTime;
+    private totalEntities;
+    private startTime;
+    private chunkCount;
+    constructor(anonymizer: IAnonymizer, config: StreamConfig, initialPiiMap?: RawPIIMap);
+    /**
+     * Get the cumulative PII map built across all chunks.
+     * Available after stream finishes.
+     */
+    getPiiMap(): RawPIIMap;
+    /**
+     * Get stream statistics.
+     */
+    get stats(): {
+        totalEntities: number;
+        chunksProcessed: number;
+        totalProcessingTimeMs: number;
+    };
+    _transform(chunk: Buffer | string, encoding: BufferEncoding, callback: TransformCallback): void;
+    _flush(callback: TransformCallback): void;
+    private processChunk;
+    private maybeSaveToStorage;
+    private processFlush;
+    private buildEntityCounts;
+}
+//# sourceMappingURL=anonymizer-stream.d.ts.map

package/dist/streaming/anonymizer-stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anonymizer-stream.d.ts","sourceRoot":"","sources":["../../src/streaming/anonymizer-stream.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,KAAK,EAAE,YAAY,EAAuC,MAAM,YAAY,CAAC;AACpF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAKzD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,gBAAiB,SAAQ,SAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA4B;IAC/D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgB;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAoC;IACrE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAqC;IAEvE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgB;IAC/C,OAAO,CAAC,YAAY,CAAK;IAEzB,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,UAAU,CAAK;gBAGrB,UAAU,EAAE,WAAW,EACvB,MAAM,EAAE,YAAY,EACpB,aAAa,CAAC,EAAE,SAAS;IAuB3B;;;OAGG;IACH,SAAS,IAAI,SAAS;IAItB;;OAEG;IACH,IAAI,KAAK,IAAI;QACX,aAAa,EAAE,MAAM,CAAC;QACtB,eAAe,EAAE,MAAM,CAAC;QACxB,qBAAqB,EAAE,MAAM,CAAC;KAC/B,CAOA;IAEQ,UAAU,CACjB,KAAK,EAAE,MAAM,GAAG,MAAM,EACtB,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,iBAAiB,GAC1B,IAAI;IAYE,MAAM,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI;YAMpC,YAAY;YAuBZ,kBAAkB;YAsBlB,YAAY;IAgD1B,OAAO,CAAC,iBAAiB;CAY1B"}