opencode-rehydar 0.14.2 → 0.14.3

package/dist/streaming/stream-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-factory.js","sourceRoot":"","sources":["../../src/streaming/stream-factory.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAAuB,EAAE;IAEzB,8DAA8D;IAC9D,IAAI,gBAAgB,GAAiC,MAAM,CAAC,UAAU,CAAC;IACvE,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,EAAE,CAAC;QACvC,gBAAgB,GAAG;YACjB,GAAG,gBAAgB;YACnB,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;SAC1B,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,+EAA+E;IAC/E,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,gBAAgB,GAAG;YACjB,GAAG,gBAAgB;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC;IACJ,CAAC;IAED,uCAAuC;IACvC,MAAM,UAAU,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IACtD,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC;IAE9B,0DAA0D;IAC1D,IAAI,aAAoC,CAAC;IACzC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,EAAE,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAC7I,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACxE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YAC9C,aAAa,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,OAAO,IAAI,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;AACjE,CAAC"}

package/dist/streaming/types.d.ts

@@ -0,0 +1,121 @@
+/**
+ * Streaming Anonymization Types
+ */
+import type { TransformOptions } from "node:stream";
+import type { AnonymizerConfig } from "../core/anonymizer.js";
+import type { AnonymizationPolicy, DetectedEntity, EncryptedPIIMap } from "../types/index.js";
+import type { KeyProvider } from "../crypto/index.js";
+import type { PIIStorageProvider } from "../storage/types.js";
+/**
+ * Configuration for the streaming anonymizer
+ */
+export interface StreamConfig {
+    /** Base anonymizer config */
+    anonymizer?: AnonymizerConfig;
+    /** Policy override for all chunks */
+    policy?: Partial<AnonymizationPolicy>;
+    /** Locale hint (e.g., 'de-DE', 'en-US') */
+    locale?: string;
+    /** Sentence buffer configuration */
+    buffer?: SentenceBufferConfig;
+    /** Session ID for cross-chunk ID persistence and storage */
+    sessionId?: string;
+    /** Storage provider (required if sessionId is set) */
+    piiStorageProvider?: PIIStorageProvider;
+    /** Key provider (required if sessionId is set) */
+    keyProvider?: KeyProvider;
+    /**
+     * Interval in milliseconds for saving the PII map to storage during streaming.
+     * When set, saves at most once per interval (in addition to the final save on flush).
+     * Useful for crash recovery on long streams.
+     * @default undefined (only save on stream end)
+     */
+    saveIntervalMs?: number;
+    /** Node.js Transform stream options (highWaterMark, etc.) */
+    streamOptions?: TransformOptions;
+    /** Callback fired after each chunk is anonymized */
+    onChunk?: (event: StreamChunkEvent) => void;
+    /** Callback fired when the stream finishes */
+    onFinish?: (event: StreamFinishEvent) => void;
+}
+/**
+ * Sentence buffer configuration
+ */
+export interface SentenceBufferConfig {
+    /**
+     * Overlap size in characters for NER context window.
+     * The overlap region from the previous chunk is re-processed
+     * to catch entities that span boundaries.
+     * @default 100
+     */
+    overlapChars?: number;
+    /**
+     * Maximum buffer size before forcing a flush.
+     * Prevents unbounded memory growth if no sentence boundary is found.
+     * @default 8192
+     */
+    maxBufferSize?: number;
+    /**
+     * Minimum characters to buffer before attempting sentence detection.
+     * In low-latency mode this is automatically reduced.
+     * @default 50
+     */
+    minBufferSize?: number;
+    /**
+     * Low-latency mode for LLM token streams.
+     * - Reduces buffer sizes
+     * - Disables NER (regex-only)
+     * - Flushes more aggressively
+     * @default false
+     */
+    lowLatency?: boolean;
+    /**
+     * Custom sentence boundary regex.
+     * @default /[.!?]\s+|[\n]{2,}/
+     */
+    sentenceBoundary?: RegExp;
+}
+/**
+ * Event emitted after each chunk is processed
+ */
+export interface StreamChunkEvent {
+    /** Anonymized text for this chunk */
+    anonymizedText: string;
+    /** Entities detected in this chunk */
+    entities: Omit<DetectedEntity, "original">[];
+    /** Cumulative entity count */
+    totalEntities: number;
+    /** Processing time for this chunk in ms */
+    processingTimeMs: number;
+}
+/**
+ * Event emitted when the stream finishes
+ */
+export interface StreamFinishEvent {
+    /** Total entities across all chunks */
+    totalEntities: number;
+    /** Final encrypted PII map (if pseudonymize mode) */
+    piiMap?: EncryptedPIIMap;
+    /** Total processing time in ms */
+    totalProcessingTimeMs: number;
+}
+/**
+ * Result of a single buffer flush
+ */
+export interface FlushResult {
+    /** Anonymized text for the new (non-overlap) portion */
+    anonymizedText: string;
+    /** Entities detected in this flush */
+    entities: Omit<DetectedEntity, "original">[];
+}
+/**
+ * Resolved buffer configuration with defaults applied
+ */
+export interface ResolvedBufferConfig {
+    overlapChars: number;
+    maxBufferSize: number;
+    minBufferSize: number;
+    lowLatency: boolean;
+    sentenceBoundary: RegExp;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/streaming/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/streaming/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EACV,mBAAmB,EACnB,cAAc,EACd,eAAe,EAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,6BAA6B;IAC7B,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAE9B,qCAAqC;IACrC,MAAM,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEtC,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,oCAAoC;IACpC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAE9B,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,sDAAsD;IACtD,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IAExC,kDAAkD;IAClD,WAAW,CAAC,EAAE,WAAW,CAAC;IAE1B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,gBAAgB,CAAC;IAEjC,oDAAoD;IACpD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAE5C,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;CAC/C;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,sCAAsC;IACtC,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,EAAE,CAAC;IAC7C,8BAA8B;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,uCAAuC;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,kCAAkC;IAClC,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,wDAAwD;IACxD,cAAc,EAAE,MAAM,CAAC;IACvB,sCAAsC;IACtC,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,EAAE,CAAC;CAC9C;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;CAC1B"}

package/dist/streaming/types.js

@@ -0,0 +1,5 @@
+/**
+ * Streaming Anonymization Types
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/streaming/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/streaming/types.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/types/index.d.ts

@@ -0,0 +1,269 @@
+import { PIIType } from "./pii-types.js";
+export * from "./pii-types.js";
+/**
+ * Source of entity detection
+ */
+export declare enum DetectionSource {
+    REGEX = "REGEX",
+    NER = "NER",
+    HYBRID = "HYBRID"
+}
+/**
+ * Anonymization mode
+ * - 'pseudonymize': Reversible anonymization with encrypted PII map (default)
+ * - 'anonymize': Irreversible anonymization without PII map
+ */
+export type AnonymizationMode = "pseudonymize" | "anonymize";
+/**
+ * Gender attribute for PERSON entities
+ * Used to preserve grammatical agreement during machine translation
+ */
+export type PersonGender = "male" | "female" | "neutral" | "unknown";
+/**
+ * Scope attribute for LOCATION entities
+ * Helps MT engines select correct prepositions (e.g., "in Berlin" vs "in Germany")
+ */
+export type LocationScope = "city" | "country" | "region" | "macro-region" | "unknown";
+/**
+ * Semantic attributes for PII entities
+ * These attributes help preserve linguistic context during translation
+ */
+export interface SemanticAttributes {
+    /** Gender for PERSON entities */
+    gender?: PersonGender;
+    /** Geographic scope for LOCATION entities */
+    scope?: LocationScope;
+    /** Honorific title extracted from PERSON entities (e.g., "Dr.", "Mrs.") */
+    title?: string;
+}
+/**
+ * Configures the delimiter format used for PII placeholder tags.
+ *
+ * Default (XML-style): `<PII type="EMAIL" id="1"/>`
+ * Custom example:      `[[PII type="EMAIL" id="1"]]`
+ */
+export interface TagFormat {
+    /** Opening delimiter (e.g., "<" for XML, "[[" for bracket style) */
+    open: string;
+    /** Closing delimiter (e.g., "/>" for XML self-closing, "]]" for bracket style) */
+    close: string;
+    /** Tag keyword (default: "PII"). Allows e.g., "REDACTED" instead of "PII" */
+    keyword?: string;
+}
+/**
+ * Default XML-style tag format: `<PII type="..." id="N"/>`
+ */
+export declare const DEFAULT_TAG_FORMAT: TagFormat;
+/**
+ * Progress callback for semantic data downloads
+ */
+export type SemanticDownloadProgressCallback = (progress: {
+    file: string;
+    bytesDownloaded: number;
+    totalBytes: number | null;
+    percent: number | null;
+}) => void;
+/**
+ * Semantic enrichment configuration
+ * Controls automatic downloading and loading of semantic data for MT-friendly PII tags
+ */
+export interface SemanticConfig {
+    /**
+     * Whether to enable semantic masking (adds gender/scope attributes to PII tags)
+     * @default false
+     */
+    enabled: boolean;
+    /**
+     * Whether to auto-download semantic data if not present
+     * Data files include name-gender mappings (~40K names) and location data (~25K cities)
+     * Total download size: ~4 MB
+     * @default true when enabled is true
+     */
+    autoDownload?: boolean;
+    /**
+     * Callback for download progress
+     */
+    onDownloadProgress?: SemanticDownloadProgressCallback;
+    /**
+     * Callback for status messages
+     */
+    onStatus?: (status: string) => void;
+}
+/**
+ * Identifier of a PII tag.
+ *
+ * IDs assigned by the tagger are 1-based, monotonically increasing numbers.
+ * Externally generated IDs (e.g. seeded through an existing PII map) may also
+ * be lowercase alphanumeric strings (`[0-9a-z]+`), which lets callers derive a
+ * stable ID from the value it masks. Decimal-only IDs are always represented
+ * as numbers; any ID containing letters is represented as a lowercase string.
+ */
+export type TagId = number | string;
+/**
+ * A detected PII entity with its position and metadata
+ */
+export interface DetectedEntity {
+    /** PII category */
+    type: PIIType;
+    /** Unique identifier within the document (see {@link TagId}) */
+    id: TagId;
+    /** Start character offset in original text (0-based, inclusive) */
+    start: number;
+    /** End character offset in original text (0-based, exclusive) */
+    end: number;
+    /** Detection confidence score (0.0 to 1.0) */
+    confidence: number;
+    /** How this entity was detected */
+    source: DetectionSource;
+    /** Original text (only stored in encrypted pii_map, never logged) */
+    original: string;
+    /** Semantic attributes for MT-friendly tags (gender, scope, etc.) */
+    semantic?: SemanticAttributes;
+}
+/**
+ * A span match from a recognizer (before ID assignment)
+ */
+export interface SpanMatch {
+    /** PII category */
+    type: PIIType;
+    /** Start character offset (0-based, inclusive) */
+    start: number;
+    /** End character offset (0-based, exclusive) */
+    end: number;
+    /** Detection confidence score (0.0 to 1.0) */
+    confidence: number;
+    /** How this span was detected */
+    source: DetectionSource;
+    /** The matched text */
+    text: string;
+    /** Semantic attributes for MT-friendly tags (gender, scope, etc.) */
+    semantic?: SemanticAttributes;
+}
+/**
+ * Custom ID pattern configuration
+ */
+export interface CustomIdPattern {
+    /** Pattern name for identification */
+    name: string;
+    /** Regular expression pattern */
+    pattern: RegExp;
+    /** PII type to assign (typically CASE_ID or CUSTOMER_ID) */
+    type: PIIType;
+    /** Optional validation function */
+    validate?: (match: string) => boolean;
+}
+/**
+ * Anonymization policy configuration
+ */
+export interface AnonymizationPolicy {
+    /** Set of PII types to detect (both regex and NER) */
+    enabledTypes: Set<PIIType>;
+    /** Set of PII types to detect via regex */
+    regexEnabledTypes: Set<PIIType>;
+    /** Set of PII types to detect via NER */
+    nerEnabledTypes: Set<PIIType>;
+    /** Priority order for resolving overlapping entities (higher index = higher priority) */
+    typePriority: PIIType[];
+    /** Minimum confidence thresholds per type (default: 0.5) */
+    confidenceThresholds: Map<PIIType, number>;
+    /** Custom ID patterns for domain-specific identifiers */
+    customIdPatterns: CustomIdPattern[];
+    /** Terms that should not be treated as PII (case-insensitive) */
+    allowlistTerms: Set<string>;
+    /** Terms that should always be treated as PII */
+    denylistPatterns: RegExp[];
+    /** Whether to reuse IDs for identical repeated PII strings */
+    reuseIdsForRepeatedPII: boolean;
+    /** Whether to run leak scan on anonymized output */
+    enableLeakScan: boolean;
+    /** Enable semantic attribute enrichment for MT-friendly tags (gender, location scope) */
+    enableSemanticMasking: boolean;
+    /** Location scopes to exclude from anonymization (e.g., 'country', 'region').
+     *  Requires enableSemanticMasking to be true. Locations whose scope matches
+     *  one of these values are dropped before tagging. */
+    excludeLocationScopes: Set<LocationScope>;
+}
+/**
+ * Encrypted PII map entry
+ */
+export interface EncryptedPIIMap {
+    /** AES-256-GCM encrypted data (base64) */
+    ciphertext: string;
+    /** Initialization vector (base64) */
+    iv: string;
+    /** Authentication tag (base64) */
+    authTag: string;
+}
+/**
+ * Statistics about the anonymization process
+ */
+export interface AnonymizationStats {
+    /** Count of entities detected per type */
+    countsByType: Record<PIIType, number>;
+    /** Total number of entities detected */
+    totalEntities: number;
+    /** NER model version used */
+    modelVersion: string;
+    /** Policy version/identifier */
+    policyVersion: string;
+    /** Processing time in milliseconds */
+    processingTimeMs: number;
+    /** Whether leak scan passed (if enabled) */
+    leakScanPassed?: boolean;
+    /**
+     * True when NER coverage was truncated because the input exceeded
+     * maxWindowsPerInput (its tail was not scanned by the NER model). Regex
+     * detection is unaffected. Callers enforcing a fail-closed policy should
+     * treat this as incomplete masking. Undefined when NER did not run (e.g.
+     * regex-only) or the producer does not report coverage.
+     */
+    nerTruncated?: boolean;
+    /**
+     * Number of leading input characters NER scanned (in prenormalized space).
+     * Only meaningful when nerTruncated is true: a caller can cut the input at
+     * this offset to keep only the fully-scanned portion. Because prenormalized
+     * text is never longer than the original, cutting the original string at
+     * this offset stays at or before the true boundary (never keeps unscanned
+     * content).
+     */
+    nerCoverageChars?: number;
+}
+/**
+ * Result of the anonymization process
+ */
+export interface AnonymizationResult {
+    /** Text with PII replaced by placeholder tags */
+    anonymizedText: string;
+    /** List of detected entities (without original text for safety) */
+    entities: Omit<DetectedEntity, "original">[];
+    /** Encrypted mapping of (type, id) -> original string (undefined in 'anonymize' mode) */
+    piiMap?: EncryptedPIIMap;
+    /** Statistics about the anonymization */
+    stats: AnonymizationStats;
+}
+/**
+ * Creates a default anonymization policy with all types enabled
+ */
+/**
+ * Secrets/credentials detection configuration
+ */
+export interface SecretsConfig {
+    /** Enable secrets/credentials detection */
+    enabled: boolean;
+    /** .env file paths or Node.js glob patterns to parse for known secret values */
+    envFiles?: string[];
+    /** Base directory for Node.js envFiles paths/globs. Defaults to process.cwd(). */
+    envBaseDirectory?: string;
+    /** Explicit values to always redact */
+    redactValues?: string[];
+    /** Additional key name patterns for ENV_VAR_SECRET / CONFIG_SECRET detection */
+    secretKeyPatterns?: RegExp[];
+    /** Minimum value length to consider as a secret (default: 4) */
+    minValueLength?: number;
+}
+export declare function createDefaultPolicy(): AnonymizationPolicy;
+/**
+ * Merges a partial policy with defaults
+ */
+export declare function mergePolicy(partial: Partial<AnonymizationPolicy>): AnonymizationPolicy;
+//# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAA2C,MAAM,gBAAgB,CAAC;AAElF,cAAc,gBAAgB,CAAC;AAE/B;;GAEG;AACH,oBAAY,eAAe;IACzB,KAAK,UAAU;IACf,GAAG,QAAQ;IACX,MAAM,WAAW;CAClB;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,cAAc,GAAG,WAAW,CAAC;AAM7D;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAErE;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,cAAc,GAAG,SAAS,CAAC;AAEvF;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,iCAAiC;IACjC,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAMD;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAIhC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,QAAQ,EAAE;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,KAAK,IAAI,CAAC;AAEX;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAC;IAEjB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB;;OAEG;IACH,kBAAkB,CAAC,EAAE,gCAAgC,CAAC;IAEtD;;OAEG;IACH,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CACrC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAEpC;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,mBAAmB;IACnB,IAAI,EAAE,OAAO,CAAC;IACd,gEAAgE;IAChE,EAAE,EAAE,KAAK,CAAC;IACV,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;IACZ,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,mCAAmC;IACnC,MAAM,EAAE,eAAe,CAAC;IACxB,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,mBAAmB;IACnB,IAAI,EAAE,OAAO,CAAC;IACd,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,MAAM,EAAE,eAAe,CAAC;IACxB,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,IAAI,EAAE,OAAO,CAAC;IACd,mCAAmC;IACnC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,sDAAsD;IACtD,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,2CAA2C;IAC3C,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAChC,yCAAyC;IACzC,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9B,yFAAyF;IACzF,YAAY,EAAE,OAAO,EAAE,CAAC;IACxB,4DAA4D;IAC5D,oBAAoB,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3C,yDAAyD;IACzD,gBAAgB,EAAE,eAAe,EAAE,CAAC;IACpC,iEAAiE;IACjE,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,iDAAiD;IACjD,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,8DAA8D;IAC9D,sBAAsB,EAAE,OAAO,CAAC;IAChC,oDAAoD;IACpD,cAAc,EAAE,OAAO,CAAC;IACxB,yFAAyF;IACzF,qBAAqB,EAAE,OAAO,CAAC;IAC/B;;0DAEsD;IACtD,qBAAqB,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACtC,wCAAwC;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,6BAA6B;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,gCAAgC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,gBAAgB,EAAE,MAAM,CAAC;IACzB,4CAA4C;IAC5C,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,iDAAiD;IACjD,cAAc,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,EAAE,CAAC;IAC7C,yFAAyF;IACzF,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,yCAAyC;IACzC,KAAK,EAAE,kBAAkB,CAAC;CAC3B;AAED;;GAEG;AACH;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,2CAA2C;IAC3C,OAAO,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uCAAuC;IACvC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gFAAgF;IAChF,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,mBAAmB,IAAI,mBAAmB,CAmDzD;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,OAAO,CAAC,mBAAmB,CAAC,GACpC,mBAAmB,CAiCrB"}

package/dist/types/index.js

@@ -0,0 +1,95 @@
+import { PIIType, DEFAULT_TYPE_PRIORITY, SECRET_PII_TYPES } from "./pii-types.js";
+export * from "./pii-types.js";
+/**
+ * Source of entity detection
+ */
+export var DetectionSource;
+(function (DetectionSource) {
+    DetectionSource["REGEX"] = "REGEX";
+    DetectionSource["NER"] = "NER";
+    DetectionSource["HYBRID"] = "HYBRID";
+})(DetectionSource || (DetectionSource = {}));
+/**
+ * Default XML-style tag format: `<PII type="..." id="N"/>`
+ */
+export const DEFAULT_TAG_FORMAT = {
+    open: "<",
+    close: "/>",
+    keyword: "PII",
+};
+export function createDefaultPolicy() {
+    const allTypes = new Set(Object.values(PIIType));
+    // Secret types are opt-in only — exclude from default enabled set
+    const secretTypeSet = new Set(SECRET_PII_TYPES);
+    for (const secretType of secretTypeSet) {
+        allTypes.delete(secretType);
+    }
+    const defaultThresholds = new Map();
+    for (const type of allTypes) {
+        // Higher threshold for NER-detected types (more uncertainty)
+        defaultThresholds.set(type, type === PIIType.PERSON || type === PIIType.ORG ? 0.7 : 0.5);
+    }
+    return {
+        enabledTypes: allTypes,
+        regexEnabledTypes: new Set([
+            PIIType.ADDRESS,
+            PIIType.EMAIL,
+            PIIType.PHONE,
+            PIIType.POSTAL_CODE,
+            PIIType.IBAN,
+            PIIType.BIC_SWIFT,
+            PIIType.CREDIT_CARD,
+            PIIType.IP_ADDRESS,
+            PIIType.URL,
+            PIIType.DATE,
+            PIIType.CASE_ID,
+            PIIType.CUSTOMER_ID,
+        ]),
+        nerEnabledTypes: new Set([
+            PIIType.PERSON,
+            PIIType.ORG,
+            PIIType.LOCATION,
+            PIIType.ADDRESS,
+            PIIType.DATE_OF_BIRTH,
+        ]),
+        typePriority: [...DEFAULT_TYPE_PRIORITY],
+        confidenceThresholds: defaultThresholds,
+        customIdPatterns: [],
+        allowlistTerms: new Set(),
+        denylistPatterns: [],
+        reuseIdsForRepeatedPII: false,
+        enableLeakScan: true,
+        enableSemanticMasking: false,
+        excludeLocationScopes: new Set(),
+    };
+}
+/**
+ * Merges a partial policy with defaults
+ */
+export function mergePolicy(partial) {
+    const defaultPolicy = createDefaultPolicy();
+    // Deep merge confidenceThresholds Map
+    let confidenceThresholds = defaultPolicy.confidenceThresholds;
+    if (partial.confidenceThresholds !== undefined) {
+        confidenceThresholds = new Map(defaultPolicy.confidenceThresholds);
+        // Merge in partial thresholds
+        for (const [type, threshold] of partial.confidenceThresholds) {
+            confidenceThresholds.set(type, threshold);
+        }
+    }
+    return {
+        enabledTypes: partial.enabledTypes ?? defaultPolicy.enabledTypes,
+        regexEnabledTypes: partial.regexEnabledTypes ?? defaultPolicy.regexEnabledTypes,
+        nerEnabledTypes: partial.nerEnabledTypes ?? defaultPolicy.nerEnabledTypes,
+        typePriority: partial.typePriority ?? defaultPolicy.typePriority,
+        confidenceThresholds,
+        customIdPatterns: partial.customIdPatterns ?? defaultPolicy.customIdPatterns,
+        allowlistTerms: partial.allowlistTerms ?? defaultPolicy.allowlistTerms,
+        denylistPatterns: partial.denylistPatterns ?? defaultPolicy.denylistPatterns,
+        reuseIdsForRepeatedPII: partial.reuseIdsForRepeatedPII ?? defaultPolicy.reuseIdsForRepeatedPII,
+        enableLeakScan: partial.enableLeakScan ?? defaultPolicy.enableLeakScan,
+        enableSemanticMasking: partial.enableSemanticMasking ?? defaultPolicy.enableSemanticMasking,
+        excludeLocationScopes: partial.excludeLocationScopes ?? defaultPolicy.excludeLocationScopes,
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElF,cAAc,gBAAgB,CAAC;AAE/B;;GAEG;AACH,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,kCAAe,CAAA;IACf,8BAAW,CAAA;IACX,oCAAiB,CAAA;AACnB,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B;AAyDD;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAc;IAC3C,IAAI,EAAE,GAAG;IACT,KAAK,EAAE,IAAI;IACX,OAAO,EAAE,KAAK;CACf,CAAC;AA+NF,MAAM,UAAU,mBAAmB;IACjC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAc,CAAC,CAAC;IAE9D,kEAAkE;IAClE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAU,gBAAgB,CAAC,CAAC;IACzD,KAAK,MAAM,UAAU,IAAI,aAAa,EAAE,CAAC;QACvC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;IAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAmB,CAAC;IACrD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,6DAA6D;QAC7D,iBAAiB,CAAC,GAAG,CACnB,IAAI,EACJ,IAAI,KAAK,OAAO,CAAC,MAAM,IAAI,IAAI,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAC5D,CAAC;IACJ,CAAC;IAED,OAAO;QACL,YAAY,EAAE,QAAQ;QACtB,iBAAiB,EAAE,IAAI,GAAG,CAAC;YACzB,OAAO,CAAC,OAAO;YACf,OAAO,CAAC,KAAK;YACb,OAAO,CAAC,KAAK;YACb,OAAO,CAAC,WAAW;YACnB,OAAO,CAAC,IAAI;YACZ,OAAO,CAAC,SAAS;YACjB,OAAO,CAAC,WAAW;YACnB,OAAO,CAAC,UAAU;YAClB,OAAO,CAAC,GAAG;YACX,OAAO,CAAC,IAAI;YACZ,OAAO,CAAC,OAAO;YACf,OAAO,CAAC,WAAW;SACpB,CAAC;QACF,eAAe,EAAE,IAAI,GAAG,CAAC;YACvB,OAAO,CAAC,MAAM;YACd,OAAO,CAAC,GAAG;YACX,OAAO,CAAC,QAAQ;YAChB,OAAO,CAAC,OAAO;YACf,OAAO,CAAC,aAAa;SACtB,CAAC;QACF,YAAY,EAAE,CAAC,GAAG,qBAAqB,CAAC;QACxC,oBAAoB,EAAE,iBAAiB;QACvC,gBAAgB,EAAE,EAAE;QACpB,cAAc,EAAE,IAAI,GAAG,EAAE;QACzB,gBAAgB,EAAE,EAAE;QACpB,sBAAsB,EAAE,KAAK;QAC7B,cAAc,EAAE,IAAI;QACpB,qBAAqB,EAAE,KAAK;QAC5B,qBAAqB,EAAE,IAAI,GAAG,EAAE;KACjC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CACzB,OAAqC;IAErC,MAAM,aAAa,GAAG,mBAAmB,EAAE,CAAC;IAE5C,sCAAsC;IACtC,IAAI,oBAAoB,GAAG,aAAa,CAAC,oBAAoB,CAAC;IAC9D,IAAI,OAAO,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;QAC/C,oBAAoB,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC;QACnE,8BAA8B;QAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAC7D,oBAAoB,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,OAAO;QACL,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,aAAa,CAAC,YAAY;QAChE,iBAAiB,EACf,OAAO,CAAC,iBAAiB,IAAI,aAAa,CAAC,iBAAiB;QAC9D,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,aAAa,CAAC,eAAe;QACzE,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,aAAa,CAAC,YAAY;QAChE,oBAAoB;QACpB,gBAAgB,EACd,OAAO,CAAC,gBAAgB,IAAI,aAAa,CAAC,gBAAgB;QAC5D,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,aAAa,CAAC,cAAc;QACtE,gBAAgB,EACd,OAAO,CAAC,gBAAgB,IAAI,aAAa,CAAC,gBAAgB;QAC5D,sBAAsB,EACpB,OAAO,CAAC,sBAAsB,IAAI,aAAa,CAAC,sBAAsB;QACxE,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,aAAa,CAAC,cAAc;QACtE,qBAAqB,EACnB,OAAO,CAAC,qBAAqB,IAAI,aAAa,CAAC,qBAAqB;QACtE,qBAAqB,EACnB,OAAO,CAAC,qBAAqB,IAAI,aAAa,CAAC,qBAAqB;KACvE,CAAC;AACJ,CAAC"}

package/dist/types/pii-types.d.ts

@@ -0,0 +1,64 @@
+/**
+ * PII Type Enumeration
+ * Defines all supported PII categories for detection and anonymization
+ */
+export declare enum PIIType {
+    PERSON = "PERSON",
+    ORG = "ORG",
+    LOCATION = "LOCATION",
+    ADDRESS = "ADDRESS",
+    POSTAL_CODE = "POSTAL_CODE",
+    EMAIL = "EMAIL",
+    PHONE = "PHONE",
+    GITHUB_USERNAME = "GITHUB_USERNAME",
+    URL = "URL",
+    IP_ADDRESS = "IP_ADDRESS",
+    IBAN = "IBAN",
+    BIC_SWIFT = "BIC_SWIFT",
+    ACCOUNT_NUMBER = "ACCOUNT_NUMBER",
+    CREDIT_CARD = "CREDIT_CARD",
+    DATE = "DATE",
+    TAX_ID = "TAX_ID",
+    NATIONAL_ID = "NATIONAL_ID",
+    DATE_OF_BIRTH = "DATE_OF_BIRTH",
+    CASE_ID = "CASE_ID",
+    CUSTOMER_ID = "CUSTOMER_ID",
+    API_KEY = "API_KEY",
+    PRIVATE_KEY = "PRIVATE_KEY",
+    JWT = "JWT",
+    CONNECTION_STRING = "CONNECTION_STRING",
+    AWS_CREDENTIALS = "AWS_CREDENTIALS",
+    ENV_VAR_SECRET = "ENV_VAR_SECRET",
+    CONFIG_SECRET = "CONFIG_SECRET"
+}
+/**
+ * All PII types as a readonly array for iteration
+ */
+export declare const ALL_PII_TYPES: readonly PIIType[];
+/**
+ * PII types that are detected via regex (structured PII)
+ */
+export declare const REGEX_PII_TYPES: readonly PIIType[];
+/**
+ * PII types that are secrets/credentials (opt-in, regex-based)
+ */
+export declare const SECRET_PII_TYPES: readonly PIIType[];
+/**
+ * PII types that are detected via NER model (soft PII)
+ */
+export declare const NER_PII_TYPES: readonly PIIType[];
+/**
+ * Default priority order for resolving overlapping entities
+ * Higher index = higher priority
+ */
+export declare const DEFAULT_TYPE_PRIORITY: readonly PIIType[];
+/**
+ * Maps NER model labels to PIIType
+ * Common label formats from NER models (B-PER, I-PER, B-ORG, etc.)
+ */
+export declare const NER_LABEL_TO_PII_TYPE: Record<string, PIIType>;
+/**
+ * Get PIIType from NER label (handles B-/I- prefixes)
+ */
+export declare function getPIITypeFromNERLabel(label: string): PIIType | null;
+//# sourceMappingURL=pii-types.d.ts.map

package/dist/types/pii-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-types.d.ts","sourceRoot":"","sources":["../../src/types/pii-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,oBAAY,OAAO;IAEjB,MAAM,WAAW;IACjB,GAAG,QAAQ;IACX,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,WAAW,gBAAgB;IAG3B,KAAK,UAAU;IACf,KAAK,UAAU;IACf,eAAe,oBAAoB;IACnC,GAAG,QAAQ;IACX,UAAU,eAAe;IAGzB,IAAI,SAAS;IACb,SAAS,cAAc;IACvB,cAAc,mBAAmB;IACjC,WAAW,gBAAgB;IAG3B,IAAI,SAAS;IAGb,MAAM,WAAW;IACjB,WAAW,gBAAgB;IAC3B,aAAa,kBAAkB;IAG/B,OAAO,YAAY;IACnB,WAAW,gBAAgB;IAG3B,OAAO,YAAY;IACnB,WAAW,gBAAgB;IAC3B,GAAG,QAAQ;IACX,iBAAiB,sBAAsB;IACvC,eAAe,oBAAoB;IACnC,cAAc,mBAAmB;IACjC,aAAa,kBAAkB;CAChC;AAED;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,OAAO,EAAwC,CAAC;AAErF;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,OAAO,EAiB7C,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,OAAO,EAQ9C,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,OAAO,EAM3C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,OAAO,EAgCnD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAWzD,CAAC;AAEF;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CASpE"}