opencode-rehydra-core 0.14.0

package/dist/recognizers/secrets/index.js

@@ -0,0 +1,41 @@
+/**
+ * Secret Recognizers Module
+ * Exports all secret/credential recognizers
+ */
+import { apiKeyRecognizer } from "./api-key.js";
+import { privateKeyRecognizer } from "./private-key.js";
+import { jwtRecognizer } from "./jwt.js";
+import { connectionStringRecognizer } from "./connection-string.js";
+import { awsCredentialsRecognizer } from "./aws-credentials.js";
+import { envVarSecretRecognizer, createEnvVarSecretRecognizer } from "./env-var.js";
+import { configSecretRecognizer, createConfigSecretRecognizer } from "./config-secret.js";
+export { apiKeyRecognizer } from "./api-key.js";
+export { privateKeyRecognizer } from "./private-key.js";
+export { jwtRecognizer } from "./jwt.js";
+export { connectionStringRecognizer } from "./connection-string.js";
+export { awsCredentialsRecognizer } from "./aws-credentials.js";
+export { envVarSecretRecognizer, createEnvVarSecretRecognizer } from "./env-var.js";
+export { configSecretRecognizer, createConfigSecretRecognizer } from "./config-secret.js";
+export { createLiteralValueRecognizer } from "./literal-value.js";
+export { isSecretKeyName } from "./key-patterns.js";
+/**
+ * Creates all secret recognizers
+ */
+export function createSecretRecognizers(options) {
+    const hasCustomOptions = (options?.secretKeyPatterns !== undefined && options.secretKeyPatterns.length > 0) ||
+        options?.minValueLength !== undefined;
+    return [
+        apiKeyRecognizer,
+        privateKeyRecognizer,
+        jwtRecognizer,
+        connectionStringRecognizer,
+        awsCredentialsRecognizer,
+        hasCustomOptions
+            ? createEnvVarSecretRecognizer(options?.minValueLength, options?.secretKeyPatterns)
+            : envVarSecretRecognizer,
+        hasCustomOptions
+            ? createConfigSecretRecognizer(options?.minValueLength, options?.secretKeyPatterns)
+            : configSecretRecognizer,
+    ];
+}
+//# sourceMappingURL=index.js.map

package/dist/recognizers/secrets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/recognizers/secrets/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAE1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAGvC;IACC,MAAM,gBAAgB,GACpB,CAAC,OAAO,EAAE,iBAAiB,KAAK,SAAS,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC;QAClF,OAAO,EAAE,cAAc,KAAK,SAAS,CAAC;IAExC,OAAO;QACL,gBAAgB;QAChB,oBAAoB;QACpB,aAAa;QACb,0BAA0B;QAC1B,wBAAwB;QACxB,gBAAgB;YACd,CAAC,CAAC,4BAA4B,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,CAAC;YACnF,CAAC,CAAC,sBAAsB;QAC1B,gBAAgB;YACd,CAAC,CAAC,4BAA4B,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,CAAC;YACnF,CAAC,CAAC,sBAAsB;KAC3B,CAAC;AACJ,CAAC"}

package/dist/recognizers/secrets/jwt.d.ts

@@ -0,0 +1,6 @@
+/**
+ * JWT Recognizer
+ * Detects JSON Web Tokens (three base64url dot-separated segments)
+ */
+export declare const jwtRecognizer: import("../base.js").Recognizer;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/recognizers/secrets/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/recognizers/secrets/jwt.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAoBH,eAAO,MAAM,aAAa,iCAuBxB,CAAC"}

package/dist/recognizers/secrets/jwt.js

@@ -0,0 +1,47 @@
+/**
+ * JWT Recognizer
+ * Detects JSON Web Tokens (three base64url dot-separated segments)
+ */
+import { createRegexRecognizer } from "../base.js";
+import { PIIType } from "../../types/index.js";
+/**
+ * Decode base64url to string (no padding required)
+ */
+function base64urlDecode(str) {
+    try {
+        // Replace base64url chars with standard base64
+        const base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+        // Add padding if needed
+        const padded = base64 + "=".repeat((4 - (base64.length % 4)) % 4);
+        return atob(padded);
+    }
+    catch {
+        return null;
+    }
+}
+export const jwtRecognizer = createRegexRecognizer({
+    type: PIIType.JWT,
+    name: "JWT",
+    defaultConfidence: 0.95,
+    patterns: [
+        // JWT: eyJ header prefix, three base64url segments separated by dots
+        /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g,
+    ],
+    validate(match) {
+        const parts = match.split(".");
+        if (parts.length !== 3)
+            return false;
+        // Decode header and verify it has an "alg" field
+        const header = base64urlDecode(parts[0]);
+        if (header === null)
+            return false;
+        try {
+            const parsed = JSON.parse(header);
+            return typeof parsed.alg === "string";
+        }
+        catch {
+            return false;
+        }
+    },
+});
+//# sourceMappingURL=jwt.js.map

package/dist/recognizers/secrets/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../src/recognizers/secrets/jwt.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAE/C;;GAEG;AACH,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,CAAC;QACH,+CAA+C;QAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,wBAAwB;QACxB,MAAM,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,qBAAqB,CAAC;IACjD,IAAI,EAAE,OAAO,CAAC,GAAG;IACjB,IAAI,EAAE,KAAK;IACX,iBAAiB,EAAE,IAAI;IACvB,QAAQ,EAAE;QACR,qEAAqE;QACrE,oEAAoE;KACrE;IACD,QAAQ,CAAC,KAAa;QACpB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAErC,iDAAiD;QACjD,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAElC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAA4B,CAAC;YAC7D,OAAO,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF,CAAC,CAAC"}

package/dist/recognizers/secrets/key-patterns.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Shared secret key name patterns
+ * Used by ENV_VAR_SECRET and CONFIG_SECRET recognizers
+ */
+/**
+ * Checks if a key/variable name suggests it holds a secret value.
+ * Handles snake_case, camelCase, and kebab-case.
+ */
+export declare function isSecretKeyName(key: string): boolean;
+//# sourceMappingURL=key-patterns.d.ts.map

package/dist/recognizers/secrets/key-patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-patterns.d.ts","sourceRoot":"","sources":["../../../src/recognizers/secrets/key-patterns.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAIpD"}

package/dist/recognizers/secrets/key-patterns.js

@@ -0,0 +1,15 @@
+/**
+ * Shared secret key name patterns
+ * Used by ENV_VAR_SECRET and CONFIG_SECRET recognizers
+ */
+const SECRET_KEY_PATTERN = /^(?:.*_)?(?:password|passwd|pwd|pass|secret|secret_key|secretkey|token|access_token|refresh_token|auth_token|api_key|apikey|api_secret|private_key|privatekey|credential|credentials|connection_string|connectionstring|database_url|dsn|encryption_key|signing_key|client_secret|app_secret|master_key|auth|bearer|jwt|api_token)(?:_.*)?$/i;
+/**
+ * Checks if a key/variable name suggests it holds a secret value.
+ * Handles snake_case, camelCase, and kebab-case.
+ */
+export function isSecretKeyName(key) {
+    // Normalize camelCase/PascalCase to snake_case for matching
+    const normalized = key.replace(/([a-z])([A-Z])/g, "$1_$2").replace(/-/g, "_");
+    return SECRET_KEY_PATTERN.test(normalized);
+}
+//# sourceMappingURL=key-patterns.js.map

package/dist/recognizers/secrets/key-patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-patterns.js","sourceRoot":"","sources":["../../../src/recognizers/secrets/key-patterns.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,kBAAkB,GAAG,8UAA8U,CAAC;AAE1W;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,4DAA4D;IAC5D,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9E,OAAO,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAC7C,CAAC"}

package/dist/recognizers/secrets/literal-value.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Literal Value Recognizer
+ * Scans for exact occurrences of known secret values (e.g., from .env files)
+ */
+import type { Recognizer } from "../base.js";
+/**
+ * Creates a recognizer that matches exact known secret values in text.
+ */
+export declare function createLiteralValueRecognizer(values: string[], minLength?: number): Recognizer;
+//# sourceMappingURL=literal-value.d.ts.map

package/dist/recognizers/secrets/literal-value.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"literal-value.d.ts","sourceRoot":"","sources":["../../../src/recognizers/secrets/literal-value.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAU7C;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,MAAM,EAAE,EAChB,SAAS,GAAE,MAAU,GACpB,UAAU,CAuCZ"}

package/dist/recognizers/secrets/literal-value.js

@@ -0,0 +1,48 @@
+/**
+ * Literal Value Recognizer
+ * Scans for exact occurrences of known secret values (e.g., from .env files)
+ */
+import { PIIType, DetectionSource } from "../../types/index.js";
+const COMMON_NON_SECRET_VALUES = new Set([
+    "true", "false", "yes", "no", "on", "off",
+    "null", "undefined", "none",
+    "0", "1", "localhost", "127.0.0.1", "0.0.0.0",
+    "development", "production", "staging", "test",
+    "utf-8", "utf8", "ascii",
+]);
+/**
+ * Creates a recognizer that matches exact known secret values in text.
+ */
+export function createLiteralValueRecognizer(values, minLength = 4) {
+    // Filter out short and common values
+    const secretValues = values.filter((v) => v.length >= minLength && !COMMON_NON_SECRET_VALUES.has(v.toLowerCase()));
+    // Sort by length descending so longer matches are found first
+    secretValues.sort((a, b) => b.length - a.length);
+    return {
+        type: PIIType.ENV_VAR_SECRET,
+        name: "Literal Secret Value",
+        defaultConfidence: 1.0,
+        find(text) {
+            const matches = [];
+            for (const value of secretValues) {
+                let start = 0;
+                while (start < text.length) {
+                    const idx = text.indexOf(value, start);
+                    if (idx === -1)
+                        break;
+                    matches.push({
+                        type: PIIType.ENV_VAR_SECRET,
+                        start: idx,
+                        end: idx + value.length,
+                        confidence: 1.0,
+                        source: DetectionSource.REGEX,
+                        text: value,
+                    });
+                    start = idx + value.length;
+                }
+            }
+            return matches;
+        },
+    };
+}
+//# sourceMappingURL=literal-value.js.map

package/dist/recognizers/secrets/literal-value.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"literal-value.js","sourceRoot":"","sources":["../../../src/recognizers/secrets/literal-value.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAkB,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAGhF,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK;IACzC,MAAM,EAAE,WAAW,EAAE,MAAM;IAC3B,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS;IAC7C,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM;IAC9C,OAAO,EAAE,MAAM,EAAE,OAAO;CACzB,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAgB,EAChB,YAAoB,CAAC;IAErB,qCAAqC;IACrC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,SAAS,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAC/E,CAAC;IAEF,8DAA8D;IAC9D,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAEjD,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,cAAc;QAC5B,IAAI,EAAE,sBAAsB;QAC5B,iBAAiB,EAAE,GAAG;QAEtB,IAAI,CAAC,IAAY;YACf,MAAM,OAAO,GAAgB,EAAE,CAAC;YAEhC,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;gBACjC,IAAI,KAAK,GAAG,CAAC,CAAC;gBACd,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;oBAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;oBACvC,IAAI,GAAG,KAAK,CAAC,CAAC;wBAAE,MAAM;oBAEtB,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,OAAO,CAAC,cAAc;wBAC5B,KAAK,EAAE,GAAG;wBACV,GAAG,EAAE,GAAG,GAAG,KAAK,CAAC,MAAM;wBACvB,UAAU,EAAE,GAAG;wBACf,MAAM,EAAE,eAAe,CAAC,KAAK;wBAC7B,IAAI,EAAE,KAAK;qBACZ,CAAC,CAAC;oBAEH,KAAK,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;gBAC7B,CAAC;YACH,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/recognizers/secrets/private-key.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Private Key Recognizer
+ * Detects PEM-encoded private keys
+ */
+export declare const privateKeyRecognizer: import("../base.js").Recognizer;
+//# sourceMappingURL=private-key.d.ts.map

package/dist/recognizers/secrets/private-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-key.d.ts","sourceRoot":"","sources":["../../../src/recognizers/secrets/private-key.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,eAAO,MAAM,oBAAoB,iCAQ/B,CAAC"}

package/dist/recognizers/secrets/private-key.js

@@ -0,0 +1,16 @@
+/**
+ * Private Key Recognizer
+ * Detects PEM-encoded private keys
+ */
+import { createRegexRecognizer } from "../base.js";
+import { PIIType } from "../../types/index.js";
+export const privateKeyRecognizer = createRegexRecognizer({
+    type: PIIType.PRIVATE_KEY,
+    name: "Private Key",
+    defaultConfidence: 0.99,
+    patterns: [
+        // Full PEM block (multiline)
+        /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY-----/g,
+    ],
+});
+//# sourceMappingURL=private-key.js.map

package/dist/recognizers/secrets/private-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-key.js","sourceRoot":"","sources":["../../../src/recognizers/secrets/private-key.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAE/C,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;IACxD,IAAI,EAAE,OAAO,CAAC,WAAW;IACzB,IAAI,EAAE,aAAa;IACnB,iBAAiB,EAAE,IAAI;IACvB,QAAQ,EAAE;QACR,6BAA6B;QAC7B,qJAAqJ;KACtJ;CACF,CAAC,CAAC"}

package/dist/recognizers/url.d.ts

@@ -0,0 +1,14 @@
+/**
+ * URL Recognizer
+ * Detects URLs with various protocols
+ */
+import type { Recognizer } from './base.js';
+/**
+ * URL recognizer
+ */
+export declare const urlRecognizer: Recognizer;
+/**
+ * Extracts the domain from a URL
+ */
+export declare function extractDomain(url: string): string | null;
+//# sourceMappingURL=url.d.ts.map

package/dist/recognizers/url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../../src/recognizers/url.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAoB5C;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UA6D3B,CAAC;AA4BF;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBxD"}

package/dist/recognizers/url.js

@@ -0,0 +1,121 @@
+/**
+ * URL Recognizer
+ * Detects URLs with various protocols
+ */
+import { PIIType, DetectionSource } from '../types/index.js';
+/**
+ * URL pattern - matches common URL formats
+ * Supports: http, https, ftp, mailto, file protocols
+ */
+const URL_PATTERN = /\b(?:https?|ftp|file):\/\/[-A-Za-z0-9+&@#/%?=~_|!:,.;]*[-A-Za-z0-9+&@#/%=~_|]/g;
+/**
+ * Pattern for URLs without explicit protocol (www.)
+ */
+const WWW_PATTERN = /\bwww\.[-A-Za-z0-9+&@#/%?=~_|!:,.;]*[-A-Za-z0-9+&@#/%=~_|]/g;
+/**
+ * Pattern for mailto: URLs
+ */
+const MAILTO_PATTERN = /\bmailto:[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
+/**
+ * URL recognizer
+ */
+export const urlRecognizer = {
+    type: PIIType.URL,
+    name: 'URL',
+    defaultConfidence: 0.92,
+    find(text) {
+        const matches = [];
+        const seen = new Set();
+        const patterns = [URL_PATTERN, WWW_PATTERN, MAILTO_PATTERN];
+        for (const pattern of patterns) {
+            const globalPattern = new RegExp(pattern.source, 'g');
+            for (const match of text.matchAll(globalPattern)) {
+                if (match.index === undefined)
+                    continue;
+                const url = match[0];
+                const key = `${match.index}:${match.index + url.length}`;
+                if (seen.has(key))
+                    continue;
+                if (!this.validate(url))
+                    continue;
+                seen.add(key);
+                matches.push({
+                    type: PIIType.URL,
+                    start: match.index,
+                    end: match.index + url.length,
+                    confidence: this.defaultConfidence,
+                    source: DetectionSource.REGEX,
+                    text: url,
+                });
+            }
+        }
+        // Remove overlapping matches (www. might be substring of http://www.)
+        return deduplicateOverlapping(matches);
+    },
+    validate(url) {
+        // Basic length check
+        if (url.length < 5)
+            return false;
+        // Should have at least one dot after the protocol
+        const withoutProtocol = url.replace(/^(?:https?|ftp|file|mailto):\/\/?/, '');
+        if (!withoutProtocol.includes('.'))
+            return false;
+        // TLD should be at least 2 characters
+        const parts = withoutProtocol.split('.');
+        const tld = parts[parts.length - 1];
+        if (tld === undefined)
+            return false;
+        // Remove any path/query from TLD
+        const cleanTld = tld.split(/[/?#]/)[0];
+        if (cleanTld === undefined || cleanTld.length < 2)
+            return false;
+        return true;
+    },
+    normalize(url) {
+        return url.trim();
+    },
+};
+/**
+ * Remove overlapping matches
+ */
+function deduplicateOverlapping(matches) {
+    if (matches.length <= 1)
+        return matches;
+    const sorted = [...matches].sort((a, b) => a.start - b.start);
+    const result = [];
+    for (const match of sorted) {
+        const last = result[result.length - 1];
+        if (last !== undefined && match.start < last.end) {
+            // Overlapping - keep the longer one
+            if (match.end > last.end) {
+                result.pop();
+                result.push(match);
+            }
+        }
+        else {
+            result.push(match);
+        }
+    }
+    return result;
+}
+/**
+ * Extracts the domain from a URL
+ */
+export function extractDomain(url) {
+    try {
+        // Add protocol if missing for URL parsing
+        let normalizedUrl = url;
+        if (url.startsWith('www.')) {
+            normalizedUrl = 'https://' + url;
+        }
+        if (!normalizedUrl.includes('://')) {
+            normalizedUrl = 'https://' + normalizedUrl;
+        }
+        const parsed = new URL(normalizedUrl);
+        return parsed.hostname;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=url.js.map

package/dist/recognizers/url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.js","sourceRoot":"","sources":["../../src/recognizers/url.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAa,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGxE;;;GAGG;AACH,MAAM,WAAW,GACf,gFAAgF,CAAC;AAEnF;;GAEG;AACH,MAAM,WAAW,GAAG,6DAA6D,CAAC;AAElF;;GAEG;AACH,MAAM,cAAc,GAClB,0DAA0D,CAAC;AAE7D;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAe;IACvC,IAAI,EAAE,OAAO,CAAC,GAAG;IACjB,IAAI,EAAE,KAAK;IACX,iBAAiB,EAAE,IAAI;IAEvB,IAAI,CAAC,IAAY;QACf,MAAM,OAAO,GAAgB,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAE/B,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;QAE5D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAEtD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBACjD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;oBAAE,SAAS;gBAExC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACrB,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;gBAEzD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC5B,IAAI,CAAC,IAAI,CAAC,QAAS,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAEnC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,OAAO,CAAC,GAAG;oBACjB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,GAAG,EAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM;oBAC7B,UAAU,EAAE,IAAI,CAAC,iBAAiB;oBAClC,MAAM,EAAE,eAAe,CAAC,KAAK;oBAC7B,IAAI,EAAE,GAAG;iBACV,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,qBAAqB;QACrB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAEjC,kDAAkD;QAClD,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAEjD,sCAAsC;QACtC,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACpC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACpC,iCAAiC;QACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAEhE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,CAAC,GAAW;QACnB,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;CACF,CAAC;AAEF;;GAEG;AACH,SAAS,sBAAsB,CAAC,OAAoB;IAClD,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC;IAExC,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAgB,EAAE,CAAC;IAE/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEvC,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACjD,oCAAoC;YACpC,IAAI,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACzB,MAAM,CAAC,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,0CAA0C;QAC1C,IAAI,aAAa,GAAG,GAAG,CAAC;QACxB,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,aAAa,GAAG,UAAU,GAAG,GAAG,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,aAAa,GAAG,UAAU,GAAG,aAAa,CAAC;QAC7C,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;QACtC,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/storage/browser.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Browser-Safe PII Storage Module
+ * Provides storage providers for persisting encrypted PII maps (browser-only)
+ *
+ * This module excludes SQLitePIIStorageProvider which requires Node.js dependencies.
+ * For SQLite support, use the main storage module or import from 'rehydra/storage/sqlite'.
+ */
+export type { PIIStorageProvider, PIIMapMetadata, StoredPIIMap, ListOptions, AnonymizerSession, } from "./types.js";
+export type { EncryptedPIIMap } from "../types/index.js";
+export { InMemoryPIIStorageProvider } from "./in-memory.js";
+export { IndexedDBPIIStorageProvider } from "./indexeddb.js";
+export { AnonymizerSessionImpl } from "./session-base.js";
+//# sourceMappingURL=browser.d.ts.map

package/dist/storage/browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/storage/browser.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,WAAW,EACX,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAGpB,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGzD,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAG7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/storage/browser.js

@@ -0,0 +1,13 @@
+/**
+ * Browser-Safe PII Storage Module
+ * Provides storage providers for persisting encrypted PII maps (browser-only)
+ *
+ * This module excludes SQLitePIIStorageProvider which requires Node.js dependencies.
+ * For SQLite support, use the main storage module or import from 'rehydra/storage/sqlite'.
+ */
+// Export browser-compatible implementations only
+export { InMemoryPIIStorageProvider } from "./in-memory.js";
+export { IndexedDBPIIStorageProvider } from "./indexeddb.js";
+// Export session implementation (browser-safe, without streaming support)
+export { AnonymizerSessionImpl } from "./session-base.js";
+//# sourceMappingURL=browser.js.map

package/dist/storage/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../../src/storage/browser.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAcH,iDAAiD;AACjD,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAE7D,0EAA0E;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/storage/in-memory.d.ts

@@ -0,0 +1,60 @@
+/**
+ * In-Memory PII Storage Provider
+ * Simple Map-based implementation for development and testing
+ */
+import type { EncryptedPIIMap } from "../types/index.js";
+import type { PIIStorageProvider, PIIMapMetadata, StoredPIIMap, ListOptions } from "./types.js";
+/**
+ * In-memory implementation of PIIStorageProvider
+ *
+ * Uses a Map for storage - data is lost when the process exits.
+ * Ideal for development, testing, and short-lived sessions.
+ *
+ * @example
+ * ```typescript
+ * const storage = new InMemoryPIIStorageProvider();
+ *
+ * await storage.save('conv-123', encryptedPiiMap, {
+ *   createdAt: Date.now(),
+ *   entityCounts: { PERSON: 2 }
+ * });
+ *
+ * const stored = await storage.load('conv-123');
+ * ```
+ */
+export declare class InMemoryPIIStorageProvider implements PIIStorageProvider {
+    private storage;
+    /**
+     * Save an encrypted PII map
+     */
+    save(conversationId: string, piiMap: EncryptedPIIMap, metadata?: Partial<PIIMapMetadata>): Promise<void>;
+    /**
+     * Load an encrypted PII map
+     */
+    load(conversationId: string): Promise<StoredPIIMap | null>;
+    /**
+     * Delete a PII map
+     */
+    delete(conversationId: string): Promise<boolean>;
+    /**
+     * Check if a PII map exists
+     */
+    exists(conversationId: string): Promise<boolean>;
+    /**
+     * List stored conversation IDs
+     */
+    list(options?: ListOptions): Promise<string[]>;
+    /**
+     * Delete entries older than the specified date
+     */
+    cleanup(olderThan: Date): Promise<number>;
+    /**
+     * Clear all stored data (useful for testing)
+     */
+    clear(): void;
+    /**
+     * Get the number of stored entries (useful for testing)
+     */
+    get size(): number;
+}
+//# sourceMappingURL=in-memory.d.ts.map

package/dist/storage/in-memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory.d.ts","sourceRoot":"","sources":["../../src/storage/in-memory.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EACV,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,WAAW,EACZ,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,0BAA2B,YAAW,kBAAkB;IACnE,OAAO,CAAC,OAAO,CAAwC;IAEvD;;OAEG;IACH,IAAI,CACF,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,eAAe,EACvB,QAAQ,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GACjC,OAAO,CAAC,IAAI,CAAC;IAmBhB;;OAEG;IACH,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAI1D;;OAEG;IACH,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIhD;;OAEG;IACH,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIhD;;OAEG;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAuB9C;;OAEG;IACH,OAAO,CAAC,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IAczC;;OAEG;IACH,KAAK,IAAI,IAAI;IAIb;;OAEG;IACH,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}

package/dist/storage/in-memory.js

@@ -0,0 +1,108 @@
+/**
+ * In-Memory PII Storage Provider
+ * Simple Map-based implementation for development and testing
+ */
+/**
+ * In-memory implementation of PIIStorageProvider
+ *
+ * Uses a Map for storage - data is lost when the process exits.
+ * Ideal for development, testing, and short-lived sessions.
+ *
+ * @example
+ * ```typescript
+ * const storage = new InMemoryPIIStorageProvider();
+ *
+ * await storage.save('conv-123', encryptedPiiMap, {
+ *   createdAt: Date.now(),
+ *   entityCounts: { PERSON: 2 }
+ * });
+ *
+ * const stored = await storage.load('conv-123');
+ * ```
+ */
+export class InMemoryPIIStorageProvider {
+    storage = new Map();
+    /**
+     * Save an encrypted PII map
+     */
+    save(conversationId, piiMap, metadata) {
+        const now = Date.now();
+        const existing = this.storage.get(conversationId);
+        const fullMetadata = {
+            createdAt: existing?.metadata.createdAt ?? metadata?.createdAt ?? now,
+            updatedAt: now,
+            entityCounts: metadata?.entityCounts ?? existing?.metadata.entityCounts ?? {},
+            modelVersion: metadata?.modelVersion ?? existing?.metadata.modelVersion,
+        };
+        this.storage.set(conversationId, {
+            piiMap,
+            metadata: fullMetadata,
+        });
+        return Promise.resolve();
+    }
+    /**
+     * Load an encrypted PII map
+     */
+    load(conversationId) {
+        return Promise.resolve(this.storage.get(conversationId) ?? null);
+    }
+    /**
+     * Delete a PII map
+     */
+    delete(conversationId) {
+        return Promise.resolve(this.storage.delete(conversationId));
+    }
+    /**
+     * Check if a PII map exists
+     */
+    exists(conversationId) {
+        return Promise.resolve(this.storage.has(conversationId));
+    }
+    /**
+     * List stored conversation IDs
+     */
+    list(options) {
+        let entries = Array.from(this.storage.entries());
+        // Filter by olderThan if specified
+        if (options?.olderThan !== undefined) {
+            const cutoff = options.olderThan.getTime();
+            entries = entries.filter(([, stored]) => stored.metadata.createdAt < cutoff);
+        }
+        // Sort by createdAt descending (most recent first)
+        entries.sort((a, b) => b[1].metadata.createdAt - a[1].metadata.createdAt);
+        // Extract conversation IDs
+        let ids = entries.map(([id]) => id);
+        // Apply limit if specified
+        if (options?.limit !== undefined && options.limit > 0) {
+            ids = ids.slice(0, options.limit);
+        }
+        return Promise.resolve(ids);
+    }
+    /**
+     * Delete entries older than the specified date
+     */
+    cleanup(olderThan) {
+        const cutoff = olderThan.getTime();
+        let deleted = 0;
+        for (const [id, stored] of this.storage.entries()) {
+            if (stored.metadata.createdAt < cutoff) {
+                this.storage.delete(id);
+                deleted++;
+            }
+        }
+        return Promise.resolve(deleted);
+    }
+    /**
+     * Clear all stored data (useful for testing)
+     */
+    clear() {
+        this.storage.clear();
+    }
+    /**
+     * Get the number of stored entries (useful for testing)
+     */
+    get size() {
+        return this.storage.size;
+    }
+}
+//# sourceMappingURL=in-memory.js.map

package/dist/storage/in-memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory.js","sourceRoot":"","sources":["../../src/storage/in-memory.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAUH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,0BAA0B;IAC7B,OAAO,GAA8B,IAAI,GAAG,EAAE,CAAC;IAEvD;;OAEG;IACH,IAAI,CACF,cAAsB,EACtB,MAAuB,EACvB,QAAkC;QAElC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAElD,MAAM,YAAY,GAAmB;YACnC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,SAAS,IAAI,QAAQ,EAAE,SAAS,IAAI,GAAG;YACrE,SAAS,EAAE,GAAG;YACd,YAAY,EAAE,QAAQ,EAAE,YAAY,IAAI,QAAQ,EAAE,QAAQ,CAAC,YAAY,IAAI,EAAE;YAC7E,YAAY,EAAE,QAAQ,EAAE,YAAY,IAAI,QAAQ,EAAE,QAAQ,CAAC,YAAY;SACxE,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE;YAC/B,MAAM;YACN,QAAQ,EAAE,YAAY;SACvB,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,cAAsB;QACzB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,cAAsB;QAC3B,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,cAAsB;QAC3B,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,OAAqB;QACxB,IAAI,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAEjD,mCAAmC;QACnC,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAC3C,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC;QAC/E,CAAC;QAED,mDAAmD;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAE1E,2BAA2B;QAC3B,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAEpC,2BAA2B;QAC3B,IAAI,OAAO,EAAE,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACtD,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,SAAe;QACrB,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,OAAO,GAAG,CAAC,CAAC;QAEhB,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YAClD,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC;gBACvC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;CACF"}

package/dist/storage/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * PII Storage Module
+ * Provides storage providers for persisting encrypted PII maps
+ */
+export type { PIIStorageProvider, PIIMapMetadata, StoredPIIMap, ListOptions, AnonymizerSession, } from "./types.js";
+export type { EncryptedPIIMap } from "../types/index.js";
+export { InMemoryPIIStorageProvider } from "./in-memory.js";
+export { SQLitePIIStorageProvider } from "./sqlite.js";
+export { IndexedDBPIIStorageProvider } from "./indexeddb.js";
+export { AnonymizerSessionImpl } from "./session.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/storage/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,WAAW,EACX,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAGpB,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGzD,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAG7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC"}

package/dist/storage/index.js

@@ -0,0 +1,11 @@
+/**
+ * PII Storage Module
+ * Provides storage providers for persisting encrypted PII maps
+ */
+// Export implementations
+export { InMemoryPIIStorageProvider } from "./in-memory.js";
+export { SQLitePIIStorageProvider } from "./sqlite.js";
+export { IndexedDBPIIStorageProvider } from "./indexeddb.js";
+// Export session implementation
+export { AnonymizerSessionImpl } from "./session.js";
+//# sourceMappingURL=index.js.map