redact0 1.0.0__py3-none-any.whl

redact0/__init__.py

@@ -0,0 +1,51 @@
+from .rules import BUILTIN_RULES, DetectorRule
+from .validators import (
+    is_valid_aadhaar,
+    is_valid_de_tax_id,
+    is_valid_dea,
+    is_valid_iban,
+    is_valid_ipv4,
+    is_valid_jwt,
+    is_valid_luhn,
+    is_valid_mbi,
+    is_valid_nhs,
+    is_valid_npi,
+    is_valid_ssn,
+    shannon_entropy,
+)
+from .vault import (
+    Finding,
+    StreamRestorer,
+    Vault,
+    create_vault,
+    redact,
+    redact_detailed,
+    redact_fhir,
+    scan,
+)
+
+__all__ = [
+    "BUILTIN_RULES",
+    "DetectorRule",
+    "Finding",
+    "StreamRestorer",
+    "Vault",
+    "create_vault",
+    "is_valid_aadhaar",
+    "is_valid_de_tax_id",
+    "is_valid_dea",
+    "is_valid_iban",
+    "is_valid_ipv4",
+    "is_valid_jwt",
+    "is_valid_luhn",
+    "is_valid_mbi",
+    "is_valid_nhs",
+    "is_valid_npi",
+    "is_valid_ssn",
+    "redact",
+    "redact_detailed",
+    "redact_fhir",
+    "scan",
+    "shannon_entropy",
+]
+__version__ = "1.0.0"

redact0/cli.py

@@ -0,0 +1,28 @@
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+
+from .vault import redact_detailed, scan
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(prog="redact0", description="0-dep reversible PII & secret redactor")
+    parser.add_argument("--preset", default="default", choices=["default", "secrets", "hipaa", "gdpr", "strict"])
+    parser.add_argument("--scan", action="store_true", help="Output findings metadata as JSON without raw values")
+    args = parser.parse_args(argv)
+
+    text = sys.stdin.read()
+    if args.scan:
+        findings = [f.__dict__ for f in scan(text, preset=args.preset)]
+        print(json.dumps(findings, indent=2))
+        return 1 if findings else 0
+
+    res = redact_detailed(text, preset=args.preset)
+    sys.stdout.write(res.value)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

redact0/compat/__init__.py

@@ -0,0 +1,3 @@
+from .llm_guard import Anonymize, Deanonymize, Sensitive, Vault, scan_output, scan_prompt
+
+__all__ = ["Anonymize", "Deanonymize", "Sensitive", "Vault", "scan_output", "scan_prompt"]

redact0/compat/llm_guard.py

@@ -0,0 +1,70 @@
+"""
+Drop-in zero-dependency compatibility layer for archived `llm-guard` (Protect AI).
+Replaces Anonymize / Deanonymize / Sensitive / Vault / scan_prompt / scan_output
+without PyTorch, spaCy, or presidio-anonymizer.
+"""
+from __future__ import annotations
+
+from typing import Any
+
+from ..vault import Vault as CoreVault
+
+
+class Vault(CoreVault):
+    """Drop-in replacement for `llm_guard.vault.Vault`."""
+
+
+class Anonymize:
+    def __init__(self, vault: CoreVault | None = None, preset: str = "default", **kwargs: Any) -> None:
+        self.vault = vault if vault is not None else CoreVault(preset=preset, **kwargs)
+
+    def scan(self, prompt: str) -> tuple[str, bool, float]:
+        res = self.vault.redact_text(prompt)
+        is_valid = res.count == 0
+        risk_score = 0.0 if is_valid else 1.0
+        return res.value, is_valid, risk_score
+
+
+class Deanonymize:
+    def __init__(self, vault: CoreVault) -> None:
+        self.vault = vault
+
+    def scan(self, _prompt: str, output: str) -> tuple[str, bool, float]:
+        restored = self.vault.restore(output)
+        return restored, True, 0.0
+
+
+class Sensitive:
+    def __init__(self, preset: str = "strict", **kwargs: Any) -> None:
+        self.vault = CoreVault(preset=preset, **kwargs)
+
+    def scan(self, _prompt: str, output: str) -> tuple[str, bool, float]:
+        res = self.vault.redact_text(output)
+        is_valid = res.count == 0
+        return res.value, is_valid, 0.0 if is_valid else 1.0
+
+
+def scan_prompt(scanners: list[Any], prompt: str) -> tuple[str, dict[str, bool], dict[str, float]]:
+    current = prompt
+    results_valid: dict[str, bool] = {}
+    results_score: dict[str, float] = {}
+    for scanner in scanners:
+        name = type(scanner).__name__
+        current, is_valid, score = scanner.scan(current)
+        results_valid[name] = is_valid
+        results_score[name] = score
+    return current, results_valid, results_score
+
+
+def scan_output(
+    scanners: list[Any], prompt: str, output: str
+) -> tuple[str, dict[str, bool], dict[str, float]]:
+    current = output
+    results_valid: dict[str, bool] = {}
+    results_score: dict[str, float] = {}
+    for scanner in scanners:
+        name = type(scanner).__name__
+        current, is_valid, score = scanner.scan(prompt, current)
+        results_valid[name] = is_valid
+        results_score[name] = score
+    return current, results_valid, results_score

redact0/py.typed

@@ -0,0 +1,3 @@
+```
+
+### `python/src/redact0/__init__.py`

redact0/rules.py

@@ -0,0 +1,305 @@
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from typing import Callable, Pattern
+
+from .validators import (
+    is_valid_aadhaar,
+    is_valid_de_tax_id,
+    is_valid_dea,
+    is_valid_iban,
+    is_valid_ipv4,
+    is_valid_jwt,
+    is_valid_luhn,
+    is_valid_mbi,
+    is_valid_nhs,
+    is_valid_npi,
+    is_valid_ssn,
+    shannon_entropy,
+)
+
+ALL_PRESETS = ("default", "secrets", "hipaa", "gdpr", "strict")
+PII_PRESETS = ("default", "hipaa", "gdpr", "strict")
+HIPAA_STRICT = ("hipaa", "strict")
+GDPR_STRICT = ("gdpr", "strict")
+
+
+@dataclass(frozen=True)
+class DetectorRule:
+    id: str
+    category: str
+    pattern: Pattern[str]
+    priority: int
+    presets: tuple[str, ...]
+    capture_group: int | None = None
+    context_regex: Pattern[str] | None = None
+    context_window: int = 40
+    validate: Callable[[str, str, int], bool] | None = None
+
+
+def _cc_validate(val: str, _full: str, _start: int) -> bool:
+    digits = re.sub(r"\D", "", val)
+    return bool(
+        re.fullmatch(
+            r"(?:4\d{12}(?:\d{3})?(?:\d{3})?|5[1-5]\d{14}|2(?:2[2-9]|[3-6]\d|7[01]|720)\d{12}|3[47]\d{13}|6(?:011|5\d\d)\d{12}|3(?:0[0-5]|[68]\d)\d{11}|(?:2131|1800|35\d{3})\d{11})",
+            digits,
+        )
+    ) and is_valid_luhn(digits)
+
+
+def _phone_validate(val: str, _full: str, _start: int) -> bool:
+    digits = re.sub(r"\D", "", val)
+    return 10 <= len(digits) <= 15 and len(set(digits)) > 1
+
+
+BUILTIN_RULES: tuple[DetectorRule, ...] = (
+    DetectorRule(
+        id="pem-private-key",
+        category="PRIVATE_KEY",
+        priority=100,
+        presets=ALL_PRESETS,
+        pattern=re.compile(
+            r"-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY-----[\s\S]{16,8192}?-----END (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY-----"
+        ),
+    ),
+    DetectorRule(
+        id="connection-uri-password",
+        category="CONNECTION_URI",
+        priority=96,
+        presets=ALL_PRESETS,
+        capture_group=1,
+        pattern=re.compile(
+            r"\b(?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis(?:s)?|amqp(?:s)?|mssql|clickhouse|cockroachdb)://[^:\s/@]+:([^@\s/]{3,256})@[^\s\"'<>]+",
+            re.I,
+        ),
+    ),
+    DetectorRule(
+        id="anthropic-key",
+        category="API_KEY",
+        priority=95,
+        presets=ALL_PRESETS,
+        pattern=re.compile(r"\bsk-ant-(?:api\d{2}|admin\d{2}|oat\d{2}|[a-z0-9]+)-[A-Za-z0-9_-]{24,}\b"),
+    ),
+    DetectorRule(
+        id="openai-key",
+        category="API_KEY",
+        priority=95,
+        presets=ALL_PRESETS,
+        pattern=re.compile(r"\bsk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]{24,}\b|\bsk-[A-Za-z0-9]{16,}T3BlbkFJ[A-Za-z0-9]{16,}\b"),
+    ),
+    DetectorRule(
+        id="github-token",
+        category="API_KEY",
+        priority=95,
+        presets=ALL_PRESETS,
+        pattern=re.compile(r"\b(?:gh[pousr]_[A-Za-z0-9_]{36,}|github_pat_[A-Za-z0-9]{22}_[A-Za-z0-9]{40,})\b"),
+    ),
+    DetectorRule(
+        id="aws-access-key",
+        category="API_KEY",
+        priority=94,
+        presets=ALL_PRESETS,
+        pattern=re.compile(r"\b(?:AKIA|ASIA|AROA|AIDA)[0-9A-Z]{16}\b"),
+    ),
+    DetectorRule(
+        id="stripe-secret",
+        category="API_KEY",
+        priority=94,
+        presets=ALL_PRESETS,
+        pattern=re.compile(r"\b(?:sk_live|rk_live|whsec)_[A-Za-z0-9]{20,}\b"),
+    ),
+    DetectorRule(
+        id="google-api-key",
+        category="API_KEY",
+        priority=93,
+        presets=ALL_PRESETS,
+        pattern=re.compile(r"\bAIza[0-9A-Za-z_-]{35}\b"),
+    ),
+    DetectorRule(
+        id="slack-token",
+        category="TOKEN",
+        priority=93,
+        presets=ALL_PRESETS,
+        pattern=re.compile(r"\bxox[baprs]-[0-9A-Za-z-]{14,}\b|https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]+"),
+    ),
+    DetectorRule(
+        id="discord-webhook",
+        category="SECRET",
+        priority=92,
+        presets=ALL_PRESETS,
+        pattern=re.compile(r"https://discord(?:app)?\.com/api/webhooks/\d{16,22}/[A-Za-z0-9_-]{40,}"),
+    ),
+    DetectorRule(
+        id="provider-prefixed-keys",
+        category="API_KEY",
+        priority=92,
+        presets=ALL_PRESETS,
+        pattern=re.compile(
+            r"\b(?:hf_[A-Za-z0-9]{30,}|gsk_[A-Za-z0-9]{36,}|xai-[A-Za-z0-9]{36,}|pplx-[A-Za-z0-9]{36,}|sbp_[A-Za-z0-9]{36,}|sb_secret_[A-Za-z0-9_-]{24,}|re_[A-Za-z0-9_]{24,}|npm_[A-Za-z0-9]{36}|pypi-AgEIcHlwaS5vcmc[A-Za-z0-9_-]{50,}|SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43})\b"
+        ),
+    ),
+    DetectorRule(
+        id="jwt-token",
+        category="JWT",
+        priority=90,
+        presets=ALL_PRESETS,
+        pattern=re.compile(r"\beyJ[A-Za-z0-9_-]{6,}\.eyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{8,}\b"),
+        validate=lambda v, _f, _s: is_valid_jwt(v),
+    ),
+    DetectorRule(
+        id="bearer-auth-header",
+        category="TOKEN",
+        priority=88,
+        presets=ALL_PRESETS,
+        capture_group=1,
+        pattern=re.compile(
+            r"\b(?:Authorization|Proxy-Authorization)\s*[:=]\s*[\"']?(?:Bearer|Basic|Token)\s+([A-Za-z0-9._~+/=-]{12,})[\"']?",
+            re.I,
+        ),
+    ),
+    DetectorRule(
+        id="contextual-secret-assignment",
+        category="SECRET",
+        priority=72,
+        presets=ALL_PRESETS,
+        capture_group=1,
+        pattern=re.compile(
+            r"\b(?:api[_-]?key|secret[_-]?key|access[_-]?token|refresh[_-]?token|auth[_-]?token|client[_-]?secret|private[_-]?key|aws_secret_access_key|password|passwd|pwd|signing[_-]?secret)\b\s*[:=]\s*[\"']?([^\s\"',;}{]{10,128})[\"']?",
+            re.I,
+        ),
+        validate=lambda v, _f, _s: not v.startswith("[") and not v.startswith("<") and shannon_entropy(v) >= 2.8,
+    ),
+    DetectorRule(
+        id="medicare-mbi",
+        category="MBI",
+        priority=84,
+        presets=HIPAA_STRICT,
+        pattern=re.compile(r"\b[1-9][AC-HJKMNP-RT-Y][0-9AC-HJKMNP-RT-Y]-?\d[AC-HJKMNP-RT-Y][0-9AC-HJKMNP-RT-Y]-?\d[AC-HJKMNP-RT-Y]{2}\d{2}\b", re.I),
+        validate=lambda v, _f, _s: is_valid_mbi(v),
+    ),
+    DetectorRule(
+        id="us-dea",
+        category="DEA",
+        priority=83,
+        presets=HIPAA_STRICT,
+        pattern=re.compile(r"\b[ABFGMPRX][A-Z9]\d{7}\b"),
+        validate=lambda v, _f, _s: is_valid_dea(v),
+    ),
+    DetectorRule(
+        id="us-npi",
+        category="NPI",
+        priority=80,
+        presets=HIPAA_STRICT,
+        context_regex=re.compile(r"\b(?:npi|provider|prescriber|practitioner|physician)\b", re.I),
+        pattern=re.compile(r"\b[12]\d{9}\b"),
+        validate=lambda v, _f, _s: is_valid_npi(v),
+    ),
+    DetectorRule(
+        id="uk-nhs-number",
+        category="NHS",
+        priority=80,
+        presets=("hipaa", "gdpr", "strict"),
+        context_regex=re.compile(r"\b(?:nhs|patient|health|care|medical)\b", re.I),
+        pattern=re.compile(r"\b\d{3}[-\s]?\d{3}[-\s]?\d{4}\b"),
+        validate=lambda v, _f, _s: is_valid_nhs(v),
+    ),
+    DetectorRule(
+        id="medical-record-number",
+        category="MRN",
+        priority=78,
+        presets=HIPAA_STRICT,
+        capture_group=1,
+        pattern=re.compile(r"\b(?:mrn|medical[\s_-]?record(?:[\s_-]?number)?|patient[\s_-]?id)\s*[:=#]?\s*([A-Z0-9-]{5,20})\b", re.I),
+    ),
+    DetectorRule(
+        id="iban",
+        category="IBAN",
+        priority=84,
+        presets=PII_PRESETS,
+        pattern=re.compile(r"\b[A-Z]{2}\d{2}(?:[\s-]?[A-Z0-9]){11,30}\b"),
+        validate=lambda v, _f, _s: is_valid_iban(v),
+    ),
+    DetectorRule(
+        id="credit-card",
+        category="CREDIT_CARD",
+        priority=82,
+        presets=PII_PRESETS,
+        pattern=re.compile(r"\b(?:\d[ -]?){13,18}\d\b"),
+        validate=_cc_validate,
+    ),
+    DetectorRule(
+        id="us-ssn",
+        category="SSN",
+        priority=81,
+        presets=PII_PRESETS,
+        pattern=re.compile(r"\b\d{3}[-\s]\d{2}[-\s]\d{4}\b|\b\d{9}\b"),
+        validate=is_valid_ssn,
+    ),
+    DetectorRule(
+        id="aadhaar-in",
+        category="AADHAAR",
+        priority=76,
+        presets=("gdpr", "strict"),
+        context_regex=re.compile(r"\b(?:aadhaar|aadhar|uidai)\b", re.I),
+        pattern=re.compile(r"\b[2-9]\d{3}[-\s]?\d{4}[-\s]?\d{4}\b"),
+        validate=lambda v, _f, _s: is_valid_aadhaar(v),
+    ),
+    DetectorRule(
+        id="de-tax-id",
+        category="TAX_ID",
+        priority=76,
+        presets=GDPR_STRICT,
+        context_regex=re.compile(r"\b(?:steuer|tax|tin|idnr|identifikationsnummer)\b", re.I),
+        pattern=re.compile(r"\b[1-9]\d{10}\b"),
+        validate=lambda v, _f, _s: is_valid_de_tax_id(v),
+    ),
+    DetectorRule(
+        id="email",
+        category="EMAIL",
+        priority=75,
+        presets=PII_PRESETS,
+        pattern=re.compile(r"\b[A-Za-z0-9._%+-]{1,64}@(?:[A-Za-z0-9-]{1,63}\.)+[A-Za-z]{2,24}\b"),
+    ),
+    DetectorRule(
+        id="phone",
+        category="PHONE",
+        priority=65,
+        presets=PII_PRESETS,
+        pattern=re.compile(r"(?:\+\d{1,3}[-.\s]?)?(?:\(\d{2,4}\)[-.\s]?|\b\d{3}[-.\s])\d{3,4}[-.\s]\d{4}\b|\+\d{1,3}[-.\s]?\d{2,4}[-.\s]?\d{3,4}[-.\s]?\d{3,4}\b"),
+        validate=_phone_validate,
+    ),
+    DetectorRule(
+        id="ipv4",
+        category="IP_ADDRESS",
+        priority=60,
+        presets=PII_PRESETS,
+        pattern=re.compile(r"\b(?:25[0-5]|2[0-4]\d|1?\d?\d)(?:\.(?:25[0-5]|2[0-4]\d|1?\d?\d)){3}\b"),
+        validate=lambda v, _f, _s: is_valid_ipv4(v),
+    ),
+    DetectorRule(
+        id="mac-address",
+        category="MAC_ADDRESS",
+        priority=58,
+        presets=("hipaa", "gdpr", "strict"),
+        pattern=re.compile(r"\b(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}\b"),
+    ),
+    DetectorRule(
+        id="labeled-person-name",
+        category="PERSON",
+        priority=55,
+        presets=HIPAA_STRICT,
+        capture_group=1,
+        pattern=re.compile(
+            r"\b(?:Patient(?:\s+Name)?|Dr\.|Doctor|Clinician|Provider|Mr\.|Mrs\.|Ms\.|Full\s+Name|Beneficiary)\s*[:.]?\s*([A-Z][a-z]{1,24}(?:\s+[A-Z]\.?)?(?:\s+[A-Z][a-z]{1,24}){1,2})"
+        ),
+    ),
+    DetectorRule(
+        id="dob-or-clinical-date",
+        category="DATE",
+        priority=52,
+        presets=HIPAA_STRICT,
+        context_regex=re.compile(r"\b(?:dob|birth|born|admit(?:ted)?|discharg(?:e|ed)|visit|encounter|date)\b", re.I),
+        pattern=re.compile(r"\b(?:\d{4}-\d{2}-\d{2}|(?:0?[1-9]|1[0-2])[/-](?:0?[1-9]|[12]\d|3[01])[/-](?:19|20)\d{2})\b"),
+    ),
+)

redact0/validators.py

@@ -0,0 +1,223 @@
+from __future__ import annotations
+
+import base64
+import math
+import re
+from collections import Counter
+
+_IBAN_LENGTHS: dict[str, int] = {
+    "AD": 24, "AE": 23, "AL": 28, "AT": 20, "AZ": 28, "BA": 20, "BE": 16, "BG": 22, "BH": 22,
+    "BR": 29, "BY": 28, "CH": 21, "CR": 22, "CY": 28, "CZ": 24, "DE": 22, "DK": 18, "DO": 28,
+    "EE": 20, "EG": 29, "ES": 24, "FI": 18, "FO": 18, "FR": 27, "GB": 22, "GE": 22, "GI": 23,
+    "GL": 18, "GR": 27, "GT": 28, "HR": 21, "HU": 28, "IE": 22, "IL": 23, "IQ": 23, "IS": 26,
+    "IT": 27, "JO": 30, "KW": 30, "KZ": 20, "LB": 28, "LC": 32, "LI": 21, "LT": 20, "LU": 20,
+    "LV": 21, "MC": 27, "MD": 24, "ME": 22, "MK": 19, "MR": 27, "MT": 31, "MU": 30, "NL": 18,
+    "NO": 15, "PK": 24, "PL": 28, "PS": 29, "PT": 25, "QA": 29, "RO": 24, "RS": 22, "SA": 24,
+    "SE": 24, "SI": 19, "SK": 24, "SM": 27, "ST": 25, "SV": 28, "TL": 23, "TN": 24, "TR": 26,
+    "UA": 29, "VA": 22, "VG": 24, "XK": 20,
+}
+
+_MBI_ALPHA = set("ACDEFGHJKMNPQRTUVWXY")
+_MBI_ALNUM = _MBI_ALPHA | set("0123456789")
+
+_VERHOEFF_D = (
+    (0, 1, 2, 3, 4, 5, 6, 7, 8, 9),
+    (1, 2, 3, 4, 0, 6, 7, 8, 9, 5),
+    (2, 3, 4, 0, 1, 7, 8, 9, 5, 6),
+    (3, 4, 0, 1, 2, 8, 9, 5, 6, 7),
+    (4, 0, 1, 2, 3, 9, 5, 6, 7, 8),
+    (5, 9, 8, 7, 6, 0, 4, 3, 2, 1),
+    (6, 5, 9, 8, 7, 1, 0, 4, 3, 2),
+    (7, 6, 5, 9, 8, 2, 1, 0, 4, 3),
+    (8, 7, 6, 5, 9, 3, 2, 1, 0, 4),
+    (9, 8, 7, 6, 5, 4, 3, 2, 1, 0),
+)
+_VERHOEFF_P = (
+    (0, 1, 2, 3, 4, 5, 6, 7, 8, 9),
+    (1, 5, 7, 6, 2, 8, 3, 0, 9, 4),
+    (5, 8, 0, 3, 7, 9, 6, 1, 4, 2),
+    (8, 9, 1, 6, 0, 4, 3, 5, 2, 7),
+    (9, 4, 5, 3, 1, 2, 6, 8, 7, 0),
+    (4, 2, 8, 6, 5, 7, 3, 9, 0, 1),
+    (2, 7, 9, 3, 8, 0, 6, 4, 1, 5),
+    (7, 0, 4, 6, 9, 1, 3, 2, 5, 8),
+)
+
+
+def _digits_only(val: str) -> str:
+    return re.sub(r"\D", "", val)
+
+
+def is_valid_luhn(val: str) -> bool:
+    digits = _digits_only(val)
+    if not (13 <= len(digits) <= 19) or len(set(digits)) == 1:
+        return False
+    total = 0
+    double = False
+    for ch in reversed(digits):
+        d = ord(ch) - 48
+        if double:
+            d *= 2
+            if d > 9:
+                d -= 9
+        total += d
+        double = not double
+    return total % 10 == 0
+
+
+def is_valid_npi(val: str) -> bool:
+    digits = _digits_only(val)
+    if not re.fullmatch(r"[12]\d{9}", digits):
+        return False
+    full = "80840" + digits
+    total = 0
+    double = False
+    for ch in reversed(full):
+        d = ord(ch) - 48
+        if double:
+            d *= 2
+            if d > 9:
+                d -= 9
+        total += d
+        double = not double
+    return total % 10 == 0
+
+
+def is_valid_dea(val: str) -> bool:
+    clean = val.strip().upper()
+    if not re.fullmatch(r"[ABFGMPRX][A-Z9]\d{7}", clean):
+        return False
+    d = [ord(c) - 48 for c in clean[2:]]
+    return ((d[0] + d[2] + d[4]) + 2 * (d[1] + d[3] + d[5])) % 10 == d[6]
+
+
+def is_valid_mbi(val: str) -> bool:
+    c = val.replace("-", "").upper()
+    if len(c) != 11:
+        return False
+    return (
+        "1" <= c[0] <= "9"
+        and c[1] in _MBI_ALPHA
+        and c[2] in _MBI_ALNUM
+        and c[3].isdigit()
+        and c[4] in _MBI_ALPHA
+        and c[5] in _MBI_ALNUM
+        and c[6].isdigit()
+        and c[7] in _MBI_ALPHA
+        and c[8] in _MBI_ALPHA
+        and c[9:11].isdigit()
+    )
+
+
+def is_valid_iban(val: str) -> bool:
+    clean = re.sub(r"[\s-]+", "", val).upper()
+    if not re.fullmatch(r"[A-Z]{2}\d{2}[A-Z0-9]{11,30}", clean):
+        return False
+    expected = _IBAN_LENGTHS.get(clean[:2])
+    if expected is not None and len(clean) != expected:
+        return False
+    rearranged = clean[4:] + clean[:4]
+    rem = 0
+    for ch in rearranged:
+        if "0" <= ch <= "9":
+            rem = (rem * 10 + (ord(ch) - 48)) % 97
+        elif "A" <= ch <= "Z":
+            rem = (rem * 100 + (ord(ch) - 55)) % 97
+        else:
+            return False
+    return rem == 1
+
+
+def is_valid_nhs(val: str) -> bool:
+    digits = _digits_only(val)
+    if len(digits) != 10 or len(set(digits)) == 1:
+        return False
+    total = sum((ord(digits[i]) - 48) * (10 - i) for i in range(9))
+    check = 11 - (total % 11)
+    if check == 11:
+        check = 0
+    if check == 10:
+        return False
+    return check == (ord(digits[9]) - 48)
+
+
+def is_valid_ssn(val: str, full_text: str = "", start: int = 0) -> bool:
+    clean = val.strip()
+    has_sep = bool(re.search(r"[-\s]", clean))
+    digits = _digits_only(clean)
+    if len(digits) != 9 or len(set(digits)) == 1:
+        return False
+    area, group, serial = int(digits[:3]), int(digits[3:5]), int(digits[5:])
+    if area in (0, 666) or area >= 900 or group == 0 or serial == 0:
+        return False
+    if not has_sep and full_text:
+        prefix = full_text[max(0, start - 36) : start]
+        return bool(re.search(r"\b(ssn|social[\s_-]?security|tin)\b", prefix, re.I))
+    return True
+
+
+def is_valid_aadhaar(val: str) -> bool:
+    digits = _digits_only(val)
+    if not re.fullmatch(r"[2-9]\d{11}", digits):
+        return False
+    c = 0
+    for i, ch in enumerate(reversed(digits)):
+        c = _VERHOEFF_D[c][_VERHOEFF_P[i % 8][ord(ch) - 48]]
+    return c == 0
+
+
+def is_valid_de_tax_id(val: str) -> bool:
+    digits = _digits_only(val)
+    if not re.fullmatch(r"[1-9]\d{10}", digits):
+        return False
+    counts = Counter(digits[:10])
+    if sum(1 for v in counts.values() if v in (2, 3)) != 1 or max(counts.values()) > 3:
+        return False
+    product = 10
+    for ch in digits[:10]:
+        s = (ord(ch) - 48 + product) % 10
+        if s == 0:
+            s = 10
+        product = (s * 2) % 11
+    check = 11 - product
+    if check == 10:
+        check = 0
+    return check == (ord(digits[10]) - 48)
+
+
+def is_valid_jwt(val: str) -> bool:
+    parts = val.split(".")
+    if len(parts) != 3 or not parts[0].startswith("eyJ"):
+        return False
+    try:
+        padded = parts[0] + "=" * ((4 - len(parts[0]) % 4) % 4)
+        decoded = base64.urlsafe_b64decode(padded.encode("ascii")).decode("utf-8")
+        return decoded.startswith("{") and '"' in decoded
+    except Exception:
+        return False
+
+
+def is_valid_ipv4(val: str) -> bool:
+    parts = val.split(".")
+    if len(parts) != 4:
+        return False
+    for p in parts:
+        if not p or (len(p) > 1 and p.startswith("0")) or not p.isdigit():
+            return False
+        if not (0 <= int(p) <= 255):
+            return False
+    return True
+
+
+def is_private_or_loopback_ipv4(val: str) -> bool:
+    parts = [int(x) for x in val.split(".")]
+    a, b = parts[0], parts[1]
+    return a in (10, 127, 0) or (a == 192 and b == 168) or (a == 172 and 16 <= b <= 31) or (a == 169 and b == 254)
+
+
+def shannon_entropy(val: str) -> float:
+    if not val:
+        return 0.0
+    counts = Counter(val)
+    length = len(val)
+    return -sum((c / length) * math.log2(c / length) for c in counts.values())

redact0/vault.py

@@ -0,0 +1,447 @@
+from __future__ import annotations
+
+import hashlib
+import hmac
+import re
+import secrets
+from dataclasses import dataclass
+from datetime import datetime, timedelta, timezone
+from typing import Any, Iterator
+
+from .rules import BUILTIN_RULES, DetectorRule
+from .validators import is_private_or_loopback_ipv4
+
+_RESERVED_TOKEN_RE = re.compile(r"\[[A-Z_]+_\d+(?:#[a-f0-9]{4,8})?\]|<[A-Z_]+_\d+(?:#[a-f0-9]{4,8})?>")
+_SENSITIVE_KEY_RE = re.compile(
+    r"^(?:password|passwd|pwd|passphrase|secret|api[_-]?key|access[_-]?token|refresh[_-]?token|auth[_-]?token|authorization|cookie|set-cookie|x-api-key|client[_-]?secret|private[_-]?key|ssn|social[_-]?security(?:[_-]?number)?|cvv|cvc|pin|iban|dob|birth[_-]?date|mrn)$",
+    re.I,
+)
+
+RESTRICTED_ZIP3_CONSERVATIVE = frozenset(
+    {
+        "036", "059", "063", "102", "203", "205", "369", "556", "692",
+        "790", "821", "823", "830", "831", "878", "879", "884", "890", "893",
+    }
+)
+
+
+@dataclass(frozen=True)
+class Finding:
+    id: str
+    category: str
+    start: int
+    end: int
+    token: str
+    length: int
+    fingerprint: str
+
+
+@dataclass(frozen=True)
+class RedactResult:
+    value: Any
+    findings: list[Finding]
+
+    @property
+    def count(self) -> int:
+        return len(self.findings)
+
+
+def _hmac_hex(key: str, msg: str, length: int = 12) -> str:
+    return hmac.new(key.encode("utf-8"), msg.encode("utf-8"), hashlib.sha256).hexdigest()[:length]
+
+
+class Vault:
+    def __init__(
+        self,
+        preset: str = "default",
+        *,
+        categories: list[str] | None = None,
+        exclude_categories: list[str] | None = None,
+        rules: list[DetectorRule] | None = None,
+        literals: list[str] | None = None,
+        allowlist: list[str] | None = None,
+        secret: str | None = None,
+        token_format: str = "bracket",
+        redact_private_ips: bool | None = None,
+        mask_char: str = "*",
+    ) -> None:
+        self.preset = preset
+        self.literals = literals or []
+        self.allowlist = set(allowlist or [])
+        self._key = secret or secrets.token_hex(16)
+        self.token_format = token_format
+        self.mask_char = mask_char
+        self.redact_private_ips = (
+            redact_private_ips if redact_private_ips is not None else preset in ("strict", "hipaa")
+        )
+
+        active = list(rules) if rules is not None else [r for r in BUILTIN_RULES if preset in r.presets]
+        if categories:
+            allowed = set(categories)
+            active = [r for r in active if r.category in allowed]
+        if exclude_categories:
+            blocked = set(exclude_categories)
+            active = [r for r in active if r.category not in blocked]
+        self._rules = active
+
+        self._forward: dict[tuple[str, str], str] = {}
+        self._reverse: dict[str, tuple[str, str]] = {}
+        self._counters: dict[str, int] = {}
+        self._reserved: set[str] = set()
+        self.version = 0
+
+    def _reserve_existing(self, text: str) -> None:
+        for m in _RESERVED_TOKEN_RE.finditer(text):
+            tok = m.group(0)
+            if tok not in self._reverse:
+                self._reserved.add(tok)
+
+    def tokenize(self, category: str, value: str) -> str:
+        key = (category, value)
+        if key in self._forward:
+            return self._forward[key]
+        if self.token_format == "mask":
+            return self.mask_char * min(max(len(value), 4), 16)
+        if self.token_format == "hash":
+            tok = f"[{category}:{_hmac_hex(self._key, f'{category}:{value}', 8)}]"
+            self._forward[key] = tok
+            self._reverse[tok] = key
+            self.version += 1
+            return tok
+
+        idx = self._counters.get(category, 0)
+        while True:
+            idx += 1
+            if self.token_format == "angle":
+                tok = f"<{category}_{idx}>"
+            elif self.token_format == "signed":
+                tok = f"[{category}_{idx}#{_hmac_hex(self._key, f'{category}:{idx}:{value}', 4)}]"
+            else:
+                tok = f"[{category}_{idx}]"
+            if tok not in self._reserved and tok not in self._reverse:
+                break
+
+        self._counters[category] = idx
+        self._forward[key] = tok
+        self._reverse[tok] = key
+        self.version += 1
+        return tok
+
+    def _collect(self, text: str) -> list[tuple[str, str, int, int, int, str]]:
+        candidates: list[tuple[str, str, int, int, int, str]] = []
+        for lit in self.literals:
+            if len(lit) < 4:
+                continue
+            idx = 0
+            while True:
+                found = text.find(lit, idx)
+                if found == -1:
+                    break
+                candidates.append(("literal-secret", "SECRET", 99, found, found + len(lit), lit))
+                idx = found + len(lit)
+
+        for rule in self._rules:
+            for m in rule.pattern.finditer(text):
+                if rule.capture_group is not None and m.group(rule.capture_group) is not None:
+                    val = m.group(rule.capture_group)
+                    start = m.start(rule.capture_group)
+                    end = m.end(rule.capture_group)
+                else:
+                    val = m.group(0)
+                    start = m.start()
+                    end = m.end()
+                if not val or val in self.allowlist:
+                    continue
+                if rule.id == "ipv4" and not self.redact_private_ips and is_private_or_loopback_ipv4(val):
+                    continue
+                if rule.context_regex is not None:
+                    left = text[max(0, start - rule.context_window) : start]
+                    right = text[end : min(len(text), end + rule.context_window)]
+                    if not (rule.context_regex.search(left) or rule.context_regex.search(right)):
+                        continue
+                if rule.validate is not None and not rule.validate(val, text, start):
+                    continue
+                candidates.append((rule.id, rule.category, rule.priority, start, end, val))
+
+        candidates.sort(key=lambda x: (-x[2], -(x[4] - x[3]), x[3]))
+        accepted: list[tuple[str, str, int, int, int, str]] = []
+        for cand in candidates:
+            if not any(cand[3] < a[4] and cand[4] > a[3] for a in accepted):
+                accepted.append(cand)
+        accepted.sort(key=lambda x: x[3])
+        return accepted
+
+    def scan(self, text: str) -> list[Finding]:
+        if not text:
+            return []
+        return [
+            Finding(
+                id=rid,
+                category=cat,
+                start=s,
+                end=e,
+                token=f"[{cat}]",
+                length=len(val),
+                fingerprint=hashlib.sha256(val.encode("utf-8")).hexdigest()[:12],
+            )
+            for rid, cat, _prio, s, e, val in self._collect(text)
+        ]
+
+    def redact_text(self, text: str) -> RedactResult:
+        if not text:
+            return RedactResult(value=text, findings=[])
+        self._reserve_existing(text)
+        matches = self._collect(text)
+        if not matches:
+            return RedactResult(value=text, findings=[])
+        parts: list[str] = []
+        findings: list[Finding] = []
+        cursor = 0
+        for rid, cat, _prio, s, e, val in matches:
+            parts.append(text[cursor:s])
+            tok = self.tokenize(cat, val)
+            parts.append(tok)
+            cursor = e
+            findings.append(
+                Finding(
+                    id=rid,
+                    category=cat,
+                    start=s,
+                    end=e,
+                    token=tok,
+                    length=len(val),
+                    fingerprint=_hmac_hex(self._key, val, 12),
+                )
+            )
+        parts.append(text[cursor:])
+        return RedactResult(value="".join(parts), findings=findings)
+
+    def redact(self, data: Any) -> RedactResult:
+        if isinstance(data, str):
+            return self.redact_text(data)
+        findings: list[Finding] = []
+        seen: dict[int, Any] = {}
+
+        def walk(node: Any, key_hint: str | None = None, depth: int = 0) -> Any:
+            if node is None or isinstance(node, (bool, int, float)):
+                return node
+            if isinstance(node, str):
+                if key_hint and _SENSITIVE_KEY_RE.match(key_hint) and node and node not in self._reverse:
+                    tok = self.tokenize("SECRET", node)
+                    findings.append(
+                        Finding(
+                            id="sensitive-key",
+                            category="SECRET",
+                            start=0,
+                            end=len(node),
+                            token=tok,
+                            length=len(node),
+                            fingerprint=_hmac_hex(self._key, node, 12),
+                        )
+                    )
+                    return tok
+                res = self.redact_text(node)
+                findings.extend(res.findings)
+                return res.value
+            if depth >= 32:
+                return "[MAX_DEPTH_TRUNCATED]"
+            obj_id = id(node)
+            if obj_id in seen:
+                return seen[obj_id]
+            if isinstance(node, list):
+                arr: list[Any] = []
+                seen[obj_id] = arr
+                for item in node:
+                    arr.append(walk(item, key_hint, depth + 1))
+                return arr
+            if isinstance(node, tuple):
+                return tuple(walk(item, key_hint, depth + 1) for item in node)
+            if isinstance(node, dict):
+                out: dict[Any, Any] = {}
+                seen[obj_id] = out
+                for k, v in node.items():
+                    out[k] = walk(v, str(k) if isinstance(k, str) else None, depth + 1)
+                return out
+            if isinstance(node, BaseException):
+                return self.redact_text(str(node)).value
+            return node
+
+        return RedactResult(value=walk(data), findings=findings)
+
+    def restore(self, text: str) -> str:
+        if not text or not self._reverse:
+            return text
+        tokens = sorted(self._reverse.keys(), key=len, reverse=True)
+        pattern = re.compile("|".join(re.escape(t) for t in tokens))
+        return pattern.sub(lambda m: self._reverse[m.group(0)][1], text)
+
+    def restore_object(self, data: Any) -> Any:
+        if isinstance(data, str):
+            return self.restore(data)
+        if isinstance(data, list):
+            return [self.restore_object(x) for x in data]
+        if isinstance(data, dict):
+            return {k: self.restore_object(v) for k, v in data.items()}
+        return data
+
+    def entries(self) -> list[tuple[str, str, str]]:
+        return [(tok, meta[0], meta[1]) for tok, meta in self._reverse.items()]
+
+
+class StreamRestorer:
+    def __init__(self, vault: Vault) -> None:
+        self.vault = vault
+        self._cached_version = -1
+        self._token_map: dict[str, str] = {}
+        self._prefixes: set[str] = set()
+        self._first_chars: set[str] = set()
+        self._max_len = 0
+        self._pending = ""
+
+    def _rebuild(self) -> None:
+        if self.vault.version == self._cached_version:
+            return
+        self._cached_version = self.vault.version
+        self._token_map.clear()
+        self._prefixes.clear()
+        self._first_chars.clear()
+        self._max_len = 0
+        for tok, _cat, val in self.vault.entries():
+            self._token_map[tok] = val
+            self._first_chars.add(tok[0])
+            self._max_len = max(self._max_len, len(tok))
+            for i in range(1, len(tok)):
+                self._prefixes.add(tok[:i])
+
+    def _process(self, is_flush: bool) -> str:
+        self._rebuild()
+        if not self._pending:
+            return ""
+        if not self._token_map:
+            out, self._pending = self._pending, ""
+            return out
+        out: list[str] = []
+        pos = 0
+        n = len(self._pending)
+        while pos < n:
+            ch = self._pending[pos]
+            if ch not in self._first_chars:
+                out.append(ch)
+                pos += 1
+                continue
+            rem = self._pending[pos:]
+            if not is_flush and len(rem) < self._max_len and rem in self._prefixes:
+                break
+            matched: str | None = None
+            for length in range(min(self._max_len, len(rem)), 0, -1):
+                candidate = rem[:length]
+                if candidate in self._token_map:
+                    matched = candidate
+                    break
+            if matched is not None:
+                out.append(self._token_map[matched])
+                pos += len(matched)
+            else:
+                out.append(ch)
+                pos += 1
+        self._pending = self._pending[pos:]
+        return "".join(out)
+
+    def push(self, chunk: str) -> str:
+        if not chunk:
+            return ""
+        self._pending += chunk
+        return self._process(False)
+
+    def flush(self) -> str:
+        return self._process(True)
+
+    def iter_restore(self, chunks: Iterator[str]) -> Iterator[str]:
+        for ch in chunks:
+            out = self.push(ch)
+            if out:
+                yield out
+        tail = self.flush()
+        if tail:
+            yield tail
+
+
+def create_vault(preset: str = "default", **kwargs: Any) -> Vault:
+    return Vault(preset=preset, **kwargs)
+
+
+def redact(data: Any, preset: str = "default", **kwargs: Any) -> Any:
+    return Vault(preset=preset, **kwargs).redact(data).value
+
+
+def redact_detailed(data: Any, preset: str = "default", **kwargs: Any) -> RedactResult:
+    return Vault(preset=preset, **kwargs).redact(data)
+
+
+def scan(text: str, preset: str = "default", **kwargs: Any) -> list[Finding]:
+    return Vault(preset=preset, **kwargs).scan(text)
+
+
+def redact_fhir(
+    resource: dict[str, Any],
+    *,
+    vault: Vault | None = None,
+    date_shift_days: int | None = None,
+    cap_age_over_89: bool = True,
+) -> tuple[dict[str, Any], Vault]:
+    v = vault or Vault(preset="hipaa")
+    seed = str(resource.get("id", "default"))
+    if date_shift_days is None:
+        h = int(hashlib.sha256(seed.encode("utf-8")).hexdigest()[:8], 16)
+        mag = 30 + (h % 151)
+        shift_days = mag if h % 2 == 0 else -mag
+    else:
+        shift_days = date_shift_days
+
+    clinical_keys = {"resourceType", "coding", "code", "system", "unit", "valueQuantity", "gender", "status"}
+    cur_year = datetime.now(timezone.utc).year
+
+    def shift_date(val: str, is_birth: bool = False) -> str:
+        m = re.match(r"^(\d{4})-(\d{2})-(\d{2})(.*)$", val)
+        if is_birth and cap_age_over_89 and m and (cur_year - int(m.group(1)) > 89):
+            return "90+"
+        if not m:
+            return val
+        dt = datetime(int(m.group(1)), int(m.group(2)), int(m.group(3)), tzinfo=timezone.utc) + timedelta(days=shift_days)
+        return dt.strftime("%Y-%m-%d") + m.group(4)
+
+    def walk(node: Any, path: tuple[str, ...], preserve: bool) -> Any:
+        cur = path[-1] if path else ""
+        if isinstance(node, str):
+            if preserve and cur != "display":
+                return node
+            if cur == "postalCode":
+                digits = re.sub(r"\D", "", node)
+                z3 = digits[:3] if len(digits) >= 3 else "000"
+                return "000" if z3 in RESTRICTED_ZIP3_CONSERVATIVE else z3
+            if cur == "birthDate":
+                return shift_date(node, is_birth=True)
+            if cur in ("date", "effectiveDateTime", "authoredOn", "onsetDateTime", "recordedDate", "issued"):
+                return shift_date(node, is_birth=False)
+            if cur in ("family", "given", "prefix", "suffix"):
+                return v.tokenize("PERSON", node)
+            if cur in ("line", "city"):
+                return v.tokenize("ADDRESS", node)
+            if cur == "id" or ("identifier" in path and cur == "value"):
+                return v.tokenize("MRN", node)
+            return v.redact_text(node).value
+        if isinstance(node, list):
+            return [walk(x, path, preserve) for x in node]
+        if isinstance(node, dict):
+            out: dict[str, Any] = {}
+            for k, val in node.items():
+                if k == "resourceType":
+                    out[k] = val
+                elif k == "photo":
+                    out[k] = []
+                else:
+                    out[k] = walk(val, (*path, k), preserve or (k in clinical_keys))
+            return out
+        return node
+
+    return walk(resource, (), False), v

redact0-1.0.0.dist-info/METADATA

@@ -0,0 +1,129 @@
+Metadata-Version: 2.5
+Name: redact0
+Version: 1.0.0
+Summary: Zero-dependency reversible PII, secret, FHIR HIPAA Safe Harbor, and streaming LLM boundary redactor. Drop-in migration for llm-guard.
+License: MIT
+Keywords: ai,fhir,gdpr,hipaa,llm-guard,pii,redaction,secrets
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+
+# redact0
+
+Zero-runtime-dependency reversible PII, secret, FHIR Safe Harbor and streaming redaction for JavaScript/TypeScript and Python.
+
+> Security note: this package is a best-effort detector/redactor, not a compliance certification or a substitute for a privacy/security review. Validate it against your own data and regulatory requirements before production use.
+
+## Requirements
+
+- Node.js 18+ for the npm package
+- Python 3.10+ for the PyPI package
+
+## Install
+
+```bash
+npm install redact0
+```
+
+```bash
+python -m pip install redact0
+```
+
+## JavaScript / TypeScript quick start
+
+```ts
+import { createVault, redact } from 'redact0';
+
+const safe = redact({
+  email: 'alice@example.com',
+  message: 'Contact alice@example.com',
+});
+
+const vault = createVault();
+const scrubbed = vault.redact('Send the report to alice@example.com').value;
+const restored = vault.restore(scrubbed);
+```
+
+## Python quick start
+
+```python
+from redact0 import Vault, redact
+
+safe = redact({"email": "alice@example.com"})
+vault = Vault()
+scrubbed = vault.redact("Contact alice@example.com").value
+restored = vault.restore(scrubbed)
+```
+
+## Build and verify from this repository
+
+```bash
+npm install
+npm run typecheck
+npm run build
+npm test
+npm run check:size
+```
+
+Python checks (from the repository root):
+
+```bash
+python -m venv .venv
+# Windows PowerShell: .venv\Scripts\Activate.ps1
+# macOS/Linux: source .venv/bin/activate
+python -m pip install -e ./python
+python -m pip install pytest
+python -m pytest python/tests
+```
+
+The Python package itself declares no runtime dependencies. `pytest` is only needed to run its tests.
+
+## CLI
+
+After building the npm package:
+
+```bash
+echo "email: alice@example.com" | node dist/cli.cjs
+npx redact0 init
+npx redact0 scan . --preset secrets
+npx redact0 mcp
+```
+
+For Python, after installation:
+
+```bash
+echo "email: alice@example.com" | redact0
+```
+
+## Exports
+
+The npm package defines these subpath exports:
+
+- `redact0/stream`
+- `redact0/fhir`
+- `redact0/ai`
+- `redact0/mcp`
+- `redact0/logger`
+
+The Python package includes `redact0.compat.llm_guard` for compatibility helpers.
+
+## Project layout
+
+- `src/`: TypeScript implementation and adapters
+- `tests/`: TypeScript tests
+- `python/src/redact0/`: Python implementation
+- `python/tests/`: Python tests
+- `llms.txt`, `llms-full.txt`, `context7.json`, `AGENTS.md`: AI-agent and documentation discovery resources
+
+## License
+
+MIT. See [LICENSE](LICENSE).

redact0-1.0.0.dist-info/RECORD

@@ -0,0 +1,12 @@
+redact0/__init__.py,sha256=6fStbaoSdHJi9Ha6StFjmZxMmqHePnWxgHeWY83DyJQ,924
+redact0/cli.py,sha256=ruvbn3072h1vE0L4-gdEvQGAgddJccM8A-nU3PBNenY,895
+redact0/py.typed,sha256=GnrsPzRHw0kxJF-41yISiGc7tdrYsH-TYiLY2AyInbg,42
+redact0/rules.py,sha256=zMTQLsOalUny1S09aZm-Lwv7gCrQiFpcCwjWlP52Dyc,10384
+redact0/validators.py,sha256=1flqPmmBQ_YMAnSQU-MkDSsbtxihMVvI8xibkL99Eak,6830
+redact0/vault.py,sha256=hLnwFtunsc053MAiagWP6bmxziyEhWy68-I_e7hHtHk,16565
+redact0/compat/__init__.py,sha256=LX6YwHIXKIcJom1qPKzCOUorPxzMwdIkYXHqharw-VM,182
+redact0/compat/llm_guard.py,sha256=4_9rLZcQvHz1f9uS36qTsqLvPaRoiqsTUHWKXVtQP8M,2394
+redact0-1.0.0.dist-info/METADATA,sha256=We7AzVI6VnXqQmFV6w-zAbv3zBBC11Ss8XLHy9MZc9E,3221
+redact0-1.0.0.dist-info/WHEEL,sha256=2iZrJkDIkeDh0k9SikKMqFuRP-ua6mb4Ir1AsER4BEw,87
+redact0-1.0.0.dist-info/entry_points.txt,sha256=1rspXGfmcuVazdgJCOIAybpx_ifher9CWmBy-_UF0oY,45
+redact0-1.0.0.dist-info/RECORD,,

redact0-1.0.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.33.0
+Root-Is-Purelib: true
+Tag: py3-none-any

redact0-1.0.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+redact0 = redact0.cli:main