spanguard 0.1.0__py3-none-any.whl

spanguard/__init__.py

@@ -0,0 +1,21 @@
+"""spanguard: detect and redact PII/PHI with leak-free audit records."""
+
+from spanguard.policy import Policy
+from spanguard.recognizers.base import Recognizer
+from spanguard.redactor import Redactor
+from spanguard.result import AuditRecord, RedactionResult, Span
+from spanguard.streaming import StreamBufferFullError, StreamRedactor
+from spanguard.tokenize import Keyring
+
+__version__ = "0.1.0"
+__all__ = [
+    "AuditRecord",
+    "Keyring",
+    "Policy",
+    "Recognizer",
+    "RedactionResult",
+    "Redactor",
+    "Span",
+    "StreamBufferFullError",
+    "StreamRedactor",
+]

spanguard/_keys.py

@@ -0,0 +1,29 @@
+"""Resolve secret keys from explicit args, env, or a fresh random fallback."""
+
+from __future__ import annotations
+
+import os
+import secrets
+import warnings
+
+
+def resolve_key(explicit: bytes | None, env_var: str) -> bytes:
+    """Return the explicit key, else the env var's bytes, else a random key.
+
+    The key is never logged. A random fallback is ephemeral (per process),
+    which makes tokenize/hash reversible/comparable only within that process
+    unless a stable key is supplied.
+    """
+    if explicit is not None:
+        return explicit
+    env = os.environ.get(env_var)
+    if env:
+        return env.encode()
+    warnings.warn(
+        f"No key provided and {env_var} is unset; using an ephemeral random key. "
+        "Hashes/tokens will not be reproducible across processes and reveal() will "
+        "only work within this process. Set the key explicitly or via the env var "
+        "for stable output.",
+        stacklevel=2,
+    )
+    return secrets.token_bytes(32)

spanguard/_overlap.py

@@ -0,0 +1,53 @@
+"""Deterministic overlap resolution: longest-wins, priority tiebreak."""
+
+from __future__ import annotations
+
+from bisect import bisect_left
+
+from spanguard.result import Span
+
+PRIORITY: dict[str, int] = {
+    "SSN": 0,
+    "CREDIT_CARD": 0,
+    "API_KEY": 0,
+    "EMAIL": 1,
+    "PHONE": 1,
+    "MRN": 1,
+    "DOB": 1,
+    "PERSON": 2,
+    "LOCATION": 2,
+}
+_DEFAULT_PRIORITY = 3
+
+
+def _rank(span: Span) -> tuple[int, int, int]:
+    """Sort key for 'best' span: longer first, then higher priority, then earlier."""
+    return (-span.length, PRIORITY.get(span.type, _DEFAULT_PRIORITY), span.start)
+
+
+def resolve_overlaps(spans: list[Span]) -> list[Span]:
+    """Greedily keep the best span, rejecting any that overlap a chosen one.
+
+    Best = longest; ties broken by priority (lower rank wins), then start.
+    Overlap is direct/pairwise (half-open [start, end) intervals), NOT
+    transitive: a span that overlaps only an already-rejected span is still
+    kept. Returns the surviving spans sorted by start.
+    """
+    # Index the chosen non-empty spans as parallel start/end lists sorted by
+    # start. They are pairwise disjoint, so their ends are sorted too, and a
+    # candidate [s, e) overlaps one of them iff the last one starting before e
+    # ends after s: one bisect per span, O(n log n) instead of O(n^2).
+    # Empty spans rank last (shortest) and can only be followed by other empty
+    # spans, which they never overlap, so they are never indexed.
+    starts: list[int] = []
+    ends: list[int] = []
+    chosen: list[Span] = []
+    for span in sorted(spans, key=_rank):
+        i = bisect_left(starts, span.end)
+        if i and ends[i - 1] > span.start:
+            continue  # overlaps an already-chosen (better) span
+        chosen.append(span)
+        if span.end > span.start:
+            starts.insert(i, span.start)
+            ends.insert(i, span.end)
+    return sorted(chosen, key=lambda s: s.start)

spanguard/_transform.py

@@ -0,0 +1,54 @@
+"""Apply resolved spans to text according to the redaction mode."""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+
+from spanguard.result import Span
+
+# Modes that require the raw matched text to compute their replacement.
+_RAW_MODES = frozenset({"hash", "tokenize"})
+
+
+def _replacement(
+    span: Span,
+    raw: str | None,
+    mode: str,
+    mask_char: str,
+    replace_raw: Callable[[Span, str], str] | None,
+) -> str:
+    if mode == "mask":
+        return mask_char * span.length
+    if mode == "placeholder":
+        return f"[{span.type}]"
+    if mode in _RAW_MODES:
+        if replace_raw is None or raw is None:  # pragma: no cover - guarded by caller
+            raise ValueError(f"mode {mode!r} requires a replace_raw callback")
+        return replace_raw(span, raw)
+    raise NotImplementedError(f"unknown mode {mode!r}")
+
+
+def apply_spans(
+    text: str,
+    spans: list[Span],
+    mode: str,
+    mask_char: str,
+    replace_raw: Callable[[Span, str], str] | None = None,
+) -> str:
+    """Rebuild `text` with each span replaced per `mode`. Spans must not overlap.
+
+    The raw matched slice is passed to `replace_raw` ONLY for raw-requiring
+    modes (hash/tokenize); mask/placeholder never receive raw text.
+    """
+    if not spans:
+        return text
+    ordered = sorted(spans, key=lambda s: s.start)
+    out: list[str] = []
+    cursor = 0
+    for span in ordered:
+        out.append(text[cursor : span.start])
+        raw = text[span.start : span.end] if mode in _RAW_MODES else None
+        out.append(_replacement(span, raw, mode, mask_char, replace_raw))
+        cursor = span.end
+    out.append(text[cursor:])
+    return "".join(out)

spanguard/cli.py

@@ -0,0 +1,145 @@
+"""Command-line interface: `spanguard scan` and `spanguard redact`."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+
+from spanguard.policy import DEFAULT_ENTITIES, Policy
+from spanguard.redactor import Redactor
+
+
+class _UsageError(Exception):
+    """A user-facing error: printed as ``error: <msg>`` with exit code 2.
+
+    Messages name paths and entity labels only, never input content.
+    """
+
+
+def _entities(value: str | None) -> tuple[str, ...]:
+    if not value:
+        return DEFAULT_ENTITIES
+    entities = tuple(e.strip().upper() for e in value.split(",") if e.strip())
+    unknown = [e for e in entities if e not in DEFAULT_ENTITIES]
+    if unknown or not entities:
+        # Silently skipping a typo would leave that type unredacted.
+        raise _UsageError(
+            f"unknown entity type(s): {', '.join(unknown) or '(none given)'}; "
+            f"choose from {', '.join(DEFAULT_ENTITIES)}"
+        )
+    return entities
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="spanguard",
+        description="Detect and redact PII/PHI in text files.",
+    )
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    scan = sub.add_parser("scan", help="Report detected entity counts (no raw values).")
+    scan.add_argument("file", help="Path to a UTF-8 text file to scan ('-' for stdin).")
+    scan.add_argument("--entities", help="Comma-separated entity types (default: all).")
+    scan.add_argument("--json", action="store_true", help="Emit the audit record as JSON.")
+
+    red = sub.add_parser("redact", help="Write redacted text.")
+    red.add_argument("file", help="Path to a UTF-8 text file to redact ('-' for stdin).")
+    red.add_argument(
+        "--mode",
+        choices=["mask", "placeholder", "hash", "tokenize"],
+        default="mask",
+    )
+    red.add_argument("--entities", help="Comma-separated entity types (default: all).")
+    red.add_argument("--out", help="Write redacted text here (default: stdout).")
+    red.add_argument(
+        "--audit-json", action="store_true", help="Emit the audit record as JSON to stderr."
+    )
+    return parser
+
+
+def _read_input(path: str) -> str:
+    """Read `path` (or stdin for ``-``) as UTF-8, mapping failures to usage errors."""
+    label = "<stdin>" if path == "-" else path
+    try:
+        if path == "-":
+            # None under `<&-` or pythonw; a closed stream would raise ValueError.
+            if sys.stdin is None or sys.stdin.closed:
+                raise _UsageError("cannot read <stdin>: stdin is not available")
+            # Decode the raw bytes ourselves: the console/pipe default (e.g.
+            # cp1252 on Windows) would silently mis-decode UTF-8 input.
+            buffer = getattr(sys.stdin, "buffer", None)
+            data = buffer.read() if buffer is not None else sys.stdin.read().encode("utf-8")
+            return bytes(data).decode("utf-8")
+        return Path(path).read_text(encoding="utf-8")
+    except FileNotFoundError:
+        raise _UsageError(f"file not found: {label}") from None
+    except UnicodeDecodeError:
+        raise _UsageError(f"cannot decode {label} as UTF-8") from None
+    except OSError as exc:
+        raise _UsageError(f"cannot read {label}: {exc.strerror or type(exc).__name__}") from None
+
+
+def _cmd_scan(args: argparse.Namespace) -> int:
+    policy = Policy(mode="placeholder", entities=_entities(args.entities))
+    text = _read_input(args.file)
+    result = Redactor(policy).redact(text)
+    if args.json:
+        print(json.dumps(
+            {"counts": result.audit.counts,
+             "policy_hash": result.audit.policy_hash,
+             "ts": result.audit.ts}
+        ))
+    else:
+        if result.audit.counts:
+            for etype, count in sorted(result.audit.counts.items()):
+                print(f"{etype}: {count}")
+        else:
+            print("No entities detected.")
+    return 0
+
+
+def _cmd_redact(args: argparse.Namespace) -> int:
+    policy = Policy(mode=args.mode, entities=_entities(args.entities))
+    text = _read_input(args.file)
+    result = Redactor(policy).redact(text)
+    if args.out:
+        try:
+            Path(args.out).write_text(result.text, encoding="utf-8")
+        except OSError as exc:
+            raise _UsageError(
+                f"cannot write {args.out}: {exc.strerror or type(exc).__name__}"
+            ) from None
+    else:
+        sys.stdout.write(result.text)
+        if not result.text.endswith("\n"):
+            sys.stdout.write("\n")
+    if args.audit_json:
+        sys.stderr.write(json.dumps(
+            {"counts": result.audit.counts,
+             "policy_hash": result.audit.policy_hash,
+             "ts": result.audit.ts}
+        ) + "\n")
+    return 0
+
+
+def main(argv: list[str] | None = None) -> int:
+    for stream in (sys.stdout, sys.stderr):
+        reconfigure = getattr(stream, "reconfigure", None)
+        if reconfigure is not None:
+            reconfigure(encoding="utf-8", errors="backslashreplace")
+
+    parser = build_parser()
+    args = parser.parse_args(argv)
+    try:
+        if args.command == "scan":
+            return _cmd_scan(args)
+        return _cmd_redact(args)
+    except _UsageError as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":  # pragma: no cover
+    raise SystemExit(main())

spanguard/policy.py

@@ -0,0 +1,35 @@
+"""Redaction policy: what to detect and how to transform it."""
+
+from __future__ import annotations
+
+import hashlib
+from typing import Literal
+
+from pydantic import BaseModel, ConfigDict
+
+RedactionMode = Literal["mask", "placeholder", "hash", "tokenize"]
+
+DEFAULT_ENTITIES: tuple[str, ...] = (
+    "EMAIL",
+    "PHONE",
+    "SSN",
+    "MRN",
+    "DOB",
+    "CREDIT_CARD",
+    "API_KEY",
+)
+
+
+class Policy(BaseModel):
+    """Immutable, serializable redaction policy."""
+
+    model_config = ConfigDict(frozen=True)
+
+    mode: RedactionMode = "mask"
+    entities: tuple[str, ...] = DEFAULT_ENTITIES
+    mask_char: str = "█"
+
+    def policy_hash(self) -> str:
+        """Stable content-addressed hash of the policy for the audit record."""
+        canonical = self.model_dump_json()
+        return hashlib.sha256(canonical.encode("utf-8")).hexdigest()[:16]

spanguard/recognizers/__init__.py

@@ -0,0 +1,8 @@
+"""Recognizers: pluggable detectors for PII/PHI entity types."""
+
+from .base import Recognizer
+from .luhn import luhn_valid
+from .ner import SpacyRecognizer
+from .regex_recognizers import DEFAULT_RECOGNIZERS
+
+__all__ = ["DEFAULT_RECOGNIZERS", "Recognizer", "SpacyRecognizer", "luhn_valid"]

spanguard/recognizers/base.py

@@ -0,0 +1,28 @@
+"""The Recognizer protocol: pluggable detectors."""
+
+from __future__ import annotations
+
+from typing import Protocol, runtime_checkable
+
+from spanguard.result import Span
+
+
+@runtime_checkable
+class Recognizer(Protocol):
+    """A detector for one entity type. Users implement this to add detectors.
+
+    Contract: `entity_type` (and the `type` field of every `Span` returned)
+    MUST be a fixed, non-sensitive entity *label* (e.g. ``"EMAIL"``,
+    ``"PHONE"``), never a value derived from the matched text. The label
+    appears verbatim in placeholder output (``[EMAIL]``) and as a key in the
+    audit record's ``counts``; putting matched content in it would leak raw
+    data into redacted output and audit records.
+    """
+
+    entity_type: str
+    """Fixed entity label for this recognizer. See class contract above:
+    never derive this from matched text."""
+
+    def recognize(self, text: str) -> list[Span]:
+        """Return non-overlapping spans of `entity_type` found in `text`."""
+        ...

spanguard/recognizers/luhn.py

@@ -0,0 +1,19 @@
+"""Luhn checksum for candidate credit-card numbers."""
+
+from __future__ import annotations
+
+
+def luhn_valid(digits: str) -> bool:
+    """True iff `digits` (bare digits, no separators) passes the Luhn check."""
+    if not digits or not digits.isdigit():
+        return False
+    total = 0
+    reverse = digits[::-1]
+    for i, ch in enumerate(reverse):
+        d = ord(ch) - 48
+        if i % 2 == 1:
+            d *= 2
+            if d > 9:
+                d -= 9
+        total += d
+    return total % 10 == 0

spanguard/recognizers/ner.py

@@ -0,0 +1,57 @@
+"""Optional spaCy NER recognizer (PERSON/LOCATION). Requires the [ner] extra."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from spanguard.result import Span
+
+_DEFAULT_LABEL_MAP = {"PERSON": "PERSON", "GPE": "LOCATION", "LOC": "LOCATION"}
+
+
+class SpacyRecognizer:
+    """Detect PERSON/LOCATION entities via spaCy NER.
+
+    spaCy is imported lazily so the base install stays light and `import
+    spanguard` works without the [ner] extra. Pass `_nlp` to inject a loaded
+    pipeline (used by tests) and skip the model load entirely.
+    """
+
+    # This recognizer emits multiple mapped types (PERSON/LOCATION); entity_type
+    # is a generic label satisfying the Recognizer protocol, not a per-span type.
+    entity_type = "NER"
+
+    def __init__(
+        self,
+        model: str = "en_core_web_sm",
+        label_map: dict[str, str] | None = None,
+        _nlp: Any | None = None,
+    ) -> None:
+        self.model = model
+        self.label_map = dict(label_map) if label_map is not None else dict(_DEFAULT_LABEL_MAP)
+        self._nlp = _nlp
+
+    def _load(self) -> Any:
+        if self._nlp is None:
+            try:
+                import spacy
+            except ModuleNotFoundError as exc:
+                if exc.name != "spacy":
+                    raise
+                raise ImportError(
+                    "SpacyRecognizer requires the optional 'ner' extra: "
+                    "pip install spanguard[ner], then download a model "
+                    "(python -m spacy download en_core_web_sm)."
+                ) from exc
+            self._nlp = spacy.load(self.model)  # pragma: no cover - env-dependent
+        return self._nlp
+
+    def recognize(self, text: str) -> list[Span]:
+        nlp = self._load()
+        doc = nlp(text)
+        spans: list[Span] = []
+        for ent in doc.ents:
+            mapped = self.label_map.get(ent.label_)
+            if mapped is not None:
+                spans.append(Span(type=mapped, start=ent.start_char, end=ent.end_char))
+        return spans

spanguard/recognizers/regex_recognizers.py

@@ -0,0 +1,156 @@
+"""Regex- and checksum-based recognizers for common PII/PHI entity types."""
+
+from __future__ import annotations
+
+import re
+from typing import ClassVar
+
+from spanguard.result import Span
+
+from .base import Recognizer
+from .luhn import luhn_valid
+
+# Email: Unicode local part and domain labels; a single @ and a dotted TLD of
+# >= 2 Unicode LETTERS (`[^\W\d_]`). Bracket/quote/comma/semicolon/colon chars
+# are excluded from the local+domain classes so the match neither gloms onto
+# surrounding punctuation nor is dropped when glued to a preceding `)`/`]`.
+#
+# Matching is kept linear on long whitespace-free runs (e.g. base64 blobs):
+# the local part is possessive (`++`, safe because its class excludes `@`),
+# and a search may only start at the beginning of a run of local-part chars.
+# Any match starting mid-run is dominated by one starting earlier in the same
+# run, EXCEPT right where a previous match ended mid-run -- that position is
+# tried with the anchored variant (see EmailRecognizer.recognize). Together
+# these reproduce `finditer` over the plain pattern exactly.
+_EMAIL_LOCAL = r"[^\s@()<>\[\]{}\",;:]"
+_EMAIL_ANCHORED = re.compile(
+    rf"{_EMAIL_LOCAL}++@{_EMAIL_LOCAL}+\.[^\W\d_]{{2,}}",
+    re.UNICODE,
+)
+_EMAIL = re.compile(rf"(?<!{_EMAIL_LOCAL}){_EMAIL_ANCHORED.pattern}", re.UNICODE)
+# NANP-style: optional +country, 3-3-4 with -, ., space, or parens on area code.
+_PHONE = re.compile(
+    r"(?<!\d)(?:\+\d{1,2}[ .\-]?)?(?:\(\d{3}\)|\d{3})[ .\-]\d{3}[ .\-]\d{4}(?!\d)"
+)
+_SSN = re.compile(r"(?<!\d)\d{3}-\d{2}-\d{4}(?!\d)")
+_MRN = re.compile(r"\bMRN\s*:?\s*(\d{6,})\b", re.IGNORECASE)
+# DOB: mm/dd/yyyy allowing 1- or 2-digit month/day (validated by range),
+# or ISO yyyy-mm-dd.
+_DOB = re.compile(
+    r"(?<!\d)(?:(0?[1-9]|1[0-2])/(0?[1-9]|[12]\d|3[01])/(\d{4})"
+    r"|(\d{4})-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01]))(?!\d)"
+)
+# A credit card: a contiguous 13-19 digit run, OR standard printed groupings
+# (4-4-4-4 / 4-4-4-3 for Visa/MC/Discover, 4-6-5 for Amex) separated by a single
+# space or dash. Grouping-awareness prevents merging adjacent numbers (e.g. a
+# phone followed by a card) into one bogus run. Each candidate is Luhn-checked.
+_CARD = re.compile(
+    r"""
+    (?<![\d-])
+    (?:
+        \d{13,19}
+      | \d{4}(?:[ -]\d{4}){2}[ -]\d{1,4}
+      | \d{4}[ -]\d{6}[ -]\d{5}
+    )
+    (?![\d-])
+    """,
+    re.VERBOSE,
+)
+# API keys: known prefixes, or a long high-entropy alnum run.
+_API_KEY = re.compile(
+    r"\b(?:sk-[A-Za-z0-9]{20,}"
+    r"|AKIA[0-9A-Z]{16}"
+    r"|ghp_[A-Za-z0-9]{36}"
+    r"|[A-Za-z0-9]{32,})\b"
+)
+
+
+class _RegexRecognizer:
+    """Shared base: emit one Span per full-match of `pattern`."""
+
+    entity_type: str
+    pattern: ClassVar[re.Pattern[str]]
+
+    def recognize(self, text: str) -> list[Span]:
+        return [
+            Span(type=self.entity_type, start=m.start(), end=m.end())
+            for m in self.pattern.finditer(text)
+        ]
+
+
+class EmailRecognizer:
+    """Emails, matched in linear time (see the `_EMAIL` comment)."""
+
+    entity_type = "EMAIL"
+
+    def recognize(self, text: str) -> list[Span]:
+        spans: list[Span] = []
+        pos = 0
+        while True:
+            m = None
+            # A previous match ended inside a run: an email may start right here.
+            if spans:
+                m = _EMAIL_ANCHORED.match(text, pos)
+            if m is None:
+                m = _EMAIL.search(text, pos)
+            if m is None:
+                return spans
+            spans.append(Span(type="EMAIL", start=m.start(), end=m.end()))
+            pos = m.end()
+
+
+class PhoneRecognizer(_RegexRecognizer):
+    entity_type = "PHONE"
+    pattern = _PHONE
+
+
+class SSNRecognizer(_RegexRecognizer):
+    entity_type = "SSN"
+    pattern = _SSN
+
+
+class DOBRecognizer(_RegexRecognizer):
+    entity_type = "DOB"
+    pattern = _DOB
+
+
+class MRNRecognizer:
+    """MRN needs the 'MRN' context word; redact only the digit run."""
+
+    entity_type = "MRN"
+
+    def recognize(self, text: str) -> list[Span]:
+        spans: list[Span] = []
+        for m in _MRN.finditer(text):
+            spans.append(Span(type="MRN", start=m.start(1), end=m.end(1)))
+        return spans
+
+
+class APIKeyRecognizer(_RegexRecognizer):
+    entity_type = "API_KEY"
+    pattern = _API_KEY
+
+
+class CreditCardRecognizer:
+    """Credit cards: contiguous or standard-grouped digit sequences, Luhn-valid."""
+
+    entity_type = "CREDIT_CARD"
+
+    def recognize(self, text: str) -> list[Span]:
+        spans: list[Span] = []
+        for m in _CARD.finditer(text):
+            digits = re.sub(r"[ -]", "", m.group())
+            if 13 <= len(digits) <= 19 and luhn_valid(digits):
+                spans.append(Span(type="CREDIT_CARD", start=m.start(), end=m.end()))
+        return spans
+
+
+DEFAULT_RECOGNIZERS: dict[str, Recognizer] = {
+    "EMAIL": EmailRecognizer(),
+    "PHONE": PhoneRecognizer(),
+    "SSN": SSNRecognizer(),
+    "MRN": MRNRecognizer(),
+    "DOB": DOBRecognizer(),
+    "CREDIT_CARD": CreditCardRecognizer(),
+    "API_KEY": APIKeyRecognizer(),
+}

spanguard/redactor.py

@@ -0,0 +1,94 @@
+"""The Redactor: run recognizers, resolve overlaps, transform, audit."""
+
+from __future__ import annotations
+
+import warnings
+
+from spanguard._keys import resolve_key
+from spanguard._overlap import resolve_overlaps
+from spanguard._transform import apply_spans
+from spanguard.policy import Policy
+from spanguard.recognizers.base import Recognizer
+from spanguard.recognizers.regex_recognizers import DEFAULT_RECOGNIZERS
+from spanguard.result import AuditRecord, RedactionResult, Span
+from spanguard.tokenize import Keyring, hmac_digest
+
+
+class Redactor:
+    """Detect and redact PII/PHI in text according to a `Policy`."""
+
+    def __init__(
+        self,
+        policy: Policy,
+        recognizers: list[Recognizer] | None = None,
+        *,
+        hmac_key: bytes | None = None,
+        tokenize_key: bytes | None = None,
+    ) -> None:
+        self.policy = policy
+        if recognizers is None:
+            missing = [e for e in policy.entities if e not in DEFAULT_RECOGNIZERS]
+            if missing:
+                # Labels only (never text), so this cannot leak raw values.
+                warnings.warn(
+                    f"Policy entities with no built-in recognizer are not detected: "
+                    f"{', '.join(missing)}. Pass recognizers=[...] (e.g. SpacyRecognizer "
+                    f"for PERSON/LOCATION) to detect them.",
+                    stacklevel=2,
+                )
+            recognizers = [
+                DEFAULT_RECOGNIZERS[e]
+                for e in policy.entities
+                if e in DEFAULT_RECOGNIZERS
+            ]
+        self.recognizers = recognizers
+        self._hmac_key_arg = hmac_key
+        self._tokenize_key_arg = tokenize_key
+        self._hmac_key_cached: bytes | None = None
+        self._keyring_cached: Keyring | None = None
+
+    @property
+    def _hmac_key(self) -> bytes:
+        if self._hmac_key_cached is None:
+            self._hmac_key_cached = resolve_key(self._hmac_key_arg, "SPANGUARD_HMAC_KEY")
+        return self._hmac_key_cached
+
+    @property
+    def keyring(self) -> Keyring:
+        if self._keyring_cached is None:
+            self._keyring_cached = Keyring(
+                resolve_key(self._tokenize_key_arg, "SPANGUARD_TOKENIZE_KEY")
+            )
+        return self._keyring_cached
+
+    def _detect(self, text: str) -> list[Span]:
+        spans: list[Span] = []
+        for rec in self.recognizers:
+            spans.extend(rec.recognize(text))
+        return resolve_overlaps(spans)
+
+    def _replace_raw(self, span: Span, raw: str) -> str:
+        if self.policy.mode == "hash":
+            return f"[{span.type}:{hmac_digest(self._hmac_key, span.type, raw)}]"
+        if self.policy.mode == "tokenize":
+            return self.keyring.tokenize(span.type, raw)
+        raise ValueError(f"no raw replacement for mode {self.policy.mode!r}")
+
+    def redact(self, text: str) -> RedactionResult:
+        return self._redact_with_spans(text, self._detect(text))
+
+    def _redact_with_spans(self, text: str, spans: list[Span]) -> RedactionResult:
+        """Redact `text` using already-resolved `spans` (from `_detect(text)`)."""
+        redacted = apply_spans(
+            text,
+            spans,
+            mode=self.policy.mode,
+            mask_char=self.policy.mask_char,
+            replace_raw=self._replace_raw,
+        )
+        audit = AuditRecord.from_spans(spans, policy_hash=self.policy.policy_hash())
+        return RedactionResult(text=redacted, audit=audit, spans=spans)
+
+    def reveal(self, text: str, keyring: Keyring | None = None) -> str:
+        """Restore tokenized values using `keyring` (defaults to this Redactor's)."""
+        return (keyring or self.keyring).reveal(text)

spanguard/result.py

@@ -0,0 +1,49 @@
+"""Value types for redaction results and leak-free audit records."""
+
+from __future__ import annotations
+
+from collections import Counter
+from dataclasses import dataclass, field
+from datetime import UTC, datetime
+
+
+@dataclass(frozen=True, slots=True)
+class Span:
+    """A detected sensitive region: entity `type` over half-open [start, end).
+
+    `type` is a fixed entity label (e.g. ``"EMAIL"``), never the matched
+    value — it appears verbatim in the audit record's ``counts`` and in
+    placeholder output.
+    """
+
+    type: str
+    start: int
+    end: int
+
+    @property
+    def length(self) -> int:
+        return self.end - self.start
+
+
+@dataclass(frozen=True, slots=True)
+class AuditRecord:
+    """Per-operation audit trail. Contains counts only — never raw values."""
+
+    counts: dict[str, int]
+    policy_hash: str
+    ts: str
+
+    @classmethod
+    def from_spans(cls, spans: list[Span], policy_hash: str) -> AuditRecord:
+        counts = dict(Counter(s.type for s in spans))
+        ts = datetime.now(UTC).isoformat()
+        return cls(counts=counts, policy_hash=policy_hash, ts=ts)
+
+
+@dataclass(frozen=True, slots=True)
+class RedactionResult:
+    """Result of a redaction: transformed `text`, its `audit`, and the `spans`."""
+
+    text: str
+    audit: AuditRecord
+    spans: list[Span] = field(default_factory=list)

spanguard/streaming.py

@@ -0,0 +1,149 @@
+"""Chunked streaming redaction that preserves entities across chunk boundaries."""
+
+from __future__ import annotations
+
+import re
+
+from spanguard.redactor import Redactor
+from spanguard.result import Span
+
+_DEFAULT_TAIL = 128
+_MIN_TAIL = 64
+_WHITESPACE = re.compile(r"\s")
+
+
+class StreamBufferFullError(Exception):
+    """Raised by ``StreamRedactor.feed`` when the held-back buffer exceeds
+    ``max_buffer`` and no point to emit up to is safe yet.
+
+    The chunk passed to that ``feed()`` has already been accepted, so do not
+    feed it again. The buffer is kept intact: call ``flush()`` to redact and
+    emit everything held so far (an entity still arriving may then be split),
+    or discard the redactor.
+    """
+
+
+class StreamRedactor:
+    """Redact a text arriving in chunks, holding back a tail so an entity split
+    across a boundary is still redacted as one.
+
+    Guarantee: for any chunking, the concatenation of all ``feed()`` outputs
+    plus ``flush()`` equals ``redactor.redact(full_text).text`` -- for every
+    mode (mask, placeholder, hash, tokenize) with the same keys.
+
+    Memory: text is emitted only up to a whitespace character that no entity
+    straddles, so while the stream keeps supplying such separators the buffer
+    stays near ``tail`` plus one chunk. A stream without one (a long base64
+    blob, or whitespace only inside a phone number) is held until one arrives
+    or ``flush()`` is called. Pass ``max_buffer`` to cap that: a ``feed()``
+    that leaves more than ``max_buffer`` characters held and can emit nothing
+    raises ``StreamBufferFullError``. (A feed that does emit may still leave
+    the buffer over the cap; the next feed that cannot emit raises.)
+
+    ``tail`` must be >= ``_MIN_TAIL`` (64),
+    which is enforced. An entity longer than ``tail`` with no internal
+    separators (e.g. an email or an API key) degrades gracefully to a
+    word-boundary split. The floor exists specifically to prevent a
+    sub-threshold leak of entities that DO contain internal separators (e.g.
+    a spaced credit card number): below the floor, the buffer never holds
+    enough of the entity for detection to fire, so every whitespace cut looks
+    safe and the raw value streams out unmasked in pieces.
+    """
+
+    def __init__(
+        self,
+        redactor: Redactor,
+        tail: int = _DEFAULT_TAIL,
+        max_buffer: int | None = None,
+    ) -> None:
+        if tail < _MIN_TAIL:
+            raise ValueError(
+                f"tail must be >= {_MIN_TAIL} to guarantee no raw value leaks; "
+                f"a smaller tail can let a multi-token entity (e.g. a credit card) "
+                f"stream out in sub-threshold pieces that never match. Got tail={tail}."
+            )
+        if max_buffer is not None and max_buffer <= tail:
+            raise ValueError(
+                f"max_buffer must be greater than tail ({tail}); got max_buffer={max_buffer}."
+            )
+        self._redactor = redactor
+        self._tail = tail
+        self._max_buffer = max_buffer
+        self._buffer = ""
+        # Cut candidates in buffer[:_tried_upto] were already tried and none
+        # was safe; only whitespace past it warrants another detection pass.
+        self._tried_upto = 0
+
+    @property
+    def pending(self) -> int:
+        return len(self._buffer)
+
+    def _safe_cut(self) -> tuple[int, list[Span]]:
+        """Largest separator index that provably reproduces the one-shot result.
+
+        A cut at ``c`` (just after a whitespace char, ``c <= len - tail``) is
+        safe iff detecting the prefix ``buffer[:c]`` yields exactly the
+        whole-buffer spans ending at or before ``c``, AND detecting the suffix
+        ``buffer[c:]`` yields exactly the whole-buffer spans starting at or
+        after ``c`` (offsets shifted by ``-c``). This behavioral check -- not a
+        positional guess -- is what makes "split == whole" hold even for
+        entities that contain internal separators or need left context.
+
+        Returns ``(cut, prefix_spans)`` -- the verified detection result for
+        ``buffer[:cut]``, so the caller can emit without re-detecting -- or
+        ``(0, [])`` when no cut is safe yet (nothing may be emitted).
+        """
+        buffer = self._buffer
+        limit = len(buffer) - self._tail
+        # Cut points sit just after a whitespace char (`\s` is exactly
+        # str.isspace()), latest first. Candidates already tried are retried
+        # only once new whitespace arrives past them, so a stream with no
+        # usable separator costs O(n) total rather than a detection pass per
+        # feed. Output is unchanged either way; only emission timing can lag.
+        limit = max(limit, 0)
+        start, self._tried_upto = self._tried_upto, limit
+        if _WHITESPACE.search(buffer, start, limit) is None:
+            return 0, []  # no new cut candidate: skip detection entirely
+        candidates = [m.end() for m in _WHITESPACE.finditer(buffer, 0, limit)][::-1]
+        full = self._redactor._detect(buffer)
+        # Worst case re-detects prefix and suffix per candidate; in practice the
+        # first candidate no span straddles is accepted (~3 detection passes).
+        for c in candidates:
+            if any(s.start < c < s.end for s in full):
+                continue  # a span straddles this cut
+            pre_expected = [s for s in full if s.end <= c]
+            suf_expected = [Span(s.type, s.start - c, s.end - c) for s in full if s.start >= c]
+            if self._redactor._detect(buffer[:c]) != pre_expected:
+                continue
+            if self._redactor._detect(buffer[c:]) != suf_expected:
+                continue
+            return c, pre_expected
+        return 0, []
+
+    def feed(self, chunk: str) -> str:
+        self._buffer += chunk
+        cut, spans = self._safe_cut()
+        if cut == 0 and self._max_buffer is not None and len(self._buffer) > self._max_buffer:
+            # A skipped (already-tried) cut may have become safe since; retry
+            # every candidate before reporting that none exists.
+            self._tried_upto = 0
+            cut, spans = self._safe_cut()
+            if cut == 0:
+                raise StreamBufferFullError(
+                    f"stream buffer holds {len(self._buffer)} characters, over "
+                    f"max_buffer={self._max_buffer}, with no safe point to emit up to"
+                )
+        if cut == 0:
+            return ""
+        emit_src = self._buffer[:cut]
+        self._buffer = self._buffer[cut:]
+        self._tried_upto = 0
+        return self._redactor._redact_with_spans(emit_src, spans).text
+
+    def flush(self) -> str:
+        if not self._buffer:
+            return ""
+        out = self._redactor.redact(self._buffer).text
+        self._buffer = ""
+        self._tried_upto = 0
+        return out

spanguard/tokenize.py

@@ -0,0 +1,71 @@
+"""Deterministic HMAC hashing and reversible tokenization with a keyring."""
+
+from __future__ import annotations
+
+import hmac
+import re
+from hashlib import sha256
+
+_DIGEST_LEN = 16
+_TOKEN_SHAPE = re.compile("⟦[^⟦⟧]*⟧")
+
+
+def hmac_digest(key: bytes, entity_type: str, raw: str) -> str:
+    """Deterministic HMAC-SHA256 digest (first 16 hex chars) over type:raw."""
+    msg = f"{entity_type}:{raw}".encode()
+    return hmac.new(key, msg, sha256).hexdigest()[:_DIGEST_LEN]
+
+
+def make_token(entity_type: str, digest: str) -> str:
+    """Stable token wrapper for a digest."""
+    return f"⟦{entity_type}_{digest}⟧"
+
+
+class Keyring:
+    """Holds the tokenize key and an in-memory token->raw map for reveal().
+
+    The key and the map are never exposed via repr/str, so a Keyring can be
+    logged without leaking secrets or raw values.
+    """
+
+    def __init__(self, tokenize_key: bytes) -> None:
+        self._key = tokenize_key
+        self._map: dict[str, str] = {}
+        # Set when a label contains a token bracket, which defeats the
+        # bracket-delimited fast path in reveal().
+        self._bracketed_label = False
+
+    def tokenize(self, entity_type: str, raw: str) -> str:
+        digest = hmac_digest(self._key, entity_type, raw)
+        token = make_token(entity_type, digest)
+        if "⟦" in entity_type or "⟧" in entity_type:
+            self._bracketed_label = True
+        self._map[token] = raw
+        return token
+
+    def reveal_token(self, token: str) -> str | None:
+        return self._map.get(token)
+
+    def reveal(self, text: str) -> str:
+        """Replace every token this keyring issued with its original value.
+
+        Substitution is a single left-to-right pass (one re.sub over an
+        alternation of all issued tokens), so a raw value that happens to
+        contain another issued token's string is never re-expanded.
+        """
+        if not self._map:
+            return text
+        if not self._bracketed_label:
+            # Every issued token is ⟦...⟧ with no inner brackets, so scanning
+            # bracket-delimited candidates and looking each up is equivalent
+            # to the alternation below, in O(len(text)) regardless of map size.
+            return _TOKEN_SHAPE.sub(lambda m: self._map.get(m[0], m[0]), text)
+        pattern = re.compile("|".join(re.escape(tok) for tok in self._map))
+        return pattern.sub(lambda m: self._map[m[0]], text)
+
+    @property
+    def tokens(self) -> frozenset[str]:
+        return frozenset(self._map)
+
+    def __repr__(self) -> str:
+        return f"Keyring(tokens={len(self._map)})"

spanguard-0.1.0.dist-info/METADATA

@@ -0,0 +1,235 @@
+Metadata-Version: 2.5
+Name: spanguard
+Version: 0.1.0
+Summary: Detect and redact PII/PHI in text and streaming transcripts, with leak-free audit records.
+Project-URL: Homepage, https://github.com/Clufy/spanguard
+Project-URL: Documentation, https://clufy.github.io/spanguard
+Project-URL: Issues, https://github.com/Clufy/spanguard/issues
+Project-URL: Changelog, https://github.com/Clufy/spanguard/blob/master/CHANGELOG.md
+Author: spanguard authors
+License-Expression: MIT
+License-File: LICENSE
+Keywords: compliance,phi,pii,privacy,redaction
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Classifier: Topic :: Text Processing
+Classifier: Typing :: Typed
+Requires-Python: >=3.12
+Requires-Dist: pydantic<3,>=2.6
+Provides-Extra: docs
+Requires-Dist: mkdocs-material>=9; extra == 'docs'
+Requires-Dist: mkdocstrings[python]>=0.24; extra == 'docs'
+Provides-Extra: ner
+Requires-Dist: spacy<4,>=3.7; extra == 'ner'
+Description-Content-Type: text/markdown
+
+# spanguard
+
+**Redact PII/PHI from text and streams — with an audit trail that can never leak the data it's auditing.**
+
+[![CI](https://github.com/Clufy/spanguard/actions/workflows/ci.yml/badge.svg)](https://github.com/Clufy/spanguard/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/spanguard.svg)](https://pypi.org/project/spanguard/)
+[![Coverage](https://img.shields.io/badge/coverage-97%25-brightgreen.svg)](https://github.com/Clufy/spanguard/actions/workflows/ci.yml)
+[![Docs](https://img.shields.io/badge/docs-mkdocs--material-blue.svg)](https://clufy.github.io/spanguard)
+[![Python](https://img.shields.io/badge/python-3.12%2B-blue.svg)](https://www.python.org/downloads/)
+[![Typed](https://img.shields.io/badge/mypy-strict-blue.svg)](https://mypy-lang.org/)
+[![License](https://img.shields.io/badge/license-MIT-green.svg)](https://github.com/Clufy/spanguard/blob/master/LICENSE)
+
+spanguard detects and redacts PII/PHI (personally identifiable information and
+protected health information) in text and streaming transcripts. Every
+`Redactor.redact()` call returns a `RedactionResult` whose `audit` field holds
+only entity-type counts, a policy hash, and a timestamp — **never the raw
+matched values** — so the audit trail itself can never become a second place
+where sensitive data leaks out. That guarantee is enforced by the test suite,
+not just documented.
+
+## Contents
+
+- [Why spanguard](#why-spanguard)
+- [Install](#install)
+- [60-second quickstart](#60-second-quickstart)
+- [Streaming](#streaming)
+- [CLI](#cli)
+- [Built-in entity table](#built-in-entity-table)
+- [Compliance / audit guarantee](#compliance--audit-guarantee)
+- [Docs](#docs)
+- [Contributing](#contributing)
+- [Security](#security)
+- [License](#license)
+
+## Why spanguard
+
+- **Leak-free audit record** — `result.audit` carries entity-type counts, a
+  policy hash, and a timestamp only; raw matches never enter it, and tests
+  verify this holds across every mode.
+- **Four redaction modes** — `mask`, `placeholder`, `hash` (deterministic
+  HMAC), and `tokenize` (reversible).
+- **Reversible tokenization** — turn tokens back into the original text with
+  `Redactor.reveal()` and an in-memory `Keyring`, scoped to a single process.
+- **Built-in detectors** — email (Unicode-aware), phone, SSN, MRN, DOB, and
+  Luhn-validated credit card numbers, plus API key patterns.
+- **Optional NER** — spaCy-backed `PERSON`/`LOCATION` detection behind the
+  `[ner]` extra, off by default so the core install stays light.
+- **Streaming-safe** — `StreamRedactor` redacts chunked input (e.g. a live
+  transcript) so the output matches a one-shot redaction, even when an entity
+  straddles a chunk boundary.
+- **Pluggable recognizers** — register a custom `Recognizer` for domain-specific
+  entities without forking the library.
+- **Typed and tested** — mypy `--strict` and ruff clean, 128 tests, 97.9%
+  coverage.
+- **CLI included** — `spanguard scan` / `spanguard redact` for one-off files
+  and shell pipelines.
+
+## Install
+
+```bash
+pip install spanguard
+```
+
+For the optional NER (`PERSON`/`LOCATION`) recognizer:
+
+```bash
+pip install spanguard[ner]
+python -m spacy download en_core_web_sm
+```
+
+NER is opt-in per `Redactor`: pass the recognizer alongside the built-ins.
+
+```python
+from spanguard import Policy, Redactor
+from spanguard.recognizers import DEFAULT_RECOGNIZERS, SpacyRecognizer
+
+redactor = Redactor(Policy(), recognizers=[*DEFAULT_RECOGNIZERS.values(), SpacyRecognizer()])
+```
+
+## 60-second quickstart
+
+```python
+from spanguard import Redactor, Policy
+
+text = "Contact: jane@example.com or 555-123-4567."
+
+# --- mask: replace each character with mask_char, preserving length ---
+mask_policy = Policy(mode="mask", entities=("EMAIL", "PHONE"))
+mask_result = Redactor(mask_policy).redact(text)
+print(mask_result.text)
+# Contact: ████████████████ or ████████████.
+print(mask_result.audit.counts)
+# {'EMAIL': 1, 'PHONE': 1}
+
+# --- placeholder: replace with a [TYPE] tag ---
+placeholder_policy = Policy(mode="placeholder", entities=("EMAIL", "PHONE"))
+placeholder_result = Redactor(placeholder_policy).redact(text)
+print(placeholder_result.text)
+# Contact: [EMAIL] or [PHONE].
+
+# --- hash: deterministic HMAC digest, reproducible with the same key ---
+hash_policy = Policy(mode="hash", entities=("EMAIL", "PHONE"))
+hash_redactor = Redactor(hash_policy, hmac_key=b"docs-example-key")
+hash_result = hash_redactor.redact(text)
+print(hash_result.text)
+# Contact: [EMAIL:11d041e6c58a0530] or [PHONE:cbe886551f4e27ed].
+
+# --- tokenize + reveal: reversible via an in-memory keyring ---
+tokenize_policy = Policy(mode="tokenize", entities=("EMAIL", "PHONE"))
+tokenize_redactor = Redactor(tokenize_policy, tokenize_key=b"docs-example-key")
+tokenize_result = tokenize_redactor.redact(text)
+print(tokenize_result.text)
+# Contact: ⟦EMAIL_11d041e6c58a0530⟧ or ⟦PHONE_cbe886551f4e27ed⟧.
+
+revealed = tokenize_redactor.reveal(tokenize_result.text)
+print(revealed == text)
+# True
+```
+
+See the [Quickstart docs](https://clufy.github.io/spanguard/quickstart/)
+for notes on keys, the audit record, and `result.spans`.
+
+## Streaming
+
+```python
+from spanguard import Redactor, Policy, StreamRedactor
+
+redactor = Redactor(Policy(mode="mask", entities=("EMAIL", "PHONE")))
+stream = StreamRedactor(redactor)
+
+output = stream.feed("Contact: jane@example.com ") + stream.feed("or 555-123-4567.")
+output += stream.flush()
+```
+
+`StreamRedactor` holds back a tail of the buffer (minimum 64 characters) so an
+entity split across a chunk boundary is still detected as one; the
+concatenation of every `feed()` plus the final `flush()` is guaranteed to
+equal a one-shot `redactor.redact(full_text).text`.
+
+Text is emitted only up to a safe split point (whitespace outside any
+entity), so a stream with none, such as a long base64 blob, is held in memory.
+Pass `StreamRedactor(redactor, max_buffer=N)` to get a `StreamBufferFullError`
+instead of unbounded growth. See
+[Streaming](https://clufy.github.io/spanguard/streaming/).
+
+## CLI
+
+```bash
+spanguard scan file.txt
+spanguard redact file.txt --mode mask
+spanguard redact file.txt --mode tokenize --out redacted.txt
+cat file.txt | spanguard redact - --mode placeholder   # '-' reads stdin
+```
+
+`scan` reports entity-type counts only (no raw values); `redact` writes the
+redacted text and, with `--audit-json`, the audit record to stderr. Bad input
+(an unknown `--entities` name, a missing or non-UTF-8 file) exits with code 2
+and a one-line `error:` message that never echoes input content. See
+[CLI](https://clufy.github.io/spanguard/cli/).
+
+## Built-in entity table
+
+| Entity type   | Detector                          | Notes                                                             |
+|---------------|------------------------------------|--------------------------------------------------------------------|
+| `EMAIL`       | regex                              | Unicode local part and domain; requires a dotted TLD of >= 2 letters. |
+| `PHONE`       | regex                              | NANP-style 3-3-4, optional `+country`, `-`/`.`/space/parens separators. |
+| `SSN`         | regex                              | `###-##-####`.                                                     |
+| `MRN`         | regex (context-anchored)           | Requires an `MRN` prefix; only the digit run is redacted.          |
+| `DOB`         | regex                              | `mm/dd/yyyy` (1- or 2-digit month/day) or ISO `yyyy-mm-dd`.         |
+| `CREDIT_CARD` | regex + Luhn checksum              | Contiguous 13-19 digits, or standard printed groupings; Luhn-validated. |
+| `API_KEY`     | regex                              | Known prefixes (`sk-`, `AKIA`, `ghp_`) or a long high-entropy alnum run. |
+| `PERSON`, `LOCATION` | spaCy NER (optional `[ner]` extra) | Requires the `[ner]` extra, a spaCy model, and passing `SpacyRecognizer()` (see [Install](#install)). |
+
+Four redaction modes are available on every `Policy`: `mask`, `placeholder`,
+`hash`, and `tokenize` (reversible via `Redactor.reveal()`). See
+[Recognizers](https://clufy.github.io/spanguard/recognizers/) for the
+full detail and how to plug in a custom `Recognizer`.
+
+## Compliance / audit guarantee
+
+`result.audit` (an `AuditRecord`) is designed to be safe to log, ship to a
+SIEM, or hand to an auditor without a second review: it contains entity-type
+**counts**, a **policy hash** (so you can prove which redaction policy ran),
+and a **timestamp** — and structurally nothing else. No raw matched value, no
+span offsets, no context window. The test suite asserts this property directly
+so a future change that widens the audit record would fail CI, not just review.
+
+## Docs
+
+Full documentation, including the API reference, streaming redaction, and the
+CLI, is at [clufy.github.io/spanguard](https://clufy.github.io/spanguard).
+
+## Contributing
+
+Bug reports and pull requests are welcome — see
+[CONTRIBUTING.md](https://github.com/Clufy/spanguard/blob/master/CONTRIBUTING.md) for how to set up a dev environment and
+run the test suite.
+
+## Security
+
+To report a vulnerability, please see [SECURITY.md](https://github.com/Clufy/spanguard/blob/master/SECURITY.md) rather than
+opening a public issue.
+
+## License
+
+MIT — see [LICENSE](https://github.com/Clufy/spanguard/blob/master/LICENSE).

spanguard-0.1.0.dist-info/RECORD

@@ -0,0 +1,21 @@
+spanguard/__init__.py,sha256=cDdM_iTmnwDsvJdl48MUvsdrU0qVNTpDrgwtmhJnOlU,578
+spanguard/_keys.py,sha256=ALRpk3x3DPhRr2lC8nashz7HBgi7MeVhOF7AZ3N9gwY,989
+spanguard/_overlap.py,sha256=oerQogEcZee-CaPdIFXZrtAb_cMU1ffIO31-gwXIsCk,1927
+spanguard/_transform.py,sha256=s59lWT0HooZZPDR0OQLtyprXV1U1sXmDcY3wwM_pBeU,1683
+spanguard/cli.py,sha256=yWxe2DwmPRWThIMYN_4i_iMyzULXrbQtfxp8uzdyiGc,5379
+spanguard/policy.py,sha256=PqT9QAzB-9Jif6B9L0zfBVrREsXLb4kygQik3f3KGdE,854
+spanguard/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+spanguard/redactor.py,sha256=UPFCYGtlDI3O_Y2stnekrIlx-82f_k7q4m2pamgT_28,3692
+spanguard/result.py,sha256=itBgD-66yCBOO7xf_Nw1aONFjtKTAfj6hSCQK-Nwirg,1337
+spanguard/streaming.py,sha256=Ius82Ijc3DdAC5F6jcQzCL0CXn30HNceYuA2fZqXSGc,6815
+spanguard/tokenize.py,sha256=8E_oTFT9vfDMTht_-estSajjYeDx0Q6Tf13A5VBD_oE,2603
+spanguard/recognizers/__init__.py,sha256=vW8bvqpI0NRZY0tIEhKgSqzYPMvJaBSaLH0dk2wUgz0,290
+spanguard/recognizers/base.py,sha256=U7CGyV_B813rwZ5W33eYcrYb8fnUpFiF7thD61GtA2A,1006
+spanguard/recognizers/luhn.py,sha256=l4vKX9UGp3Px90W4xfd_9I7oC2KPBEuRtj9FXfHqZ8g,510
+spanguard/recognizers/ner.py,sha256=b6SfP5Jx0ccIesfE5pyRMaTNd7jSUxmdkisdkXHv-4g,2021
+spanguard/recognizers/regex_recognizers.py,sha256=t8BZwZhD0-hsdUC3i4lmyOnYhxQhj75QoXE0pvMdzgk,5004
+spanguard-0.1.0.dist-info/METADATA,sha256=R5idIrFfWqF846KEQAfx0QGxqo2vXRSXoSKgReLoFCQ,10516
+spanguard-0.1.0.dist-info/WHEEL,sha256=2iZrJkDIkeDh0k9SikKMqFuRP-ua6mb4Ir1AsER4BEw,87
+spanguard-0.1.0.dist-info/entry_points.txt,sha256=DcGxztV3YXOE4N9fdUTC8JHfPMkVuiwvr4qJzYekX58,49
+spanguard-0.1.0.dist-info/licenses/LICENSE,sha256=h7YUOU_WJFAP4W9WbZv2IbHwquJMioZBYqX1HlTPVfU,1074
+spanguard-0.1.0.dist-info/RECORD,,

spanguard-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.33.0
+Root-Is-Purelib: true
+Tag: py3-none-any

spanguard-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+spanguard = spanguard.cli:main

spanguard-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 spanguard authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.