Module redaction 

PII Redaction Types and Verification Registry

This module provides the core types for PII redaction and the server-side verification registry. Under Option A, the client scrubs + encrypts; the server verifies consistency and stores ciphertext.

Key types

• ScrubbedText: Text that has been through redaction. Private constructor.
• ScrubbedPayload: JSON payload that has been through redaction. Private constructor.
• RedactionManifest: Describes what was redacted (spans + vault inserts).
• RedactionRegistry: Server-side verifier + egress guard + redact-only fallback.

Structs

DetectedMatch 🔒

Internal: a detected match before overlap resolution.

ManifestViolation

A consistency violation between manifest and payload.

PiiDetector 🔒

A single PII detector: a compiled regex + metadata.

PiiViolation

A PII pattern detected during verification (text claimed scrubbed but isn’t).

RedactionManifest

Manifest describing what was redacted. Accompanies scrubbed text.

RedactionRegistry

Server-side PII verification registry and egress guard.

RedactionSpan

A single detected PII span within text.

ScrubbedPayload

JSON payload that has been through PII redaction.

ScrubbedText

Text that has been through PII redaction.

VaultInsert

Client-encrypted value for vault storage.

Enums

PiiType

PII type classification for detected sensitive data.

Functions

default_detectors 🔒

Compiled detectors, built once at startup.

requires_vault_insert 🔒

Whether a PII type requires a vault insert for reveal capability.

resolve_overlaps 🔒

Resolve overlapping matches: longest match wins. Input must be sorted by start position.