@discretion/core 0.1.0

package/dist/src/encoding/bech32.js

@@ -0,0 +1,108 @@
+/**
+ * Bech32 (BIP-173) and bech32m (BIP-350).
+ *
+ * The two differ ONLY in the final checksum constant — 1 for bech32,
+ * 0x2bc830a3 for bech32m — and mixing them up validates nothing: segwit v0
+ * addresses use bech32, v1+ (taproot) use bech32m, and Cardano Shelley
+ * addresses use bech32 far beyond BIP-173's 90-character limit, which is why
+ * decode() takes an explicit maxLength.
+ */
+const CHARSET = 'qpzry9x8gf2tvdw0s3jn54khce6mua7l';
+const CHAR_VALUES = new Map([...CHARSET].map((ch, i) => [ch, i]));
+const GENERATORS = [0x3b6a57b2, 0x26508e6d, 0x1ea119fa, 0x3d4233dd, 0x2a1462b3];
+const BECH32_CONST = 1;
+const BECH32M_CONST = 0x2bc830a3;
+function polymod(values) {
+    let chk = 1;
+    for (const v of values) {
+        const top = chk >>> 25;
+        chk = ((chk & 0x1ffffff) << 5) ^ v;
+        for (let i = 0; i < 5; i++) {
+            if ((top >>> i) & 1)
+                chk ^= GENERATORS[i];
+        }
+    }
+    return chk >>> 0;
+}
+function hrpExpand(hrp) {
+    const out = [];
+    for (const ch of hrp)
+        out.push(ch.charCodeAt(0) >> 5);
+    out.push(0);
+    for (const ch of hrp)
+        out.push(ch.charCodeAt(0) & 0x1f);
+    return out;
+}
+/**
+ * Decode a bech32/bech32m string, detecting which checksum closed it.
+ * Null on mixed case, malformed structure, or checksum failure.
+ */
+export function bech32Decode(input, maxLength = 90) {
+    if (input.length < 8 || input.length > maxLength)
+        return null;
+    const hasLower = /[a-z]/.test(input);
+    const hasUpper = /[A-Z]/.test(input);
+    if (hasLower && hasUpper)
+        return null; // BIP-173: mixed case is invalid
+    const s = input.toLowerCase();
+    const sep = s.lastIndexOf('1');
+    if (sep < 1 || sep + 7 > s.length)
+        return null;
+    const hrp = s.slice(0, sep);
+    for (const ch of hrp) {
+        const code = ch.charCodeAt(0);
+        if (code < 33 || code > 126)
+            return null;
+    }
+    const values = [];
+    for (const ch of s.slice(sep + 1)) {
+        const v = CHAR_VALUES.get(ch);
+        if (v === undefined)
+            return null;
+        values.push(v);
+    }
+    const check = polymod([...hrpExpand(hrp), ...values]);
+    const encoding = check === BECH32_CONST ? 'bech32' : check === BECH32M_CONST ? 'bech32m' : null;
+    if (encoding === null)
+        return null;
+    return { hrp, data: values.slice(0, -6), encoding };
+}
+/** Encode 5-bit data under an hrp with the requested checksum variant. */
+export function bech32Encode(hrp, data, encoding) {
+    const constant = encoding === 'bech32' ? BECH32_CONST : BECH32M_CONST;
+    const values = [...hrpExpand(hrp), ...data];
+    const target = polymod([...values, 0, 0, 0, 0, 0, 0]) ^ constant;
+    const checksum = [];
+    for (let i = 0; i < 6; i++)
+        checksum.push((target >>> (5 * (5 - i))) & 0x1f);
+    return `${hrp}1${[...data, ...checksum].map((v) => CHARSET[v]).join('')}`;
+}
+/**
+ * Regroup bits (5→8 for witness programs). Strict: rejects padding misuse.
+ * Null on overflow or illegal residue.
+ */
+export function convertBits(data, from, to, pad) {
+    let acc = 0;
+    let bits = 0;
+    const out = [];
+    const maxv = (1 << to) - 1;
+    for (const v of data) {
+        if (v < 0 || v >> from !== 0)
+            return null;
+        acc = (acc << from) | v;
+        bits += from;
+        while (bits >= to) {
+            bits -= to;
+            out.push((acc >> bits) & maxv);
+        }
+    }
+    if (pad) {
+        if (bits > 0)
+            out.push((acc << (to - bits)) & maxv);
+    }
+    else if (bits >= from || ((acc << (to - bits)) & maxv) !== 0) {
+        return null;
+    }
+    return out;
+}
+//# sourceMappingURL=bech32.js.map

package/dist/src/encoding/bech32.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bech32.js","sourceRoot":"","sources":["../../../src/encoding/bech32.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,OAAO,GAAG,kCAAkC,CAAC;AAEnD,MAAM,WAAW,GAAgC,IAAI,GAAG,CACtD,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CACrC,CAAC;AAEF,MAAM,UAAU,GAAsB,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AAEnG,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,aAAa,GAAG,UAAU,CAAC;AAEjC,SAAS,OAAO,CAAC,MAAyB;IACxC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,GAAG,KAAK,EAAE,CAAC;QACvB,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC;gBAAE,GAAG,IAAI,UAAU,CAAC,CAAC,CAAE,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,EAAE,IAAI,GAAG;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACZ,KAAK,MAAM,EAAE,IAAI,GAAG;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACxD,OAAO,GAAG,CAAC;AACb,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,SAAS,GAAG,EAAE;IACxD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,QAAQ,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC,CAAC,iCAAiC;IACxE,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAE9B,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,IAAI,GAAG,EAAE,IAAI,IAAI,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;IAC3C,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAChG,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEnC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;AACtD,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,YAAY,CAC1B,GAAW,EACX,IAAuB,EACvB,QAA8B;IAE9B,MAAM,QAAQ,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC;IACtE,MAAM,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC;IACjE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7E,OAAO,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,IAAuB,EACvB,IAAY,EACZ,EAAU,EACV,GAAY;IAEZ,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,GAAG,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,IAAI,IAAI,CAAC;QACb,OAAO,IAAI,IAAI,EAAE,EAAE,CAAC;YAClB,IAAI,IAAI,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,IAAI,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACtD,CAAC;SAAM,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/src/encoding/bytes.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Byte-array helpers shared by the hash and encoding primitives.
+ *
+ * Written here rather than using TextEncoder/Buffer so that
+ * `packages/core` stays free of every environment-provided global — the
+ * eslint fence bans DOM and Node names, and these three functions are the
+ * whole surface the primitives need.
+ */
+/** UTF-8 encode a string. */
+export declare function utf8ToBytes(s: string): Uint8Array;
+/** Lowercase hex for a byte array. */
+export declare function bytesToHex(bytes: Uint8Array): string;
+/** Parse hex (case-insensitive, no prefix) to bytes; null on malformed. */
+export declare function hexToBytes(hex: string): Uint8Array | null;
+//# sourceMappingURL=bytes.d.ts.map

package/dist/src/encoding/bytes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bytes.d.ts","sourceRoot":"","sources":["../../../src/encoding/bytes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,6BAA6B;AAC7B,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAoBjD;AAED,sCAAsC;AACtC,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIpD;AAED,2EAA2E;AAC3E,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAOzD"}

package/dist/src/encoding/bytes.js

@@ -0,0 +1,46 @@
+/**
+ * Byte-array helpers shared by the hash and encoding primitives.
+ *
+ * Written here rather than using TextEncoder/Buffer so that
+ * `packages/core` stays free of every environment-provided global — the
+ * eslint fence bans DOM and Node names, and these three functions are the
+ * whole surface the primitives need.
+ */
+/** UTF-8 encode a string. */
+export function utf8ToBytes(s) {
+    const out = [];
+    for (const ch of s) {
+        const cp = ch.codePointAt(0);
+        if (cp < 0x80) {
+            out.push(cp);
+        }
+        else if (cp < 0x800) {
+            out.push(0xc0 | (cp >> 6), 0x80 | (cp & 0x3f));
+        }
+        else if (cp < 0x10000) {
+            out.push(0xe0 | (cp >> 12), 0x80 | ((cp >> 6) & 0x3f), 0x80 | (cp & 0x3f));
+        }
+        else {
+            out.push(0xf0 | (cp >> 18), 0x80 | ((cp >> 12) & 0x3f), 0x80 | ((cp >> 6) & 0x3f), 0x80 | (cp & 0x3f));
+        }
+    }
+    return Uint8Array.from(out);
+}
+/** Lowercase hex for a byte array. */
+export function bytesToHex(bytes) {
+    let out = '';
+    for (const b of bytes)
+        out += b.toString(16).padStart(2, '0');
+    return out;
+}
+/** Parse hex (case-insensitive, no prefix) to bytes; null on malformed. */
+export function hexToBytes(hex) {
+    if (hex.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(hex))
+        return null;
+    const out = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < out.length; i++) {
+        out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    }
+    return out;
+}
+//# sourceMappingURL=bytes.js.map

package/dist/src/encoding/bytes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bytes.js","sourceRoot":"","sources":["../../../src/encoding/bytes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,6BAA6B;AAC7B,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC;QAC9B,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;aAAM,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;YACtB,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QACjD,CAAC;aAAM,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QAC7E,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CACN,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,EACjB,IAAI,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAC1B,IAAI,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,EACzB,IAAI,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CACnB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,UAAU,CAAC,KAAiB;IAC1C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/src/entityFamily.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Which family an entity type belongs to.
+ *
+ * In core rather than in a UI package for the same reason `labelOf` is, and
+ * recorded there first: "two maps drift the moment a type is added to one of
+ * them". There are now two consumers - the playground, where the family picks
+ * a highlight hue, and the extension's Local Insights, where it is the
+ * category counts are kept by ("this month: 12 secrets, 8 financial"). A type
+ * filed under `secret` in one and `other` in the other would make the two
+ * surfaces disagree about the same text.
+ *
+ * Pure data with no environment dependency, which is the bar for living here.
+ */
+import type { EntityType } from './types.js';
+/** Annotation families — each gets one hue in the ledger palette. */
+export type EntityFamily = 'contact' | 'financial' | 'identity' | 'document' | 'health' | 'secret' | 'network' | 'location' | 'person' | 'other';
+export declare function familyOf(type: EntityType): EntityFamily;
+//# sourceMappingURL=entityFamily.d.ts.map

package/dist/src/entityFamily.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entityFamily.d.ts","sourceRoot":"","sources":["../../src/entityFamily.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,qEAAqE;AACrE,MAAM,MAAM,YAAY,GACpB,SAAS,GACT,WAAW,GACX,UAAU,GACV,UAAU,GACV,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,UAAU,GACV,QAAQ,GACR,OAAO,CAAC;AAwCZ,wBAAgB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,YAAY,CAEvD"}

package/dist/src/entityFamily.js

@@ -0,0 +1,54 @@
+/**
+ * Which family an entity type belongs to.
+ *
+ * In core rather than in a UI package for the same reason `labelOf` is, and
+ * recorded there first: "two maps drift the moment a type is added to one of
+ * them". There are now two consumers - the playground, where the family picks
+ * a highlight hue, and the extension's Local Insights, where it is the
+ * category counts are kept by ("this month: 12 secrets, 8 financial"). A type
+ * filed under `secret` in one and `other` in the other would make the two
+ * surfaces disagree about the same text.
+ *
+ * Pure data with no environment dependency, which is the bar for living here.
+ */
+const FAMILY_BY_TYPE = {
+    EMAIL: 'contact',
+    PHONE: 'contact',
+    IP_ADDRESS: 'network',
+    MAC_ADDRESS: 'network',
+    URL_WITH_CREDENTIALS: 'secret',
+    CREDIT_CARD: 'financial',
+    IBAN: 'financial',
+    SWIFT_BIC: 'financial',
+    US_ROUTING_NUMBER: 'financial',
+    UK_SORT_CODE: 'financial',
+    CA_TRANSIT_NUMBER: 'financial',
+    AU_BSB: 'financial',
+    IN_IFSC: 'financial',
+    BR_AGENCIA: 'financial',
+    CRYPTO_WALLET: 'financial',
+    NATIONAL_ID: 'identity',
+    TAX_ID: 'identity',
+    VAT_NUMBER: 'identity',
+    PASSPORT_MRZ: 'document',
+    DRIVERS_LICENSE: 'document',
+    VIN: 'document',
+    US_NPI: 'document',
+    HEALTH_DATA: 'health',
+    API_KEY: 'secret',
+    PRIVATE_KEY: 'secret',
+    JWT: 'secret',
+    GENERIC_SECRET: 'secret',
+    CONNECTION_STRING: 'secret',
+    POSTAL_CODE: 'location',
+    STREET_ADDRESS: 'location',
+    COORDINATES: 'location',
+    PERSON: 'person',
+    ORG: 'person',
+    LOCATION: 'location',
+    DATE_OF_BIRTH: 'identity',
+};
+export function familyOf(type) {
+    return FAMILY_BY_TYPE[type] ?? 'other';
+}
+//# sourceMappingURL=entityFamily.js.map

package/dist/src/entityFamily.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entityFamily.js","sourceRoot":"","sources":["../../src/entityFamily.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAiBH,MAAM,cAAc,GAA+C;IACjE,KAAK,EAAE,SAAS;IAChB,KAAK,EAAE,SAAS;IAChB,UAAU,EAAE,SAAS;IACrB,WAAW,EAAE,SAAS;IACtB,oBAAoB,EAAE,QAAQ;IAC9B,WAAW,EAAE,WAAW;IACxB,IAAI,EAAE,WAAW;IACjB,SAAS,EAAE,WAAW;IACtB,iBAAiB,EAAE,WAAW;IAC9B,YAAY,EAAE,WAAW;IACzB,iBAAiB,EAAE,WAAW;IAC9B,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,WAAW;IACpB,UAAU,EAAE,WAAW;IACvB,aAAa,EAAE,WAAW;IAC1B,WAAW,EAAE,UAAU;IACvB,MAAM,EAAE,UAAU;IAClB,UAAU,EAAE,UAAU;IACtB,YAAY,EAAE,UAAU;IACxB,eAAe,EAAE,UAAU;IAC3B,GAAG,EAAE,UAAU;IACf,MAAM,EAAE,UAAU;IAClB,WAAW,EAAE,QAAQ;IACrB,OAAO,EAAE,QAAQ;IACjB,WAAW,EAAE,QAAQ;IACrB,GAAG,EAAE,QAAQ;IACb,cAAc,EAAE,QAAQ;IACxB,iBAAiB,EAAE,QAAQ;IAC3B,WAAW,EAAE,UAAU;IACvB,cAAc,EAAE,UAAU;IAC1B,WAAW,EAAE,UAAU;IACvB,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,QAAQ;IACb,QAAQ,EAAE,UAAU;IACpB,aAAa,EAAE,UAAU;CAC1B,CAAC;AAEF,MAAM,UAAU,QAAQ,CAAC,IAAgB;IACvC,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC;AACzC,CAAC"}

package/dist/src/entityLabel.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Human-readable names for entity types.
+ *
+ * In core rather than in a UI package because there are now two surfaces that
+ * must name the same type the same way — the playground and the extension's
+ * review panel — and two label maps drift the moment a type is added to one of
+ * them. The function is pure string work with no environment dependency, which
+ * is the bar for living here.
+ *
+ * Derived from the type name rather than a hand-written table, so a new entity
+ * type is labelled correctly without touching this file at all. Only the
+ * initialisms need listing: sentence case turns IBAN into "Iban", and a
+ * reviewer who sees "Iban" reasonably doubts everything else on the panel.
+ */
+import type { EntityType } from './types.js';
+/** e.g. 'CREDIT_CARD' -> 'Credit card', 'IN_IFSC' -> 'IN IFSC'. */
+export declare function labelOf(type: EntityType | string): string;
+//# sourceMappingURL=entityLabel.d.ts.map

package/dist/src/entityLabel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entityLabel.d.ts","sourceRoot":"","sources":["../../src/entityLabel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA6B7C,mEAAmE;AACnE,wBAAgB,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAUzD"}

package/dist/src/entityLabel.js

@@ -0,0 +1,53 @@
+/**
+ * Human-readable names for entity types.
+ *
+ * In core rather than in a UI package because there are now two surfaces that
+ * must name the same type the same way — the playground and the extension's
+ * review panel — and two label maps drift the moment a type is added to one of
+ * them. The function is pure string work with no environment dependency, which
+ * is the bar for living here.
+ *
+ * Derived from the type name rather than a hand-written table, so a new entity
+ * type is labelled correctly without touching this file at all. Only the
+ * initialisms need listing: sentence case turns IBAN into "Iban", and a
+ * reviewer who sees "Iban" reasonably doubts everything else on the panel.
+ */
+/** Initialisms that must not be sentence-cased, longest first. */
+const INITIALISMS = [
+    'IBAN',
+    'IFSC',
+    'BSB',
+    'MRZ',
+    'SWIFT',
+    'BIC',
+    'API',
+    'JWT',
+    'URL',
+    'MAC',
+    'NPI',
+    'VAT',
+    'VIN',
+    'ID',
+    'IP',
+    'US',
+    'UK',
+    'CA',
+    'AU',
+    'IN',
+    'BR',
+];
+const INITIALISM_SET = new Set(INITIALISMS.map((word) => word.toLowerCase()));
+/** e.g. 'CREDIT_CARD' -> 'Credit card', 'IN_IFSC' -> 'IN IFSC'. */
+export function labelOf(type) {
+    const words = type.toLowerCase().split('_');
+    return words
+        .map((word, index) => {
+        const upper = word.toUpperCase();
+        if (INITIALISM_SET.has(word))
+            return upper;
+        // Only the first word is capitalised: "Credit card", not "Credit Card".
+        return index === 0 ? word.charAt(0).toUpperCase() + word.slice(1) : word;
+    })
+        .join(' ');
+}
+//# sourceMappingURL=entityLabel.js.map

package/dist/src/entityLabel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entityLabel.js","sourceRoot":"","sources":["../../src/entityLabel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,kEAAkE;AAClE,MAAM,WAAW,GAAG;IAClB,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,OAAO;IACP,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;CACL,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAE9E,mEAAmE;AACnE,MAAM,UAAU,OAAO,CAAC,IAAyB;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,wEAAwE;QACxE,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC"}

package/dist/src/entityTypes.d.ts

@@ -0,0 +1,64 @@
+/**
+ * entityTypes.ts — runtime enumeration of `EntityType`.
+ *
+ * ─────────────────────────────────────────────────────────────────────────
+ * WHY THIS EXISTS IN CORE
+ *
+ * `EntityType` is a TypeScript union, so it has no runtime representation. Any
+ * consumer that needs to iterate the types — an options page, a report, a
+ * coverage check — has to write the list out by hand, and every hand-written
+ * copy is a place the list can go stale when the union grows.
+ *
+ * Until M12 the only such list lived in the extension's options page. That is
+ * the wrong package for it: which entity types exist, and which of them
+ * anything can actually produce, are facts about the DETECTION ENGINE, and a
+ * published library consumer has no access to the extension at all.
+ *
+ * ─────────────────────────────────────────────────────────────────────────
+ * DECLARED vs DERIVED, AND THE BUG THAT MOTIVATED IT
+ *
+ * `ALL_ENTITY_TYPES` must be declared: there is nothing to derive it from.
+ * `Record<EntityType, true>` makes an omission a COMPILE ERROR, which is the
+ * only guarantee available.
+ *
+ * `detectableEntityTypes()` is the opposite: it is DERIVED from the detector
+ * registry and the Stage 2 output types, never declared. M11 found that the
+ * options page offered a `DATE_OF_BIRTH` toggle although no Stage 1 detector
+ * emits it and Stage 2 emits only PERSON/ORG/LOCATION — a control that did
+ * nothing in either position, which is a quiet claim that the type is being
+ * looked for. Nothing in the test suite could have caught it, because every
+ * test agreed with the code that all 35 types were offered.
+ *
+ * Deriving the answer is what stops that recurring. When a `DATE_OF_BIRTH`
+ * detector is registered the type reappears here on its own, and when a type
+ * loses its last detector it disappears the same way.
+ */
+import type { NerEntityType } from './ner/types.js';
+import type { EntityType } from './types.js';
+/** Every entity type the engine models, detectable or not. */
+export declare const ALL_ENTITY_TYPES: readonly EntityType[];
+/** The types Stage 2's model can produce. */
+export declare const NER_ENTITY_TYPES: readonly NerEntityType[];
+/**
+ * The types anything can actually produce: those with at least one registered
+ * Stage 1 detector, plus those Stage 2 emits.
+ *
+ * RECOMPUTED ON EVERY CALL, and deliberately not memoised. The first version
+ * cached the answer on the reasoning that the registry only grows. It does
+ * only grow — but `registerDetector` is public API, so a consumer who adds a
+ * detector for their own identifier format and then asks which types are
+ * detectable would have been told the answer from before their own call. A
+ * cache that is only correct until someone uses another part of the API is
+ * worse than no cache.
+ *
+ * The work is a scan of the registry per type: 35 types against ~113
+ * detectors, no allocation beyond the result. That is not worth a correctness
+ * hazard.
+ *
+ * Reading the registry at call time is also what makes the answer safe at any
+ * point in the import cycle: detectors register as a side effect of importing
+ * the package, and a module-level constant here would have been evaluated
+ * during that same import, possibly yielding a confidently empty list.
+ */
+export declare function detectableEntityTypes(): readonly EntityType[];
+//# sourceMappingURL=entityTypes.d.ts.map

package/dist/src/entityTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entityTypes.d.ts","sourceRoot":"","sources":["../../src/entityTypes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAqB7C,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB,EAAE,SAAS,UAAU,EAEjD,CAAC;AAaF,6CAA6C;AAC7C,eAAO,MAAM,gBAAgB,EAAE,SAAS,aAAa,EAEpD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,qBAAqB,IAAI,SAAS,UAAU,EAAE,CAK7D"}

package/dist/src/entityTypes.js

@@ -0,0 +1,94 @@
+/**
+ * entityTypes.ts — runtime enumeration of `EntityType`.
+ *
+ * ─────────────────────────────────────────────────────────────────────────
+ * WHY THIS EXISTS IN CORE
+ *
+ * `EntityType` is a TypeScript union, so it has no runtime representation. Any
+ * consumer that needs to iterate the types — an options page, a report, a
+ * coverage check — has to write the list out by hand, and every hand-written
+ * copy is a place the list can go stale when the union grows.
+ *
+ * Until M12 the only such list lived in the extension's options page. That is
+ * the wrong package for it: which entity types exist, and which of them
+ * anything can actually produce, are facts about the DETECTION ENGINE, and a
+ * published library consumer has no access to the extension at all.
+ *
+ * ─────────────────────────────────────────────────────────────────────────
+ * DECLARED vs DERIVED, AND THE BUG THAT MOTIVATED IT
+ *
+ * `ALL_ENTITY_TYPES` must be declared: there is nothing to derive it from.
+ * `Record<EntityType, true>` makes an omission a COMPILE ERROR, which is the
+ * only guarantee available.
+ *
+ * `detectableEntityTypes()` is the opposite: it is DERIVED from the detector
+ * registry and the Stage 2 output types, never declared. M11 found that the
+ * options page offered a `DATE_OF_BIRTH` toggle although no Stage 1 detector
+ * emits it and Stage 2 emits only PERSON/ORG/LOCATION — a control that did
+ * nothing in either position, which is a quiet claim that the type is being
+ * looked for. Nothing in the test suite could have caught it, because every
+ * test agreed with the code that all 35 types were offered.
+ *
+ * Deriving the answer is what stops that recurring. When a `DATE_OF_BIRTH`
+ * detector is registered the type reappears here on its own, and when a type
+ * loses its last detector it disappears the same way.
+ */
+import { detectorsForEntityType } from './detect/registry.js';
+/**
+ * Every member of `EntityType`, in a stable, family-grouped order.
+ *
+ * The `Record<EntityType, true>` annotation is load-bearing: adding a member
+ * to the union without adding it here fails to compile.
+ */
+const ALL_TYPES = {
+    EMAIL: true, PHONE: true, IP_ADDRESS: true, MAC_ADDRESS: true,
+    URL_WITH_CREDENTIALS: true, CREDIT_CARD: true, IBAN: true, SWIFT_BIC: true,
+    US_ROUTING_NUMBER: true, UK_SORT_CODE: true, CA_TRANSIT_NUMBER: true,
+    AU_BSB: true, IN_IFSC: true, BR_AGENCIA: true, CRYPTO_WALLET: true,
+    NATIONAL_ID: true, TAX_ID: true, VAT_NUMBER: true, PASSPORT_MRZ: true,
+    DRIVERS_LICENSE: true, VIN: true, US_NPI: true, HEALTH_DATA: true,
+    API_KEY: true, PRIVATE_KEY: true, JWT: true, GENERIC_SECRET: true,
+    CONNECTION_STRING: true, POSTAL_CODE: true, STREET_ADDRESS: true,
+    COORDINATES: true, PERSON: true, ORG: true, LOCATION: true,
+    DATE_OF_BIRTH: true,
+};
+/** Every entity type the engine models, detectable or not. */
+export const ALL_ENTITY_TYPES = Object.freeze(Object.keys(ALL_TYPES));
+/**
+ * The types Stage 2 can emit.
+ *
+ * Declared for the same reason as `ALL_TYPES` — `NerEntityType` is a union —
+ * and annotated the same way so that widening the union fails to compile here
+ * rather than silently narrowing `detectableEntityTypes()`.
+ */
+const NER_TYPES = {
+    PERSON: true, ORG: true, LOCATION: true,
+};
+/** The types Stage 2's model can produce. */
+export const NER_ENTITY_TYPES = Object.freeze(Object.keys(NER_TYPES));
+/**
+ * The types anything can actually produce: those with at least one registered
+ * Stage 1 detector, plus those Stage 2 emits.
+ *
+ * RECOMPUTED ON EVERY CALL, and deliberately not memoised. The first version
+ * cached the answer on the reasoning that the registry only grows. It does
+ * only grow — but `registerDetector` is public API, so a consumer who adds a
+ * detector for their own identifier format and then asks which types are
+ * detectable would have been told the answer from before their own call. A
+ * cache that is only correct until someone uses another part of the API is
+ * worse than no cache.
+ *
+ * The work is a scan of the registry per type: 35 types against ~113
+ * detectors, no allocation beyond the result. That is not worth a correctness
+ * hazard.
+ *
+ * Reading the registry at call time is also what makes the answer safe at any
+ * point in the import cycle: detectors register as a side effect of importing
+ * the package, and a module-level constant here would have been evaluated
+ * during that same import, possibly yielding a confidently empty list.
+ */
+export function detectableEntityTypes() {
+    const ner = new Set(NER_ENTITY_TYPES);
+    return ALL_ENTITY_TYPES.filter((type) => detectorsForEntityType(type).length > 0 || ner.has(type));
+}
+//# sourceMappingURL=entityTypes.js.map

package/dist/src/entityTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entityTypes.js","sourceRoot":"","sources":["../../src/entityTypes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAI9D;;;;;GAKG;AACH,MAAM,SAAS,GAAuC;IACpD,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI;IAC7D,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI;IAC1E,iBAAiB,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI;IACpE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI;IAClE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI;IACrE,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI;IACjE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI;IACjE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI;IAChE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI;IAC1D,aAAa,EAAE,IAAI;CACpB,CAAC;AAEF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAA0B,MAAM,CAAC,MAAM,CAClE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAiB,CACvC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,SAAS,GAA0C;IACvD,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI;CACxC,CAAC;AAEF,6CAA6C;AAC7C,MAAM,CAAC,MAAM,gBAAgB,GAA6B,MAAM,CAAC,MAAM,CACrE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAoB,CAC1C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,gBAAgB,CAAC,CAAC;IAC9C,OAAO,gBAAgB,CAAC,MAAM,CAC5B,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CACnE,CAAC;AACJ,CAAC"}

package/dist/src/exposure/index.d.ts

@@ -0,0 +1,86 @@
+/**
+ * The EXPOSURE SCORE.
+ *
+ * SPEC.md: "A document-level, user-facing sensitivity summary, computed in
+ * core … EXPLAINABLE BY CONSTRUCTION: a deterministic aggregation of
+ * calibrated confidence × category severity weight × per-type factors, and the
+ * report decomposes the total into named contributions. A score that cannot
+ * show its work is not acceptable."
+ *
+ * MONOTONICITY IS STRUCTURAL, NOT INCIDENTAL. SPEC requires that adding a
+ * detected entity never lowers the score and removing one never raises it. The
+ * aggregation below is a sum of non-negative per-entity contributions passed
+ * through a saturating transform that is strictly increasing. Both halves
+ * matter: if a contribution could be negative, or the transform could
+ * decrease, the property would fail. It is therefore not something to test for
+ * and hope — it holds because of the shape of the arithmetic, and the test
+ * exists to catch a future change that breaks the shape.
+ *
+ * WHY SATURATION AT ALL. A raw sum is unbounded and unreadable: a document
+ * with forty identifiers would score in the thousands and mean nothing to a
+ * user. The score is mapped into 0–100 by a saturating curve so that "how
+ * exposed is this document" stays comparable between a short message and a
+ * long one. Saturation is strictly increasing, so monotonicity survives it —
+ * a fortieth entity adds less than the first, but it never adds less than
+ * nothing.
+ *
+ * THE LIMITATION, which SPEC requires be stated wherever the score is shown,
+ * travels with the report itself rather than living only in the UI: see
+ * `ExposureReport.limitation`.
+ */
+import { type SeverityCategory } from '@discretion/data';
+import type { EntityType } from '../types.js';
+export interface ExposureContribution {
+    readonly type: EntityType;
+    readonly category: SeverityCategory;
+    /** The entity's calibrated confidence, as it entered the sum. */
+    readonly confidence: number;
+    /** Category severity weight, 0–100. */
+    readonly weight: number;
+    /** Per-type factor applied within the category. */
+    readonly factor: number;
+    /** confidence × weight × factor — this entity's share of the raw sum. */
+    readonly points: number;
+    /** Short human-readable text for the report. */
+    readonly detail: string;
+}
+export interface CategoryBreakdown {
+    readonly category: SeverityCategory;
+    readonly entities: number;
+    readonly points: number;
+    /** Share of the raw total, 0–1. */
+    readonly share: number;
+}
+export interface ExposureReport {
+    /** Overall exposure, 0–100. */
+    readonly score: number;
+    /** The un-saturated sum, so the transform can be checked by a reader. */
+    readonly rawPoints: number;
+    readonly byCategory: readonly CategoryBreakdown[];
+    /** Highest-contributing entities first. */
+    readonly topContributors: readonly ExposureContribution[];
+    /** Every contribution, so the total demonstrably decomposes. */
+    readonly contributions: readonly ExposureContribution[];
+    /** Stated wherever the score is shown, per SPEC. */
+    readonly limitation: string;
+}
+/** What the engine needs from an entity. Deliberately minimal. */
+export interface ExposureInput {
+    readonly type: EntityType;
+    readonly calibratedConfidence: number;
+}
+export declare const EXPOSURE_LIMITATION: string;
+/**
+ * Compute a document's exposure.
+ *
+ * Deterministic: the same entities in any order produce the same score, which
+ * matters because the report is shown to a user and must not flicker as
+ * detection order changes.
+ */
+export declare function computeExposure(entities: readonly ExposureInput[]): ExposureReport;
+/**
+ * A band for presentation. Thresholds are presentational only — every decision
+ * the pipeline makes uses calibrated confidence, never this label.
+ */
+export declare function exposureBand(score: number): 'none' | 'low' | 'moderate' | 'high' | 'severe';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/exposure/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/exposure/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAA+C,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACtG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAgB9C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uCAAuC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mCAAmC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,+BAA+B;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAClD,2CAA2C;IAC3C,QAAQ,CAAC,eAAe,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC1D,gEAAgE;IAChE,QAAQ,CAAC,aAAa,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACxD,oDAAoD;IACpD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAED,eAAO,MAAM,mBAAmB,QAE6B,CAAC;AAwC9D;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,GAAG,cAAc,CAoClF;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,CAM3F"}