@jinn-network/client 0.1.8 → 0.1.9-canary.023faefb

package/dist/trajectory/scrub/emit-scrub.js

@@ -0,0 +1,88 @@
+import { computeGenesisHash, computePrevSpanHash } from '../hash-chain.js';
+/**
+ * Seller-side scrub applied at emit time, before a trajectory is signed and
+ * published. Runs every span's attributes (and each event's attributes) through
+ * the pipeline, rebuilds the prev-span hash chain over the scrubbed spans, and
+ * produces the redaction manifest (one entry per span listing the keys touched;
+ * `event.<key>` for event-attribute redactions).
+ */
+export async function scrubSpansForEmit(spans, pipeline, taskCid) {
+    const out = [];
+    const manifestSpans = [];
+    let total = 0;
+    let prev = computeGenesisHash(taskCid);
+    for (const span of spans) {
+        const redactedKeys = new Set();
+        const attrResult = await pipeline.run(span.attributes ?? {});
+        for (const r of attrResult.redactions)
+            redactedKeys.add(r.key);
+        const events = [];
+        for (const event of span.events) {
+            if (event.attributes && Object.keys(event.attributes).length > 0) {
+                const evResult = await pipeline.run(event.attributes);
+                events.push({ ...event, attributes: evResult.attributes });
+                for (const r of evResult.redactions)
+                    redactedKeys.add(`event.${r.key}`);
+            }
+            else {
+                events.push(event);
+            }
+        }
+        const scrubbed = {
+            ...span,
+            attributes: { ...attrResult.attributes, 'jinn.prevSpanHash': prev },
+            events,
+        };
+        out.push(scrubbed);
+        prev = computePrevSpanHash(scrubbed);
+        if (redactedKeys.size > 0) {
+            const keys = [...redactedKeys];
+            manifestSpans.push({ spanId: span.spanId, redactedKeys: keys });
+            total += keys.length;
+        }
+    }
+    return { spans: out, redactionManifest: { spans: manifestSpans, totalRedactions: total } };
+}
+/**
+ * Seller-side scrub for capture spans, applied at publish time before the
+ * capture trajectory is uploaded. Runs each span's attributes through the
+ * pipeline, replacing them with the scrubbed values, and unions the pipeline's
+ * redactions into the span's existing `redactedKeys`. Unlike
+ * {@link scrubSpansForEmit} it does NOT touch events or inject a hash chain —
+ * capture spans carry neither. Generic over the span type so the concrete
+ * `SpanRow` (with its extra columns) is returned unchanged apart from
+ * `attributes` and `redactedKeys`.
+ */
+export async function scrubCaptureSpans(spans, pipeline) {
+    const out = [];
+    for (const span of spans) {
+        const result = await pipeline.run(span.attributes ?? {});
+        const redactedKeys = new Set(span.redactedKeys);
+        for (const r of result.redactions)
+            redactedKeys.add(r.key);
+        out.push({ ...span, attributes: result.attributes, redactedKeys: [...redactedKeys] });
+    }
+    return out;
+}
+/**
+ * Unions two redaction manifests by spanId (dedup redactedKeys per span). Used
+ * when an ingestion-time manifest (e.g. a capture's stored redactedKeys) is
+ * combined with the emit-time pipeline manifest. Keeps the
+ * `totalRedactions === sum(redactedKeys)` invariant the schema enforces.
+ */
+export function mergeRedactionManifests(a, b) {
+    const bySpan = new Map();
+    for (const m of [a, b]) {
+        for (const s of m.spans) {
+            const set = bySpan.get(s.spanId) ?? new Set();
+            for (const k of s.redactedKeys)
+                set.add(k);
+            bySpan.set(s.spanId, set);
+        }
+    }
+    const spans = [...bySpan]
+        .map(([spanId, keys]) => ({ spanId, redactedKeys: [...keys] }))
+        .filter((s) => s.redactedKeys.length > 0);
+    return { spans, totalRedactions: spans.reduce((n, s) => n + s.redactedKeys.length, 0) };
+}
+//# sourceMappingURL=emit-scrub.js.map

package/dist/trajectory/scrub/emit-scrub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emit-scrub.js","sourceRoot":"","sources":["../../../src/trajectory/scrub/emit-scrub.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAI3E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAa,EACb,QAAuB,EACvB,OAAe;IAEf,MAAM,GAAG,GAAW,EAAE,CAAC;IACvB,MAAM,aAAa,GAA+B,EAAE,CAAC;IACrD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAEvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;QAEvC,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QAC7D,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,UAAU;YAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAE/D,MAAM,MAAM,GAAmB,EAAE,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACtD,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;gBAC3D,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,UAAU;oBAAE,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1E,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAS;YACrB,GAAG,IAAI;YACP,UAAU,EAAE,EAAE,GAAG,UAAU,CAAC,UAAU,EAAE,mBAAmB,EAAE,IAAI,EAAE;YACnE,MAAM;SACP,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnB,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAErC,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;YAC/B,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,KAAK,EAAE,EAAE,CAAC;AAC7F,CAAC;AAaD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAU,EACV,QAAuB;IAEvB,MAAM,GAAG,GAAQ,EAAE,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAChD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU;YAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3D,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,CAAoB,EAAE,CAAoB;IAChF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YACtD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC;SACtB,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;SAC9D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5C,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC;AAC1F,CAAC"}

package/dist/trajectory/scrub/key-policy.d.ts

@@ -0,0 +1,20 @@
+import type { ScrubStage } from './types.js';
+export interface KeyPolicy {
+    /** keys whose values are structural and safe to publish raw */
+    safe: string[];
+    /** keys to delete entirely (never published) */
+    drop: string[];
+}
+export type KeyClass = 'safe' | 'content' | 'drop';
+/**
+ * Classify an attribute key against the policy. `drop` wins over `safe` (a key
+ * matching both is dropped — fail safe). Unmatched keys are `content` and flow
+ * to the value-scrubbing stages.
+ */
+export declare function classifyKey(key: string, policy: KeyPolicy): KeyClass;
+/**
+ * Structural key-policy stage: deletes `drop` keys outright (recording a
+ * redaction) and passes `safe` + `content` keys through unchanged. Value-level
+ * scrubbing of `content` keys is handled by later stages.
+ */
+export declare function keyPolicyStage(policy: KeyPolicy): ScrubStage;

package/dist/trajectory/scrub/key-policy.js

@@ -0,0 +1,43 @@
+const VERSION = '0.1.0';
+/** Exact match, or prefix match when the pattern ends with `*`. */
+function matches(key, pattern) {
+    if (pattern.endsWith('*'))
+        return key.startsWith(pattern.slice(0, -1));
+    return key === pattern;
+}
+/**
+ * Classify an attribute key against the policy. `drop` wins over `safe` (a key
+ * matching both is dropped — fail safe). Unmatched keys are `content` and flow
+ * to the value-scrubbing stages.
+ */
+export function classifyKey(key, policy) {
+    if (policy.drop.some((p) => matches(key, p)))
+        return 'drop';
+    if (policy.safe.some((p) => matches(key, p)))
+        return 'safe';
+    return 'content';
+}
+/**
+ * Structural key-policy stage: deletes `drop` keys outright (recording a
+ * redaction) and passes `safe` + `content` keys through unchanged. Value-level
+ * scrubbing of `content` keys is handled by later stages.
+ */
+export function keyPolicyStage(policy) {
+    return {
+        name: 'key-policy',
+        version: VERSION,
+        scrub(attributes) {
+            const out = {};
+            const redactions = [];
+            for (const [key, value] of Object.entries(attributes)) {
+                if (classifyKey(key, policy) === 'drop') {
+                    redactions.push({ key, stage: 'key-policy', kind: 'dropped-key' });
+                    continue;
+                }
+                out[key] = value;
+            }
+            return { attributes: out, redactions };
+        },
+    };
+}
+//# sourceMappingURL=key-policy.js.map

package/dist/trajectory/scrub/key-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-policy.js","sourceRoot":"","sources":["../../../src/trajectory/scrub/key-policy.ts"],"names":[],"mappings":"AAWA,MAAM,OAAO,GAAG,OAAO,CAAC;AAExB,mEAAmE;AACnE,SAAS,OAAO,CAAC,GAAW,EAAE,OAAe;IAC3C,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,OAAO,GAAG,KAAK,OAAO,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,MAAiB;IACxD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5D,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAiB;IAC9C,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,OAAO;QAChB,KAAK,CAAC,UAAsB;YAC1B,MAAM,GAAG,GAAe,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAsB,EAAE,CAAC;YACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtD,IAAI,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;oBACxC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;oBACnE,SAAS;gBACX,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACnB,CAAC;YACD,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/trajectory/scrub/layer2.d.ts

@@ -0,0 +1,23 @@
+import { ScrubPipeline } from './pipeline.js';
+import { type KeyPolicy } from './key-policy.js';
+/**
+ * The layer-2 / public / derived-content scrub altitude
+ * (spec/2026-07-06-distillation-v1.md §10, D6; reconciled 2026-07-07 with the
+ * shipped #1409 seed profile).
+ *
+ * Secret-only: the structural key policy + deterministic plain-patterns
+ * (emails, home-dir paths, credential-ID prefixes — #1330/#1415) + the FULL
+ * secretlint stage (including its Pass-2 entropy secret-shape fallback). It
+ * deliberately DROPS openredaction and ML-PII — the stages whose PII
+ * shape-matching and trigger-word behaviour deface ordinary public prose
+ * (#1409).
+ *
+ * Mode note vs the seed profile (`buildSeedScrubPipeline`): seeds are
+ * REDACT-mode (the scrubbed output is published, so prose must survive →
+ * entropy fallback OFF there). This pipeline serves CHECK-mode consumers —
+ * `distillClusters` REJECTS a skill on any scrub change rather than publishing
+ * a redacted body — so a false positive costs one re-distill, never defaces
+ * published content, and the entropy fallback stays ON as the stricter net for
+ * a fresh secret surface (DR-2026-07-06 decision 3).
+ */
+export declare function buildLayer2ScrubPipeline(policy?: KeyPolicy): ScrubPipeline;

package/dist/trajectory/scrub/layer2.js

@@ -0,0 +1,33 @@
+import { ScrubPipeline } from './pipeline.js';
+import { keyPolicyStage } from './key-policy.js';
+import { secretlintStage } from './secretlint-stage.js';
+import { plainPatternsStage } from './plain-patterns-stage.js';
+import { DEFAULT_KEY_POLICY } from './build.js';
+/**
+ * The layer-2 / public / derived-content scrub altitude
+ * (spec/2026-07-06-distillation-v1.md §10, D6; reconciled 2026-07-07 with the
+ * shipped #1409 seed profile).
+ *
+ * Secret-only: the structural key policy + deterministic plain-patterns
+ * (emails, home-dir paths, credential-ID prefixes — #1330/#1415) + the FULL
+ * secretlint stage (including its Pass-2 entropy secret-shape fallback). It
+ * deliberately DROPS openredaction and ML-PII — the stages whose PII
+ * shape-matching and trigger-word behaviour deface ordinary public prose
+ * (#1409).
+ *
+ * Mode note vs the seed profile (`buildSeedScrubPipeline`): seeds are
+ * REDACT-mode (the scrubbed output is published, so prose must survive →
+ * entropy fallback OFF there). This pipeline serves CHECK-mode consumers —
+ * `distillClusters` REJECTS a skill on any scrub change rather than publishing
+ * a redacted body — so a false positive costs one re-distill, never defaces
+ * published content, and the entropy fallback stays ON as the stricter net for
+ * a fresh secret surface (DR-2026-07-06 decision 3).
+ */
+export function buildLayer2ScrubPipeline(policy = DEFAULT_KEY_POLICY) {
+    return new ScrubPipeline([
+        keyPolicyStage(policy),
+        plainPatternsStage(policy, { credentialIds: true }),
+        secretlintStage(policy),
+    ]);
+}
+//# sourceMappingURL=layer2.js.map

package/dist/trajectory/scrub/layer2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"layer2.js","sourceRoot":"","sources":["../../../src/trajectory/scrub/layer2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAkB,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAoB,kBAAkB;IAC7E,OAAO,IAAI,aAAa,CAAC;QACvB,cAAc,CAAC,MAAM,CAAC;QACtB,kBAAkB,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QACnD,eAAe,CAAC,MAAM,CAAC;KACxB,CAAC,CAAC;AACL,CAAC"}

package/dist/trajectory/scrub/ml-pii-stage.d.ts

@@ -0,0 +1,24 @@
+import { type KeyPolicy } from './key-policy.js';
+import type { ScrubStage } from './types.js';
+/** A PII entity detected in text: a label (PER/ORG/LOC/…) and the matched span text. */
+export interface PiiEntity {
+    label: string;
+    text: string;
+}
+/**
+ * ML PII detector seam. The production implementation wraps a Transformers.js
+ * token-classification (NER) model; tests inject a deterministic fake. Kept
+ * behind an interface so the stage logic is unit-tested without loading a model.
+ */
+export interface PiiDetector {
+    detect(text: string): Promise<PiiEntity[]>;
+}
+/**
+ * ML PII stage. Runs the injected NER detector over each `content`-classified
+ * string value and replaces whole-word occurrences of each detected entity with
+ * `[PII:<label>]` (word-boundary matching so substrings aren't corrupted — e.g.
+ * detecting "London" leaves "Londoner" intact). `safe` and non-string values
+ * pass through untouched. The detector returns matched text rather than offsets
+ * because the Transformers.js NER pipeline does not surface character offsets.
+ */
+export declare function mlPiiStage(policy: KeyPolicy, detector: PiiDetector): ScrubStage;

package/dist/trajectory/scrub/ml-pii-stage.js

@@ -0,0 +1,43 @@
+import { classifyKey } from './key-policy.js';
+const VERSION = '0.1.0';
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * ML PII stage. Runs the injected NER detector over each `content`-classified
+ * string value and replaces whole-word occurrences of each detected entity with
+ * `[PII:<label>]` (word-boundary matching so substrings aren't corrupted — e.g.
+ * detecting "London" leaves "Londoner" intact). `safe` and non-string values
+ * pass through untouched. The detector returns matched text rather than offsets
+ * because the Transformers.js NER pipeline does not surface character offsets.
+ */
+export function mlPiiStage(policy, detector) {
+    return {
+        name: 'ml-pii',
+        version: VERSION,
+        async scrub(attributes) {
+            const out = {};
+            const redactions = [];
+            for (const [key, value] of Object.entries(attributes)) {
+                if (typeof value !== 'string' || classifyKey(key, policy) !== 'content') {
+                    out[key] = value;
+                    continue;
+                }
+                let text = value;
+                for (const ent of await detector.detect(value)) {
+                    if (!ent.text)
+                        continue;
+                    const re = new RegExp(`\\b${escapeRegExp(ent.text)}\\b`, 'g');
+                    const replaced = text.replace(re, `[PII:${ent.label}]`);
+                    if (replaced !== text) {
+                        redactions.push({ key, stage: 'ml-pii', kind: 'pii', detail: ent.label });
+                        text = replaced;
+                    }
+                }
+                out[key] = text;
+            }
+            return { attributes: out, redactions };
+        },
+    };
+}
+//# sourceMappingURL=ml-pii-stage.js.map

package/dist/trajectory/scrub/ml-pii-stage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ml-pii-stage.js","sourceRoot":"","sources":["../../../src/trajectory/scrub/ml-pii-stage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAkB,MAAM,iBAAiB,CAAC;AAkB9D,MAAM,OAAO,GAAG,OAAO,CAAC;AAExB,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,MAAiB,EAAE,QAAqB;IACjE,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO;QAChB,KAAK,CAAC,KAAK,CAAC,UAAsB;YAChC,MAAM,GAAG,GAAe,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAsB,EAAE,CAAC;YAEzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;oBACxE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;oBACjB,SAAS;gBACX,CAAC;gBAED,IAAI,IAAI,GAAG,KAAK,CAAC;gBACjB,KAAK,MAAM,GAAG,IAAI,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/C,IAAI,CAAC,GAAG,CAAC,IAAI;wBAAE,SAAS;oBACxB,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC;oBACxD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;wBACtB,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;wBAC1E,IAAI,GAAG,QAAQ,CAAC;oBAClB,CAAC;gBACH,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YAClB,CAAC;YAED,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/trajectory/scrub/openredaction-stage.d.ts

@@ -0,0 +1,178 @@
+import { OpenRedaction } from 'openredaction';
+import { type KeyPolicy } from './key-policy.js';
+import type { ScrubStage } from './types.js';
+/**
+ * Patterns excluded from the default detector (#1331). All three ship with a
+ * bare-word regex (`\b[a-zA-Z0-9._]{3,30}\b` or equivalent) that matches
+ * nearly every token of ordinary technical prose — "Update the staging
+ * bucket config" came back as `[IG_USER_…] the staging [IG_USER_…]
+ * [IG_USER_…]`, destroying the readability and distillation value of every
+ * published trajectory. A social handle has no shape of its own outside its
+ * platform context, so dropping these loses no genuine coverage: emails,
+ * keys, cards, SSNs, phones etc. all keep their dedicated patterns (pinned
+ * by test/trajectory/scrub/openredaction-tuning.test.ts and the
+ * harness-layer seeded-secrets fixture).
+ *
+ * `NAME` is denylisted for the same reason with an acknowledged trade-off:
+ * its follower branch accepts lowercase words (`[A-Z][a-z…]+ (\s+[a-z…]+){1,3}`),
+ * so ANY sentence-initial capitalised word plus 1–3 words matches — "Fix the
+ * failing test" is a "name" to it, which mangles the first sentence of
+ * essentially every task summary. Person-name detection is the ML PII
+ * stage's job (GLiNER, `mlPiiStage`), which the daemon wires when the model
+ * is available; a bare unlabelled name in prose is not regex-detectable at
+ * acceptable precision.
+ *
+ * `LAB_TEST_ID` and `EXAM_ID` are denylisted for the same reason (#1348):
+ * both trigger on ubiquitous software words (`\b(?:LAB|TEST|SAMPLE)…` and
+ * `\b(?:EXAM|TEST|QUIZ|ASSESSMENT)…`, case-insensitive, same bare
+ * `[A-Z0-9]{6,12}` tail) — "test-driven-development" came back as
+ * `test-[LAB_8465]-development` — and lab-specimen / exam IDs are not
+ * plausible in agent-trajectory content. Nothing in the seeded-secrets
+ * fixture pins either pattern.
+ *
+ * #1391 additions (full 42-seed characterisation) — bare-SHAPE patterns
+ * whose regex matches ordinary technical tokens with no trigger word at all:
+ *
+ * - `ZIP_CODE_US` — `\b\d{5}(…)?\b`: ANY 5-digit number. Fired on GitHub
+ *   issue numbers ("#26251", "#41417"), millisecond values ("60000"), quota
+ *   figures ("25000"), Lark error codes ("41050"). A bare 5-digit number in
+ *   trajectory content is overwhelmingly a count, id, or port, not a home
+ *   address component; street-level address detection is the ML PII stage's
+ *   job, where the surrounding words disambiguate.
+ * - `POSTCODE_UK` — matches hex colour literals ("#FF00FF" → `[POSTCODE]`).
+ *   Same rationale: a bare alphanumeric cluster is not a location without
+ *   context, which the ML PII stage has and this regex does not.
+ * - `SWIFT_BIC` — `\b[A-Z]{6}[A-Z0-9]{2}([A-Z0-9]{3})?\b`: ANY 8- or 11-char
+ *   uppercase word ("REQUIRED", from an HTTP header name). BIC codes are
+ *   public bank identifiers, not secrets, and the shape is indistinguishable
+ *   from an all-caps word.
+ * - `TIKTOK_USERNAME` / `SOCIAL_MEDIA_HANDLE` — the #1331 social-handle
+ *   family: `@`-prefixed bare words. Fired on npm scoped packages
+ *   ("@n8n/n8n-nodes-langchain…", "@github/copilot-sdk"), which are
+ *   ubiquitous in technical prose.
+ */
+export declare const BARE_WORD_PATTERN_DENYLIST: readonly string[];
+/**
+ * Trigger-word patterns excluded for #1372 (kept as a separate block from the
+ * bare-word denylist above so parallel denylist additions merge cleanly).
+ *
+ * These share one pathology: an ordinary English trigger word (`TO`,
+ * `APPROVAL`, `PROJECT`, `ORDER`, `REVIEW`, `PASS`, `LOT`, `SO`, `REG`, `WO`,
+ * `MISSING`, `RETURN`, `user`, `prod`, `ice`…), case-insensitive, followed by
+ * a bare `[A-Z0-9]{n,m}` tail with no intrinsic shape. On the published seed
+ * skills' SKILL.md prose every one of them fired — all 42 seed bodies were
+ * defaced ("project context" → `project [PROJECT_3875]`, "get your approval
+ * before" → `approval [AUTH_5211]`), several mid-word ("something" →
+ * `so[SO_1826]`, "workflow" → `wo[WO_3602]`, "regressions" →
+ * `[REG]ressions`). Observed trigger words per pattern, from the #1372
+ * characterisation over five real seed bodies:
+ *
+ * - `USERNAME` — "user intent", "user has"; a bare word after "user"/"login"
+ *   is not a credential. Credentials keep their shaped patterns; person
+ *   names are the ML PII stage's job (see the `NAME` note above).
+ * - `PROJECT_CODE` — "project context", "project goes through".
+ * - `CARD_AUTH_CODE` — "approval before" (card auth codes travel with card
+ *   numbers, which `CREDIT_CARD` still catches).
+ * - `IATA_AIRPORT_CODE` — "to use" ("TO" + any 3 capitalisable letters).
+ * - `JUDGMENT_NUMBER` — "order should".
+ * - `STANDING_ORDER_REF` — "SO" matches inside "something"/"solution".
+ * - `PRODUCTION_ID` — "production classes"; nested self-replacement
+ *   corrupted "NO PRODUCTION CODE" into `PROD[PROD[PROD…`.
+ * - `WORK_ORDER_NUMBER` — "wo" matches inside "workflow"/"worktree".
+ * - `PERFORMANCE_REVIEW_ID` — "performance problems", "evaluation between".
+ * - `TNT_TRACKING` — every clause optional except the tail, so ANY 9- or
+ *   13-character word matches ("variation", "statement").
+ * - `THEME_PARK_TICKET` — "pass immediately".
+ * - `TOURNAMENT_REGISTRATION_ID` — "REG" matches inside "regressions".
+ * - `MISSING_PERSON_CASE` — "missing requirements".
+ * - `RMA_NUMBER` — "return expected".
+ * - `BATCH_LOT_NUMBER` — "a lot faster".
+ * - `EMERGENCY_CONTACT` — "ice" (unanchored, matches inside "practice")
+ *   followed by any 2–4 words.
+ *
+ * Lab-grade coverage loss is acceptable: these label niche reference numbers
+ * (parcel tracking, theme-park tickets, tournament brackets, standing
+ * orders, RMAs…) that are implausible in agent-trajectory content and carry
+ * no shape of their own beyond the trigger word. Genuinely secret-shaped
+ * content keeps its dedicated patterns (emails, cards, SSNs, API keys —
+ * pinned below and by the harness-layer seeded-secrets fixture), and the
+ * secretlint + plain-patterns stages still run behind this one.
+ *
+ * #1391 additions — the #1372 characterisation ran 5 sample bodies; the
+ * full-42-seed sweep surfaced the longer tail below (same pathology, same
+ * fix, observed trigger words in parentheses). One aggravator worth naming:
+ * openredaction substitutes a detection's captured VALUE case-insensitively
+ * across the whole document, so a single trigger FP defaces every other
+ * occurrence of that value. Every seed's frontmatter contains
+ * `license: MIT` — LICENSE_PLATE captures `MIT`, and every "limit(s)" /
+ * "submit" in the body came back as `li[PLATE_2299]s` / `Sub[PLATE_2299]`.
+ *
+ * - `LICENSE_PLATE` — "license: MIT" (frontmatter, all 42 seeds); `REG`
+ *   trigger mid-word ("registers" → `[PLATE]isters`).
+ * - `US_LICENSE_PLATE` / `INTERNATIONAL_LICENSE_PLATE` — same trigger family
+ *   (`PLATE|LICENSE|TAG|REGISTRATION`): "tag-driven", "tagged as data".
+ * - `EDITORIAL_TICKET` — "edit existing", "edit endpoints" (`EDIT` trigger).
+ * - `TRANSACTION_ID` — `TRANS` trigger mid-word: "transformations" →
+ *   `[TXN]formations`.
+ * - `AIRLINE_BOOKING_REFERENCE` — "reference images", "reference videos",
+ *   "node reference syntax" (`REFERENCE` trigger).
+ * - `SOURCE_ID` — "source images", "source directory", "multi-source
+ *   aggregation".
+ * - `SERVICE_REQUEST_NUMBER` — "service discovery", "app-service assessment".
+ * - `TERMINAL_ID` — "terminal status"; `POS` trigger mid-word: "false
+ *   positives", "PostToolUse".
+ * - `EXIT_INTERVIEW_ID` — "termination criterion/oracle", "separation
+ *   exists" (`EXIT|TERMINATION|SEPARATION` triggers).
+ * - `HOTEL_LOYALTY_NUMBER` — "member-remove" (wiki commands), "rewards
+ *   padding" (`MEMBER|LOYALTY|REWARDS` triggers).
+ * - `SEARCH_RESCUE_MISSION_ID` — "search operations", "web/search results"
+ *   (`SEARCH|RESCUE|MISSION` triggers).
+ * - `APPLICATION_ID` / `JOB_APPLICATION_ID` — "application gateway",
+ *   "candidate contradicts", "candidate regions" (`APPLICATION|CANDIDATE|
+ *   APPLICANT` triggers).
+ * - `ARTICLE_ID` — "user story should", "user-story-example" (`STORY`
+ *   trigger).
+ * - `EMERGENCY_CALL_REF` — "incident investigation" (`INCIDENT` trigger).
+ * - `CAMPAIGN_CODE` — "brand campaigns", "brand campaign jingle".
+ * - `INSTALLATION_REF` — "brew install imagemagick", "apt-get install".
+ * - `PRODUCT_SKU` — "SKU changes", "SKU upgrades" (Azure sizing prose).
+ * - `BAR_NUMBER` — "raises the bar because" (`BAR` trigger).
+ * - `PREMIUM_PAYMENT_REF` — "premium commercial cuts", "premium brand".
+ * - `HOUSING_ASSIGNMENT` — "ambient room tone" (`ROOM` trigger).
+ * - `MANUSCRIPT_ID` — `MS` trigger: "0.8 ms overhead" → `[MANUSCRIPT]`.
+ * - `STATEMENT_REF` — "return statement exists".
+ * - `QUOTE_REFERENCE` — "quote shortest decisive line".
+ * - `RESUME_ID` — "Resume caveman after" (`RESUME|CV` triggers).
+ * - `PAYMENT_REFERENCE` — `PAY` trigger mid-word: "paymentGateway" →
+ *   `pay[PAY_REF]`.
+ * - `ROUTING_NUMBER_MFG` — "routing convention".
+ * - `MICROSOFT_CERTIFICATION` — "Microsoft documentation" (`MICROSOFT|MS`
+ *   triggers).
+ *
+ * Revealed at fixpoint (iteration 2 — patterns previously shadowed by a
+ * higher-priority pattern that the first pass denylisted):
+ * - `INCIDENT_REPORT_NUMBER` — "Incident Investigation" (`INCIDENT` trigger,
+ *   surfaced once EMERGENCY_CALL_REF was gone).
+ * - `ENROLLMENT_NUMBER` — "registration succeeds" (`REGISTRATION` trigger).
+ * - `HOTEL_RESERVATION` — "Capacity Reservation Groups" (`RESERVATION`
+ *   trigger, surfaced once AIRLINE_BOOKING_REFERENCE was gone).
+ */
+export declare const PROSE_TRIGGER_PATTERN_DENYLIST: readonly string[];
+/**
+ * Default detector: openredaction's full pattern set minus the audited
+ * bare-word matchers. Built via the `patterns` whitelist option (the
+ * library has no exclude option), so a version bump that renames patterns
+ * fails loudly in the tuning tests rather than silently re-enabling junk.
+ */
+export declare function buildDefaultDetector(): OpenRedaction;
+/**
+ * Structured-PII stage backed by `openredaction` (570+ curated regex patterns +
+ * checksum validation, e.g. Luhn for cards). Runs only on `content`-classified
+ * string attributes; `safe` and non-string values pass through untouched. Each
+ * detection is replaced inline (openredaction's placeholder substitution) and
+ * recorded as a `pii` redaction for the provenance manifest.
+ *
+ * The detector is constructed once at factory time and reused across spans
+ * (pattern compilation is not free).
+ */
+export declare function openredactionStage(policy: KeyPolicy, detector?: OpenRedaction): ScrubStage;