@jinn-network/client 0.1.8 → 0.1.9-canary.02befda9

package/dist/trajectory/scrub/build.js

@@ -0,0 +1,43 @@
+import { ScrubPipeline } from './pipeline.js';
+import { keyPolicyStage } from './key-policy.js';
+import { openredactionStage } from './openredaction-stage.js';
+import { secretlintStage } from './secretlint-stage.js';
+import { mlPiiStage } from './ml-pii-stage.js';
+/**
+ * Default key policy. `jinn.*` identity/chain attributes are structural and pass
+ * raw. The `drop` tier deletes the spec's stage-1 high-confidence keys outright
+ * (auth headers, cookies, env dumps — see `spec/2026-06-15-ts-trajectory-scrub-stack.md`):
+ * these never carry sellable content and are never safe to publish. Globs use the
+ * trailing-`*` prefix form `classifyKey` supports; the HTTP header keys are listed
+ * per request/response direction (a leading `*.header.…` glob is not matched, so
+ * we enumerate the concrete keys). Everything else is `content` and flows through
+ * the value-scrubbing stages.
+ */
+export const DEFAULT_KEY_POLICY = {
+    safe: ['jinn.*'],
+    drop: [
+        'http.request.header.authorization',
+        'http.response.header.authorization',
+        'http.request.header.cookie',
+        'http.response.header.cookie',
+        'http.request.header.set-cookie',
+        'http.response.header.set-cookie',
+        'env.*',
+    ],
+};
+/**
+ * Assembles the seller-side scrub pipeline (cost-ascending): structural key
+ * policy → openredaction (structured PII) → secretlint + entropy (secrets) →
+ * optional GLiNER (ML PII). The GLiNER stage is added only when a detector is
+ * supplied, so the daemon degrades gracefully (regex + secrets still scrub) when
+ * the ML model is unavailable.
+ */
+export function buildScrubPipeline(opts = {}) {
+    const policy = opts.policy ?? DEFAULT_KEY_POLICY;
+    const stages = [keyPolicyStage(policy), openredactionStage(policy), secretlintStage(policy)];
+    if (opts.piiDetector) {
+        stages.push(mlPiiStage(policy, opts.piiDetector));
+    }
+    return new ScrubPipeline(stages);
+}
+//# sourceMappingURL=build.js.map

package/dist/trajectory/scrub/build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../../../src/trajectory/scrub/build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAkB,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAoB,MAAM,mBAAmB,CAAC;AAEjE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAc;IAC3C,IAAI,EAAE,CAAC,QAAQ,CAAC;IAChB,IAAI,EAAE;QACJ,mCAAmC;QACnC,oCAAoC;QACpC,4BAA4B;QAC5B,6BAA6B;QAC7B,gCAAgC;QAChC,iCAAiC;QACjC,OAAO;KACR;CACF,CAAC;AAQF;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAkC,EAAE;IACrE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,kBAAkB,CAAC;IACjD,MAAM,MAAM,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7F,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC"}

package/dist/trajectory/scrub/emit-scrub.d.ts

@@ -0,0 +1,41 @@
+import type { RedactionManifest, Span } from '../schema.js';
+import type { ScrubPipeline } from './pipeline.js';
+/**
+ * Seller-side scrub applied at emit time, before a trajectory is signed and
+ * published. Runs every span's attributes (and each event's attributes) through
+ * the pipeline, rebuilds the prev-span hash chain over the scrubbed spans, and
+ * produces the redaction manifest (one entry per span listing the keys touched;
+ * `event.<key>` for event-attribute redactions).
+ */
+export declare function scrubSpansForEmit(spans: Span[], pipeline: ScrubPipeline, taskCid: string): Promise<{
+    spans: Span[];
+    redactionManifest: RedactionManifest;
+}>;
+/**
+ * Minimal structural shape of a capture span (jinn.capture-trajectory.v1): a
+ * flat attribute bag plus the keys already redacted at ingest. Captures have no
+ * events array and no in-run hash chain, so they cannot go through
+ * {@link scrubSpansForEmit}; this is their dedicated seller-side scrub.
+ */
+export interface ScrubbableCaptureSpan {
+    attributes: Record<string, unknown>;
+    redactedKeys: string[];
+}
+/**
+ * Seller-side scrub for capture spans, applied at publish time before the
+ * capture trajectory is uploaded. Runs each span's attributes through the
+ * pipeline, replacing them with the scrubbed values, and unions the pipeline's
+ * redactions into the span's existing `redactedKeys`. Unlike
+ * {@link scrubSpansForEmit} it does NOT touch events or inject a hash chain —
+ * capture spans carry neither. Generic over the span type so the concrete
+ * `SpanRow` (with its extra columns) is returned unchanged apart from
+ * `attributes` and `redactedKeys`.
+ */
+export declare function scrubCaptureSpans<T extends ScrubbableCaptureSpan>(spans: T[], pipeline: ScrubPipeline): Promise<T[]>;
+/**
+ * Unions two redaction manifests by spanId (dedup redactedKeys per span). Used
+ * when an ingestion-time manifest (e.g. a capture's stored redactedKeys) is
+ * combined with the emit-time pipeline manifest. Keeps the
+ * `totalRedactions === sum(redactedKeys)` invariant the schema enforces.
+ */
+export declare function mergeRedactionManifests(a: RedactionManifest, b: RedactionManifest): RedactionManifest;

package/dist/trajectory/scrub/emit-scrub.js

@@ -0,0 +1,88 @@
+import { computeGenesisHash, computePrevSpanHash } from '../hash-chain.js';
+/**
+ * Seller-side scrub applied at emit time, before a trajectory is signed and
+ * published. Runs every span's attributes (and each event's attributes) through
+ * the pipeline, rebuilds the prev-span hash chain over the scrubbed spans, and
+ * produces the redaction manifest (one entry per span listing the keys touched;
+ * `event.<key>` for event-attribute redactions).
+ */
+export async function scrubSpansForEmit(spans, pipeline, taskCid) {
+    const out = [];
+    const manifestSpans = [];
+    let total = 0;
+    let prev = computeGenesisHash(taskCid);
+    for (const span of spans) {
+        const redactedKeys = new Set();
+        const attrResult = await pipeline.run(span.attributes ?? {});
+        for (const r of attrResult.redactions)
+            redactedKeys.add(r.key);
+        const events = [];
+        for (const event of span.events) {
+            if (event.attributes && Object.keys(event.attributes).length > 0) {
+                const evResult = await pipeline.run(event.attributes);
+                events.push({ ...event, attributes: evResult.attributes });
+                for (const r of evResult.redactions)
+                    redactedKeys.add(`event.${r.key}`);
+            }
+            else {
+                events.push(event);
+            }
+        }
+        const scrubbed = {
+            ...span,
+            attributes: { ...attrResult.attributes, 'jinn.prevSpanHash': prev },
+            events,
+        };
+        out.push(scrubbed);
+        prev = computePrevSpanHash(scrubbed);
+        if (redactedKeys.size > 0) {
+            const keys = [...redactedKeys];
+            manifestSpans.push({ spanId: span.spanId, redactedKeys: keys });
+            total += keys.length;
+        }
+    }
+    return { spans: out, redactionManifest: { spans: manifestSpans, totalRedactions: total } };
+}
+/**
+ * Seller-side scrub for capture spans, applied at publish time before the
+ * capture trajectory is uploaded. Runs each span's attributes through the
+ * pipeline, replacing them with the scrubbed values, and unions the pipeline's
+ * redactions into the span's existing `redactedKeys`. Unlike
+ * {@link scrubSpansForEmit} it does NOT touch events or inject a hash chain —
+ * capture spans carry neither. Generic over the span type so the concrete
+ * `SpanRow` (with its extra columns) is returned unchanged apart from
+ * `attributes` and `redactedKeys`.
+ */
+export async function scrubCaptureSpans(spans, pipeline) {
+    const out = [];
+    for (const span of spans) {
+        const result = await pipeline.run(span.attributes ?? {});
+        const redactedKeys = new Set(span.redactedKeys);
+        for (const r of result.redactions)
+            redactedKeys.add(r.key);
+        out.push({ ...span, attributes: result.attributes, redactedKeys: [...redactedKeys] });
+    }
+    return out;
+}
+/**
+ * Unions two redaction manifests by spanId (dedup redactedKeys per span). Used
+ * when an ingestion-time manifest (e.g. a capture's stored redactedKeys) is
+ * combined with the emit-time pipeline manifest. Keeps the
+ * `totalRedactions === sum(redactedKeys)` invariant the schema enforces.
+ */
+export function mergeRedactionManifests(a, b) {
+    const bySpan = new Map();
+    for (const m of [a, b]) {
+        for (const s of m.spans) {
+            const set = bySpan.get(s.spanId) ?? new Set();
+            for (const k of s.redactedKeys)
+                set.add(k);
+            bySpan.set(s.spanId, set);
+        }
+    }
+    const spans = [...bySpan]
+        .map(([spanId, keys]) => ({ spanId, redactedKeys: [...keys] }))
+        .filter((s) => s.redactedKeys.length > 0);
+    return { spans, totalRedactions: spans.reduce((n, s) => n + s.redactedKeys.length, 0) };
+}
+//# sourceMappingURL=emit-scrub.js.map

package/dist/trajectory/scrub/emit-scrub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emit-scrub.js","sourceRoot":"","sources":["../../../src/trajectory/scrub/emit-scrub.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAI3E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAa,EACb,QAAuB,EACvB,OAAe;IAEf,MAAM,GAAG,GAAW,EAAE,CAAC;IACvB,MAAM,aAAa,GAA+B,EAAE,CAAC;IACrD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAEvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;QAEvC,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QAC7D,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,UAAU;YAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAE/D,MAAM,MAAM,GAAmB,EAAE,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACtD,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;gBAC3D,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,UAAU;oBAAE,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1E,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAS;YACrB,GAAG,IAAI;YACP,UAAU,EAAE,EAAE,GAAG,UAAU,CAAC,UAAU,EAAE,mBAAmB,EAAE,IAAI,EAAE;YACnE,MAAM;SACP,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnB,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAErC,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;YAC/B,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,KAAK,EAAE,EAAE,CAAC;AAC7F,CAAC;AAaD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAU,EACV,QAAuB;IAEvB,MAAM,GAAG,GAAQ,EAAE,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAChD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU;YAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3D,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,CAAoB,EAAE,CAAoB;IAChF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YACtD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC;SACtB,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;SAC9D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5C,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC;AAC1F,CAAC"}

package/dist/trajectory/scrub/key-policy.d.ts

@@ -0,0 +1,20 @@
+import type { ScrubStage } from './types.js';
+export interface KeyPolicy {
+    /** keys whose values are structural and safe to publish raw */
+    safe: string[];
+    /** keys to delete entirely (never published) */
+    drop: string[];
+}
+export type KeyClass = 'safe' | 'content' | 'drop';
+/**
+ * Classify an attribute key against the policy. `drop` wins over `safe` (a key
+ * matching both is dropped — fail safe). Unmatched keys are `content` and flow
+ * to the value-scrubbing stages.
+ */
+export declare function classifyKey(key: string, policy: KeyPolicy): KeyClass;
+/**
+ * Structural key-policy stage: deletes `drop` keys outright (recording a
+ * redaction) and passes `safe` + `content` keys through unchanged. Value-level
+ * scrubbing of `content` keys is handled by later stages.
+ */
+export declare function keyPolicyStage(policy: KeyPolicy): ScrubStage;

package/dist/trajectory/scrub/key-policy.js

@@ -0,0 +1,43 @@
+const VERSION = '0.1.0';
+/** Exact match, or prefix match when the pattern ends with `*`. */
+function matches(key, pattern) {
+    if (pattern.endsWith('*'))
+        return key.startsWith(pattern.slice(0, -1));
+    return key === pattern;
+}
+/**
+ * Classify an attribute key against the policy. `drop` wins over `safe` (a key
+ * matching both is dropped — fail safe). Unmatched keys are `content` and flow
+ * to the value-scrubbing stages.
+ */
+export function classifyKey(key, policy) {
+    if (policy.drop.some((p) => matches(key, p)))
+        return 'drop';
+    if (policy.safe.some((p) => matches(key, p)))
+        return 'safe';
+    return 'content';
+}
+/**
+ * Structural key-policy stage: deletes `drop` keys outright (recording a
+ * redaction) and passes `safe` + `content` keys through unchanged. Value-level
+ * scrubbing of `content` keys is handled by later stages.
+ */
+export function keyPolicyStage(policy) {
+    return {
+        name: 'key-policy',
+        version: VERSION,
+        scrub(attributes) {
+            const out = {};
+            const redactions = [];
+            for (const [key, value] of Object.entries(attributes)) {
+                if (classifyKey(key, policy) === 'drop') {
+                    redactions.push({ key, stage: 'key-policy', kind: 'dropped-key' });
+                    continue;
+                }
+                out[key] = value;
+            }
+            return { attributes: out, redactions };
+        },
+    };
+}
+//# sourceMappingURL=key-policy.js.map

package/dist/trajectory/scrub/key-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-policy.js","sourceRoot":"","sources":["../../../src/trajectory/scrub/key-policy.ts"],"names":[],"mappings":"AAWA,MAAM,OAAO,GAAG,OAAO,CAAC;AAExB,mEAAmE;AACnE,SAAS,OAAO,CAAC,GAAW,EAAE,OAAe;IAC3C,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,OAAO,GAAG,KAAK,OAAO,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,MAAiB;IACxD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5D,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAiB;IAC9C,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,OAAO;QAChB,KAAK,CAAC,UAAsB;YAC1B,MAAM,GAAG,GAAe,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAsB,EAAE,CAAC;YACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtD,IAAI,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;oBACxC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;oBACnE,SAAS;gBACX,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACnB,CAAC;YACD,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/trajectory/scrub/ml-pii-stage.d.ts

@@ -0,0 +1,24 @@
+import { type KeyPolicy } from './key-policy.js';
+import type { ScrubStage } from './types.js';
+/** A PII entity detected in text: a label (PER/ORG/LOC/…) and the matched span text. */
+export interface PiiEntity {
+    label: string;
+    text: string;
+}
+/**
+ * ML PII detector seam. The production implementation wraps a Transformers.js
+ * token-classification (NER) model; tests inject a deterministic fake. Kept
+ * behind an interface so the stage logic is unit-tested without loading a model.
+ */
+export interface PiiDetector {
+    detect(text: string): Promise<PiiEntity[]>;
+}
+/**
+ * ML PII stage. Runs the injected NER detector over each `content`-classified
+ * string value and replaces whole-word occurrences of each detected entity with
+ * `[PII:<label>]` (word-boundary matching so substrings aren't corrupted — e.g.
+ * detecting "London" leaves "Londoner" intact). `safe` and non-string values
+ * pass through untouched. The detector returns matched text rather than offsets
+ * because the Transformers.js NER pipeline does not surface character offsets.
+ */
+export declare function mlPiiStage(policy: KeyPolicy, detector: PiiDetector): ScrubStage;

package/dist/trajectory/scrub/ml-pii-stage.js

@@ -0,0 +1,43 @@
+import { classifyKey } from './key-policy.js';
+const VERSION = '0.1.0';
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * ML PII stage. Runs the injected NER detector over each `content`-classified
+ * string value and replaces whole-word occurrences of each detected entity with
+ * `[PII:<label>]` (word-boundary matching so substrings aren't corrupted — e.g.
+ * detecting "London" leaves "Londoner" intact). `safe` and non-string values
+ * pass through untouched. The detector returns matched text rather than offsets
+ * because the Transformers.js NER pipeline does not surface character offsets.
+ */
+export function mlPiiStage(policy, detector) {
+    return {
+        name: 'ml-pii',
+        version: VERSION,
+        async scrub(attributes) {
+            const out = {};
+            const redactions = [];
+            for (const [key, value] of Object.entries(attributes)) {
+                if (typeof value !== 'string' || classifyKey(key, policy) !== 'content') {
+                    out[key] = value;
+                    continue;
+                }
+                let text = value;
+                for (const ent of await detector.detect(value)) {
+                    if (!ent.text)
+                        continue;
+                    const re = new RegExp(`\\b${escapeRegExp(ent.text)}\\b`, 'g');
+                    const replaced = text.replace(re, `[PII:${ent.label}]`);
+                    if (replaced !== text) {
+                        redactions.push({ key, stage: 'ml-pii', kind: 'pii', detail: ent.label });
+                        text = replaced;
+                    }
+                }
+                out[key] = text;
+            }
+            return { attributes: out, redactions };
+        },
+    };
+}
+//# sourceMappingURL=ml-pii-stage.js.map

package/dist/trajectory/scrub/ml-pii-stage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ml-pii-stage.js","sourceRoot":"","sources":["../../../src/trajectory/scrub/ml-pii-stage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAkB,MAAM,iBAAiB,CAAC;AAkB9D,MAAM,OAAO,GAAG,OAAO,CAAC;AAExB,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,MAAiB,EAAE,QAAqB;IACjE,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO;QAChB,KAAK,CAAC,KAAK,CAAC,UAAsB;YAChC,MAAM,GAAG,GAAe,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAsB,EAAE,CAAC;YAEzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;oBACxE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;oBACjB,SAAS;gBACX,CAAC;gBAED,IAAI,IAAI,GAAG,KAAK,CAAC;gBACjB,KAAK,MAAM,GAAG,IAAI,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/C,IAAI,CAAC,GAAG,CAAC,IAAI;wBAAE,SAAS;oBACxB,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC;oBACxD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;wBACtB,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;wBAC1E,IAAI,GAAG,QAAQ,CAAC;oBAClB,CAAC;gBACH,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YAClB,CAAC;YAED,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/trajectory/scrub/openredaction-stage.d.ts

@@ -0,0 +1,14 @@
+import { OpenRedaction } from 'openredaction';
+import { type KeyPolicy } from './key-policy.js';
+import type { ScrubStage } from './types.js';
+/**
+ * Structured-PII stage backed by `openredaction` (570+ curated regex patterns +
+ * checksum validation, e.g. Luhn for cards). Runs only on `content`-classified
+ * string attributes; `safe` and non-string values pass through untouched. Each
+ * detection is replaced inline (openredaction's placeholder substitution) and
+ * recorded as a `pii` redaction for the provenance manifest.
+ *
+ * The detector is constructed once at factory time and reused across spans
+ * (pattern compilation is not free).
+ */
+export declare function openredactionStage(policy: KeyPolicy, detector?: OpenRedaction): ScrubStage;

package/dist/trajectory/scrub/openredaction-stage.js

@@ -0,0 +1,36 @@
+import { OpenRedaction } from 'openredaction';
+import { classifyKey } from './key-policy.js';
+const VERSION = '0.1.0';
+/**
+ * Structured-PII stage backed by `openredaction` (570+ curated regex patterns +
+ * checksum validation, e.g. Luhn for cards). Runs only on `content`-classified
+ * string attributes; `safe` and non-string values pass through untouched. Each
+ * detection is replaced inline (openredaction's placeholder substitution) and
+ * recorded as a `pii` redaction for the provenance manifest.
+ *
+ * The detector is constructed once at factory time and reused across spans
+ * (pattern compilation is not free).
+ */
+export function openredactionStage(policy, detector = new OpenRedaction()) {
+    return {
+        name: 'openredaction',
+        version: VERSION,
+        async scrub(attributes) {
+            const out = {};
+            const redactions = [];
+            for (const [key, value] of Object.entries(attributes)) {
+                if (typeof value !== 'string' || classifyKey(key, policy) !== 'content') {
+                    out[key] = value;
+                    continue;
+                }
+                const result = await detector.detect(value);
+                out[key] = result.redacted;
+                for (const det of result.detections) {
+                    redactions.push({ key, stage: 'openredaction', kind: 'pii', detail: det.type });
+                }
+            }
+            return { attributes: out, redactions };
+        },
+    };
+}
+//# sourceMappingURL=openredaction-stage.js.map

package/dist/trajectory/scrub/openredaction-stage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openredaction-stage.js","sourceRoot":"","sources":["../../../src/trajectory/scrub/openredaction-stage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAkB,MAAM,iBAAiB,CAAC;AAG9D,MAAM,OAAO,GAAG,OAAO,CAAC;AAExB;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAiB,EACjB,WAA0B,IAAI,aAAa,EAAE;IAE7C,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,OAAO;QAChB,KAAK,CAAC,KAAK,CAAC,UAAsB;YAChC,MAAM,GAAG,GAAe,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAsB,EAAE,CAAC;YACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;oBACxE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;oBACjB,SAAS;gBACX,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5C,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;gBAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;oBACpC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC;YACD,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/trajectory/scrub/pii-build.d.ts

@@ -0,0 +1,31 @@
+import type { PiiDetector } from './ml-pii-stage.js';
+export interface PiiDetectionConfig {
+    enabled: boolean;
+    /** Optional Transformers.js NER model id (defaults to Xenova/bert-base-NER). */
+    model?: string;
+}
+/** Thrown by the fail-closed detector on every scrub call when ML PII was enabled but the model never loaded. */
+export declare class MlPiiUnavailableError extends Error {
+    constructor(cause: string);
+}
+/**
+ * Builds the ML PII detector (Transformers.js NER, in-process) when enabled,
+ * warming up the model.
+ *
+ * Failure altitude is **publish-time, not boot-time** (per
+ * `spec/2026-06-15-ts-trajectory-scrub-stack.md`, §"Failure posture": "if any
+ * stage errors or the model fails to load, the trajectory is **not**
+ * published"). Three cases:
+ *
+ * - Disabled (the default): returns `undefined` — the scrub pipeline runs the
+ *   structural key policy + openredaction + secretlint/entropy stages only, with
+ *   no ML PII tier and no error. Exactly the legacy behaviour.
+ * - Enabled and the model loads: returns the real detector.
+ * - Enabled but the model fails to load: does NOT throw at construction. Returns
+ *   a fail-closed detector that hard-throws on every scrub call, so each affected
+ *   publish aborts (fails closed — never publishes under-redacted/raw) while the
+ *   rest of the daemon keeps running. A loud one-time boot warning is emitted so
+ *   the degraded posture is visible in logs; the per-publish throw carries its own
+ *   clear error so aborted publishes are never silent.
+ */
+export declare function maybeBuildPiiDetector(cfg: PiiDetectionConfig, log?: (msg: string) => void): Promise<PiiDetector | undefined>;

package/dist/trajectory/scrub/pii-build.js

@@ -0,0 +1,64 @@
+import { TransformersPiiDetector } from './transformers-detector.js';
+/** Thrown by the fail-closed detector on every scrub call when ML PII was enabled but the model never loaded. */
+export class MlPiiUnavailableError extends Error {
+    constructor(cause) {
+        super('ML PII detection was enabled but the model failed to load; failing closed — ' +
+            `this trajectory is NOT published (disable captures.piiDetection or fix the model to publish): ${cause}`);
+        this.name = 'MlPiiUnavailableError';
+    }
+}
+/**
+ * A detector that hard-throws on every `detect()` call. Used when ML PII is
+ * enabled but the model failed to load: the failure is narrowed to **publish
+ * altitude** — the throw propagates through the ML scrub stage and aborts the
+ * one publish in flight (capture publish aborts; task-trajectory ref drops to
+ * null), so no raw trajectory is ever published. The daemon's other loops
+ * (earning, claim, engine, balance-topup) are unaffected because the failure
+ * is no longer raised at construction/boot.
+ */
+function failClosedDetector(cause) {
+    return {
+        detect() {
+            return Promise.reject(new MlPiiUnavailableError(cause));
+        },
+    };
+}
+/**
+ * Builds the ML PII detector (Transformers.js NER, in-process) when enabled,
+ * warming up the model.
+ *
+ * Failure altitude is **publish-time, not boot-time** (per
+ * `spec/2026-06-15-ts-trajectory-scrub-stack.md`, §"Failure posture": "if any
+ * stage errors or the model fails to load, the trajectory is **not**
+ * published"). Three cases:
+ *
+ * - Disabled (the default): returns `undefined` — the scrub pipeline runs the
+ *   structural key policy + openredaction + secretlint/entropy stages only, with
+ *   no ML PII tier and no error. Exactly the legacy behaviour.
+ * - Enabled and the model loads: returns the real detector.
+ * - Enabled but the model fails to load: does NOT throw at construction. Returns
+ *   a fail-closed detector that hard-throws on every scrub call, so each affected
+ *   publish aborts (fails closed — never publishes under-redacted/raw) while the
+ *   rest of the daemon keeps running. A loud one-time boot warning is emitted so
+ *   the degraded posture is visible in logs; the per-publish throw carries its own
+ *   clear error so aborted publishes are never silent.
+ */
+export async function maybeBuildPiiDetector(cfg, log = (m) => console.warn(m)) {
+    if (!cfg.enabled)
+        return undefined;
+    try {
+        const detector = new TransformersPiiDetector(cfg.model ? { model: cfg.model } : {});
+        await detector.init();
+        log('[scrub] ML PII detection (Transformers.js NER) enabled.');
+        return detector;
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        log('[scrub] WARNING: ML PII detection is enabled but the model failed to load. ' +
+            'Failing closed at publish altitude: trajectory/capture publishing will ABORT ' +
+            '(no raw trajectories are published) until this is resolved or captures.piiDetection ' +
+            `is disabled. The daemon's other loops continue running. Cause: ${message}`);
+        return failClosedDetector(message);
+    }
+}
+//# sourceMappingURL=pii-build.js.map

package/dist/trajectory/scrub/pii-build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-build.js","sourceRoot":"","sources":["../../../src/trajectory/scrub/pii-build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AASrE,iHAAiH;AACjH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,KAAa;QACvB,KAAK,CACH,8EAA8E;YAC5E,iGAAiG,KAAK,EAAE,CAC3G,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO;QACL,MAAM;YACJ,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAuB,EACvB,MAA6B,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAEnD,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpF,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,GAAG,CAAC,yDAAyD,CAAC,CAAC;QAC/D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,GAAG,CACD,6EAA6E;YAC3E,+EAA+E;YAC/E,sFAAsF;YACtF,kEAAkE,OAAO,EAAE,CAC9E,CAAC;QACF,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;AACH,CAAC"}

package/dist/trajectory/scrub/pipeline.d.ts

@@ -0,0 +1,16 @@
+import type { Attributes, ScrubResult, ScrubStage } from './types.js';
+/**
+ * Runs scrub stages in order over a span's attributes: each stage's output
+ * attributes feed the next, and redaction records accumulate across the whole
+ * chain. Stages may be async (e.g. the ML PII stage). The `components` list
+ * (stage name + pinned version) is what the signed provenance manifest records.
+ */
+export declare class ScrubPipeline {
+    private readonly stages;
+    constructor(stages: ScrubStage[]);
+    get components(): Array<{
+        name: string;
+        version: string;
+    }>;
+    run(attributes: Attributes): Promise<ScrubResult>;
+}

package/dist/trajectory/scrub/pipeline.js

@@ -0,0 +1,26 @@
+/**
+ * Runs scrub stages in order over a span's attributes: each stage's output
+ * attributes feed the next, and redaction records accumulate across the whole
+ * chain. Stages may be async (e.g. the ML PII stage). The `components` list
+ * (stage name + pinned version) is what the signed provenance manifest records.
+ */
+export class ScrubPipeline {
+    stages;
+    constructor(stages) {
+        this.stages = stages;
+    }
+    get components() {
+        return this.stages.map((s) => ({ name: s.name, version: s.version }));
+    }
+    async run(attributes) {
+        let current = attributes;
+        const redactions = [];
+        for (const stage of this.stages) {
+            const result = await stage.scrub(current);
+            current = result.attributes;
+            redactions.push(...result.redactions);
+        }
+        return { attributes: current, redactions };
+    }
+}
+//# sourceMappingURL=pipeline.js.map

package/dist/trajectory/scrub/pipeline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline.js","sourceRoot":"","sources":["../../../src/trajectory/scrub/pipeline.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,OAAO,aAAa;IACK;IAA7B,YAA6B,MAAoB;QAApB,WAAM,GAAN,MAAM,CAAc;IAAG,CAAC;IAErD,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,UAAsB;QAC9B,IAAI,OAAO,GAAG,UAAU,CAAC;QACzB,MAAM,UAAU,GAAsB,EAAE,CAAC;QACzC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC1C,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC;YAC5B,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IAC7C,CAAC;CACF"}

package/dist/trajectory/scrub/secretlint-stage.d.ts

@@ -0,0 +1,13 @@
+import { type KeyPolicy } from './key-policy.js';
+import type { ScrubStage } from './types.js';
+/**
+ * Secrets stage. Two passes over each `content`-classified string value:
+ *  1. secretlint preset-recommend rules (AWS, GitHub, Slack, GCP, npm, …) —
+ *     each match replaced inline with `[SECRET:<rule>]`.
+ *  2. a conservative Shannon-entropy + secret-shape fallback that catches
+ *     near-random tokens no specific rule matched (≥ 20 chars by entropy alone,
+ *     or 16–19 chars when the token is a single high-density secret-charset run
+ *     mixing multiple character classes), replaced with `[SECRET:high-entropy]`.
+ * `safe` and non-string values pass through untouched.
+ */
+export declare function secretlintStage(policy: KeyPolicy): ScrubStage;