@jinn-network/client 0.1.9 → 0.2.0

package/node_modules/@jinn-network/core/dist/scrub/pipeline.js

@@ -0,0 +1,83 @@
+/**
+ * Runs scrub stages in order over a span's attributes: each stage's output
+ * attributes feed the next, and redaction records accumulate across the whole
+ * chain. Stages may be async (e.g. the ML PII stage). The `components` list
+ * (stage name + pinned version) is available for local inspection and tests;
+ * the current trace-envelope schema does not publish it.
+ *
+ * Nested values (#1378): the stages themselves operate on flat string values —
+ * a non-string attribute value (e.g. `tool.args` captured as an object) used
+ * to pass through every stage untouched and publish verbatim, leaking the
+ * exact strings the same pipeline redacted out of `tool.result`. `run()` now
+ * walks surviving object/array values after the flat pass and scrubs every
+ * string leaf through the same stage chain, keyed by the TOP-LEVEL attribute
+ * key so the key policy classifies leaves exactly like the flat value
+ * (`jinn.*` structural attributes stay raw; `drop` keys are already gone
+ * before the walk). Redactions from leaf runs carry the top-level key, so the
+ * redaction manifest and capture redaction diff report `tool.args` as the
+ * touched field.
+ */
+export class ScrubPipeline {
+    stages;
+    constructor(stages) {
+        this.stages = stages;
+    }
+    get components() {
+        return this.stages.map((s) => ({ name: s.name, version: s.version }));
+    }
+    async run(attributes) {
+        const flat = await this.runStages(attributes);
+        const out = {};
+        const redactions = [...flat.redactions];
+        for (const [key, value] of Object.entries(flat.attributes)) {
+            // Flat strings were scrubbed by the pass above; only container values
+            // (objects/arrays) still hold unscrubbed string leaves.
+            out[key] = typeof value === 'string' ? value : await this.scrubNested(key, value, redactions);
+        }
+        return { attributes: out, redactions };
+    }
+    /** One pass of every stage over a flat attribute bag (the original `run`). */
+    async runStages(attributes) {
+        let current = attributes;
+        const redactions = [];
+        for (const stage of this.stages) {
+            const result = await stage.scrub(current);
+            current = result.attributes;
+            redactions.push(...result.redactions);
+        }
+        return { attributes: current, redactions };
+    }
+    /**
+     * Recursively scrub the string leaves of a nested attribute value through
+     * the full stage chain, using the top-level attribute key for policy
+     * classification. Non-container, non-string values (numbers, booleans,
+     * null) and non-plain objects pass through unchanged.
+     */
+    async scrubNested(key, value, redactions) {
+        if (typeof value === 'string') {
+            const result = await this.runStages({ [key]: value });
+            redactions.push(...result.redactions);
+            const scrubbed = result.attributes[key];
+            // Stages only rewrite strings; a `drop`-classified key never reaches
+            // here (dropped in the flat pass), so non-string means untouched.
+            return typeof scrubbed === 'string' ? scrubbed : value;
+        }
+        if (Array.isArray(value)) {
+            const items = [];
+            for (const item of value)
+                items.push(await this.scrubNested(key, item, redactions));
+            return items;
+        }
+        if (value !== null && typeof value === 'object') {
+            const proto = Object.getPrototypeOf(value);
+            if (proto !== Object.prototype && proto !== null)
+                return value; // non-plain: pass through
+            const entries = {};
+            for (const [k, v] of Object.entries(value)) {
+                entries[k] = await this.scrubNested(key, v, redactions);
+            }
+            return entries;
+        }
+        return value;
+    }
+}

package/node_modules/@jinn-network/core/dist/scrub/plain-patterns-stage.d.ts

@@ -0,0 +1,42 @@
+/**
+ * plain-patterns stage — deterministic regex redaction for two shapes the
+ * probabilistic stages demonstrably miss (issue #1330, found while building
+ * the harness-layer capture path in #1310):
+ *
+ *  - plain email addresses: openredaction's EMAIL pattern is unreliable
+ *    (misses e.g. `jane.doe@example-corp.com`);
+ *  - POSIX home-directory paths carrying a username
+ *    (`/Users/<name>/…`, `/home/<name>/…`) — nothing else touches paths.
+ *
+ * Graduated here from the harness-layer's capture-local stages so the daemon
+ * capture publish path and the harness layer share ONE implementation.
+ * Deliberately broad: over-redacting an email or a username is cheap; leaking
+ * one is not.
+ *
+ * An opt-in third set (`credentialIds`, #1415) adds deterministic cloud
+ * credential-ID prefixes for the seed profile, which runs without the entropy
+ * fallback that covers these shapes in the trace profile. An opt-in fourth set
+ * (`walletAddresses`, #1959) adds the deterministic `0x`+40-hex wallet-address
+ * detector the seed profile needs now that it is the episode seed lane's
+ * profile — the class openredaction catches in the trace profile but the seed
+ * profile leaked verbatim to the public corpus.
+ */
+import { type KeyPolicy } from './key-policy.js';
+import type { ScrubStage } from './types.js';
+export interface PlainPatternsOptions {
+    /**
+     * Adds the deterministic credential-ID prefixes above (#1415). Default false:
+     * the trace profile already catches these via secretlint's entropy fallback
+     * and must stay byte-identical. The seed profile (which runs without the
+     * fallback) turns this on.
+     */
+    credentialIds?: boolean;
+    /**
+     * Adds the deterministic `0x`+40-hex wallet-address detector above (#1959).
+     * Default false: the trace profile already catches this class via
+     * openredaction and must stay byte-identical. The seed profile (which runs
+     * without openredaction) turns this on to close the wallet-address leak.
+     */
+    walletAddresses?: boolean;
+}
+export declare function plainPatternsStage(policy: KeyPolicy, opts?: PlainPatternsOptions): ScrubStage;

package/node_modules/@jinn-network/core/dist/scrub/plain-patterns-stage.js

@@ -0,0 +1,114 @@
+/**
+ * plain-patterns stage — deterministic regex redaction for two shapes the
+ * probabilistic stages demonstrably miss (issue #1330, found while building
+ * the harness-layer capture path in #1310):
+ *
+ *  - plain email addresses: openredaction's EMAIL pattern is unreliable
+ *    (misses e.g. `jane.doe@example-corp.com`);
+ *  - POSIX home-directory paths carrying a username
+ *    (`/Users/<name>/…`, `/home/<name>/…`) — nothing else touches paths.
+ *
+ * Graduated here from the harness-layer's capture-local stages so the daemon
+ * capture publish path and the harness layer share ONE implementation.
+ * Deliberately broad: over-redacting an email or a username is cheap; leaking
+ * one is not.
+ *
+ * An opt-in third set (`credentialIds`, #1415) adds deterministic cloud
+ * credential-ID prefixes for the seed profile, which runs without the entropy
+ * fallback that covers these shapes in the trace profile. An opt-in fourth set
+ * (`walletAddresses`, #1959) adds the deterministic `0x`+40-hex wallet-address
+ * detector the seed profile needs now that it is the episode seed lane's
+ * profile — the class openredaction catches in the trace profile but the seed
+ * profile leaked verbatim to the public corpus.
+ */
+import { classifyKey } from './key-policy.js';
+const VERSION = '0.1.0';
+/** Plain email shape. */
+const EMAIL_PATTERN = /[A-Za-z0-9._%+-]+@[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])+)+/g;
+/** POSIX home-dir path segment carrying a username. */
+const HOME_PATH_PATTERN = /\/(?:Users|home)\/[^/\s"'`]+/g;
+const PATTERNS = [
+    { pattern: EMAIL_PATTERN, replacement: '[EMAIL]', detail: 'email', kind: 'pii' },
+    { pattern: HOME_PATH_PATTERN, replacement: '/users/anon', detail: 'home-path', kind: 'pii' },
+];
+/**
+ * Bare AWS access-key ID — the fixed four-char prefixes + 16 key chars that
+ * secretlint's aws rule only scans for under `enableIDScanRule: true`, which
+ * preset-recommend leaves off (#1415).
+ */
+const AWS_KEY_ID_PATTERN = /\b(?:A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}\b/g;
+/**
+ * GCP API key: fixed `AIza` prefix + 35 key chars. No trailing `\b` — the key
+ * charset includes `-`, which breaks word-boundary semantics at the end.
+ */
+const GCP_API_KEY_PATTERN = /\bAIza[0-9A-Za-z_-]{35}/g;
+const CREDENTIAL_ID_PATTERNS = [
+    {
+        pattern: AWS_KEY_ID_PATTERN,
+        replacement: '[SECRET:aws-access-key-id]',
+        detail: 'aws-access-key-id',
+        kind: 'secret',
+    },
+    {
+        pattern: GCP_API_KEY_PATTERN,
+        replacement: '[SECRET:gcp-api-key]',
+        detail: 'gcp-api-key',
+        kind: 'secret',
+    },
+];
+/**
+ * Ethereum-style wallet address: `0x` + exactly 40 hex chars (#1959). Ported
+ * verbatim from openredaction's `ETHEREUM_ADDRESS` matcher, so the seed
+ * profile catches this class exactly as the trace profile does through
+ * openredaction (parity), without pulling in the rest of that stage. The `0x`
+ * prefix and the `\b` bounds are load-bearing carve-outs: bare 40-hex git
+ * object ids (no `0x`) and `0x`+64-hex transaction hashes are provenance
+ * receipts that must survive, so neither may be swallowed. This is the scrub
+ * redesign's C1 detector (`docs/superpowers/specs/2026-07-22-scrub-redesign-
+ * design.md` §6.2) minus the instance-allowlist refinement — verbatim
+ * forward-compatible.
+ */
+const ETH_ADDRESS_PATTERN = /\b0x[a-fA-F0-9]{40}\b/g;
+const WALLET_ADDRESS_PATTERNS = [
+    {
+        pattern: ETH_ADDRESS_PATTERN,
+        replacement: (index) => `[ETH_ADDR_${index}]`,
+        detail: 'eth-address',
+        kind: 'pii',
+    },
+];
+export function plainPatternsStage(policy, opts = {}) {
+    const patterns = [
+        ...PATTERNS,
+        ...(opts.credentialIds ? CREDENTIAL_ID_PATTERNS : []),
+        ...(opts.walletAddresses ? WALLET_ADDRESS_PATTERNS : []),
+    ];
+    return {
+        name: 'plain-patterns',
+        version: VERSION,
+        scrub(attributes) {
+            const out = {};
+            const redactions = [];
+            for (const [key, value] of Object.entries(attributes)) {
+                if (typeof value !== 'string' || classifyKey(key, policy) !== 'content') {
+                    out[key] = value;
+                    continue;
+                }
+                let scrubbed = value;
+                for (const { pattern, replacement, detail, kind } of patterns) {
+                    let hits = 0;
+                    scrubbed = scrubbed.replace(pattern, () => {
+                        const stub = typeof replacement === 'function' ? replacement(hits) : replacement;
+                        hits += 1;
+                        return stub;
+                    });
+                    for (let i = 0; i < hits; i += 1) {
+                        redactions.push({ key, stage: 'plain-patterns', kind, detail });
+                    }
+                }
+                out[key] = scrubbed;
+            }
+            return { attributes: out, redactions };
+        },
+    };
+}

package/node_modules/@jinn-network/core/dist/scrub/secretlint-stage.d.ts

@@ -0,0 +1,36 @@
+import { type KeyPolicy } from './key-policy.js';
+import type { ScrubStage } from './types.js';
+/**
+ * Secrets stage. Two passes over each `content`-classified string value:
+ *  1. secretlint preset-recommend rules (AWS secret-key assignments, GitHub,
+ *     Slack, npm, GCP service-account JSON, …) — each match replaced inline
+ *     with `[SECRET:<rule>]`. Note the preset's defaults are narrower than the
+ *     rule names suggest: bare AWS key IDs (AKIA…) and `AIza…` GCP API keys
+ *     are NOT detected in this pass.
+ *  2. a conservative Shannon-entropy + secret-shape fallback that catches
+ *     near-random tokens no specific rule matched (≥ 20 chars by entropy alone,
+ *     or 16–19 chars when the token is a single high-density secret-charset run
+ *     mixing multiple character classes), replaced with `[SECRET:high-entropy]`.
+ *     Path-shaped tokens (`owner/repo/slug` and friends, #1348) are judged
+ *     per-segment rather than whole-token, so slug identifiers survive while a
+ *     secret embedded as a path segment still redacts.
+ * `safe` and non-string values pass through untouched.
+ */
+export interface SecretlintStageOptions {
+    /**
+     * Gate for the pass-2 Shannon-entropy fallback (#1409). Default true (trace
+     * profile, unchanged). The seed-import profile sets false for public,
+     * transformed, or otherwise human-curated evidence where the probabilistic
+     * sweep demonstrably false-positives (env-var assignments with dated slugs,
+     * ≥20-char camelCase identifiers) — pass-1 deterministic rules still run
+     * unconditionally. With the fallback off, bare AWS key IDs (AKIA…),
+     * `AIza…` GCP API keys, JWTs, and generic high-entropy blobs pass this stage
+     * unredacted (pass-1 catches AWS secret-key assignments and GCP
+     * service-account JSON only). The seed profile covers the AWS/GCP key-ID
+     * shapes upstream in plain-patterns (#1415). JWTs and other high-entropy
+     * residuals remain the local curator's responsibility; using this profile
+     * does not itself establish that an input is safe to publish.
+     */
+    entropyFallback?: boolean;
+}
+export declare function secretlintStage(policy: KeyPolicy, opts?: SecretlintStageOptions): ScrubStage;

package/node_modules/@jinn-network/core/dist/scrub/secretlint-stage.js

@@ -0,0 +1,249 @@
+import { lintSource } from '@secretlint/core';
+import { creator } from '@secretlint/secretlint-rule-preset-recommend';
+import { classifyKey } from './key-policy.js';
+const VERSION = '0.4.1'; // 0.4.1: public SWE-rebench instance ids skip the entropy fallback
+const PRESET_RULE_ID = '@secretlint/secretlint-rule-preset-recommend';
+// Entropy fallback thresholds. Conservative on purpose: a long token whose
+// character distribution is near-random is almost certainly a key/token, not
+// prose. Tunable; raise the bar if legitimate high-entropy content over-redacts.
+//
+// `ENTROPY_MIN_BITS` stays at 4.0: English prose sits ~4.0–4.5 bits/char, so
+// lowering it below 4.0 globally nukes legitimate prose. `ENTROPY_MIN_LEN` is
+// lowered from 20 → 16 so secret-shaped tokens in the 16–19 char band (which
+// the old 20-char floor never even considered) are caught — but only when they
+// ALSO pass the structural shape gate below, so the longer tail of legit
+// identifiers/words in that band is not swept in. Tokens of length ≥ 20 keep
+// the original entropy-only behaviour (the shape gate does not narrow it).
+const ENTROPY_MIN_LEN = 16;
+const ENTROPY_MIN_BITS = 4.0;
+// Above this length the entropy bar alone decides (original behaviour). Between
+// ENTROPY_MIN_LEN and here the structural shape gate is additionally required.
+const ENTROPY_STRICT_LEN = 20;
+// A "secret-shaped" token: a single run of base64 / base64url / hex charset
+// characters only (letters, digits, and the `+/=_-` set), with NO natural-language
+// punctuation or spaces.
+const SECRET_CHARSET = /^[A-Za-z0-9+/=_-]+$/;
+// Tuning note (#1348): a path-shaped token — slug segments joined by `/`,
+// e.g. `obra/superpowers/skills/test-driven-development` — is judged
+// per-SEGMENT, not whole-token, but ONLY when the whole token mixes at most
+// 2 character classes. Concatenating several short human-readable slugs
+// inflates whole-token Shannon entropy past 4.0 bits/char purely by
+// length/variety, which was redacting seed-import task summaries as
+// `[SECRET:high-entropy]`; real slugs are overwhelmingly lowercase (1–2
+// classes), while secrets that merely contain `/` or `.` (AWS-style base64
+// keys, `dir/<blob>.tar.gz` filenames) almost always mix 3 classes and keep
+// the original whole-token entropy behaviour. The segment charset excludes
+// `+` and `=`, so base64 blobs containing either are never path-shaped.
+// Residual exposure: a secret with ≤ 2 whole-token character classes whose
+// every `[/.]`-split segment is under 16 chars (or below the entropy bar)
+// qualifies as a path and escapes the fallback.
+const PATH_SHAPED = /^[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)+$/;
+// SWE-rebench instance ids are public corpus identifiers (`owner__repo-PR`),
+// not key material. Some short bridge summaries repeat them and otherwise cross
+// the defacement gate after entropy redaction.
+const SWE_REBENCH_INSTANCE_ID = /^[a-z0-9][a-z0-9._-]*__[a-z0-9][a-z0-9._-]*-\d+$/;
+// Tuning note (#1391): the entropy fallback's threat model is ASCII key
+// material — base64 / base64url / hex runs. Natural-language text outside the
+// Latin script (CJK especially) has char-level Shannon entropy far above 4.0
+// bits/char (most characters in a sentence are unique), so whole-token entropy
+// classified ordinary Chinese skill prose as secrets and shredded it. A token
+// whose non-ASCII share exceeds this threshold skips the entropy fallback
+// entirely; the pass-1 secretlint preset rules still run on everything.
+// Residual exposure: a generic (rule-less) secret glued WITHOUT whitespace
+// into a majority-non-ASCII token escapes the fallback — prefixed keys
+// (ghp_…, AKIA…, sk-…) are still caught by pass 1, and CJK prose separates
+// embedded ASCII material with spacing or punctuation in practice.
+const NON_ASCII_MAX_SHARE = 0.3;
+// Tuning note (#1391): a STRUCTURED token — one containing characters outside
+// SECRET_CHARSET, i.e. URLs (`://`, `?`, `&`, `#`), markdown links (`](`),
+// shell interpolations (`${…}`), serialised code — cannot itself be a
+// contiguous key: real key material never contains brackets, quotes or `?`.
+// A key can only be EMBEDDED in such a token as a delimited segment, so the
+// token is judged per-segment (mirroring the #1348 PATH_SHAPED carve-out)
+// instead of by whole-token entropy, which URLs and markdown links inflate
+// past 4.0 bits/char purely by punctuation/length variety (every seed
+// envelope's attribution URL published as [SECRET:high-entropy]).
+// Segments split on everything outside `[A-Za-z0-9+=_-]`: `/` and `.` split
+// (slug and query-string segments stay short and human-readable — matching
+// the PATH gate's `[/.]` split), while `-`, `_`, `+`, `=` stay inside a
+// segment because base64url alphabets and key=value pairs use them
+// (`?key=<blob>` gates as one segment; a JWT's `.`-separated base64url
+// segments gate individually). Residual exposure, same shape as the #1348
+// note: a secret whose every delimited segment falls under 16 chars (or the
+// entropy bar, or a single character class) escapes — e.g. a base64 blob
+// with `/` every few chars additionally wrapped in punctuation.
+const STRUCTURED_SEGMENT_DELIMITER = /[^A-Za-z0-9+=_-]+/;
+// Tuning note (#1391): a "wordish" segment — two or more purely-alphabetic
+// runs joined by `_` or `-` (`Microsoft_Azure_Capacity`, `backend-refactor`)
+// — is an identifier, not key material, even when its length and character
+// variety clear the entropy bar (the Azure portal URL's
+// `Microsoft_Azure_Capacity` sits at 4.002 bits/char). Key material of
+// segment-gate length (≥ 16 chars) drawn from a base64/base64url alphabet
+// contains a digit with ~94% probability and separator-split all-alphabetic
+// runs almost never; the residual all-alpha, separator-structured key is
+// accepted as out of the fallback's reach.
+const WORDISH_SEGMENT = /^[A-Za-z]+([_-][A-Za-z]+)+$/;
+function shannonEntropy(s) {
+    const freq = {};
+    for (const ch of s)
+        freq[ch] = (freq[ch] ?? 0) + 1;
+    let e = 0;
+    for (const count of Object.values(freq)) {
+        const p = count / s.length;
+        e -= p * Math.log2(p);
+    }
+    return e;
+}
+/** Count distinct character classes present (lowercase / uppercase / digit). */
+function charClassCount(s) {
+    let n = 0;
+    if (/[a-z]/.test(s))
+        n += 1;
+    if (/[A-Z]/.test(s))
+        n += 1;
+    if (/[0-9]/.test(s))
+        n += 1;
+    return n;
+}
+function isSweRebenchInstanceId(token) {
+    return SWE_REBENCH_INSTANCE_ID.test(token);
+}
+/**
+ * Decide whether a single whitespace-delimited token should be redacted as a
+ * high-entropy / secret-shaped value. Purely additive over the original rule:
+ *  - length ≥ ENTROPY_STRICT_LEN (20): entropy bar alone (unchanged behaviour),
+ *  - ENTROPY_MIN_LEN (16) ≤ length < 20: entropy bar AND the structural shape
+ *    gate — the token must be a single secret-charset run mixing ≥ 2 character
+ *    classes (so dictionary words + a trailing suffix like `authentication123`,
+ *    which sit below 4.0 bits/char anyway, are not swept in).
+ * Never fires below ENTROPY_MIN_LEN.
+ *
+ * Path carve-out (#1348): a PATH_SHAPED token whose WHOLE-token character-
+ * class count is ≤ 2 is redacted only when at least one `[/.]`-delimited
+ * segment independently passes the strict shape gate (length ≥
+ * ENTROPY_MIN_LEN, entropy ≥ ENTROPY_MIN_BITS, secret charset, ≥ 2 character
+ * classes) — applied at ALL lengths, so a long path of short slugs never
+ * trips the whole-token entropy bar, while a real key embedded as a path
+ * segment (`api/v1/ghp_…`) still redacts. A path-shaped token mixing ≥ 3
+ * whole-token classes never takes the carve-out — real slugs are 1–2
+ * classes, and 3-class "paths" are secrets wearing slashes/dots (#1348
+ * review finding) — it falls through to the whole-token logic below.
+ * Splitting on dots as well as slashes means a sentence full stop or a file
+ * extension yields its own (failing) segment instead of poisoning the
+ * secret blob next to it. Non-path tokens are unaffected.
+ *
+ * #1391 additions, checked in order:
+ *  - a non-ASCII-dominant token (share > NON_ASCII_MAX_SHARE) is prose in a
+ *    non-Latin script, not ASCII key material — never entropy-gated;
+ *  - a structured token (any character outside SECRET_CHARSET: URLs,
+ *    markdown links, shell interpolations) is judged per delimited segment
+ *    via the same strict gate as path segments — see the
+ *    STRUCTURED_SEGMENT_DELIMITER tuning note.
+ * Pure SECRET_CHARSET runs keep the original whole-token behaviour.
+ */
+function isSecretShapedToken(token) {
+    if (token.length < ENTROPY_MIN_LEN)
+        return false;
+    if (nonAsciiShare(token) > NON_ASCII_MAX_SHARE)
+        return false;
+    if (isSweRebenchInstanceId(token))
+        return false;
+    if (PATH_SHAPED.test(token) && charClassCount(token) <= 2) {
+        return token.split(/[/.]/).some(passesStrictSegmentGate);
+    }
+    if (!SECRET_CHARSET.test(token)) {
+        // Structured token (#1391) — URL, markdown link, shell interpolation…
+        // A contiguous key can only live inside a delimited segment.
+        return token.split(STRUCTURED_SEGMENT_DELIMITER).some(passesStrictSegmentGate);
+    }
+    if (shannonEntropy(token) < ENTROPY_MIN_BITS)
+        return false;
+    if (token.length >= ENTROPY_STRICT_LEN)
+        return true;
+    return charClassCount(token) >= 2;
+}
+/**
+ * The strict per-segment gate shared by the PATH_SHAPED (#1348) and
+ * structured-token (#1391) carve-outs: a segment is secret-shaped only when
+ * it is ≥ ENTROPY_MIN_LEN chars, clears the entropy bar, is a single
+ * secret-charset run, and mixes ≥ 2 character classes.
+ */
+function passesStrictSegmentGate(segment) {
+    return (segment.length >= ENTROPY_MIN_LEN &&
+        !WORDISH_SEGMENT.test(segment) &&
+        shannonEntropy(segment) >= ENTROPY_MIN_BITS &&
+        SECRET_CHARSET.test(segment) &&
+        charClassCount(segment) >= 2);
+}
+/** Share of characters outside the 7-bit ASCII range (by code point). */
+function nonAsciiShare(s) {
+    let n = 0;
+    let total = 0;
+    for (const ch of s) {
+        total += 1;
+        if ((ch.codePointAt(0) ?? 0) > 0x7f)
+            n += 1;
+    }
+    return total === 0 ? 0 : n / total;
+}
+/** Short label from a secretlint ruleId, e.g. `@secretlint/secretlint-rule-github` → `github`. */
+function shortRule(ruleId) {
+    return ruleId.replace(/^@secretlint\/secretlint-rule-/, '').replace(/^@secretlint\//, '');
+}
+// #1378 cosmetic: a `\S+` token inside serialised JSON drags its wrapping
+// delimiters along (`"…/blob",` is one whitespace-delimited token), so
+// replacing the whole token swallowed the quotes/comma and left malformed
+// JSON (`"resolved_path": [SECRET:high-entropy] "files_modified": …`). Split
+// each token into leading punctuation / core / trailing punctuation, gate on
+// the core, and reattach the punctuation around the placeholder. None of the
+// stripped characters belong to SECRET_CHARSET (`=` deliberately excluded —
+// base64 padding), so no secret material is ever preserved; if anything,
+// stripping the wrapper improves detection (the 16–19 char shape gate
+// previously failed on quoted tokens because the quotes broke the charset).
+const TOKEN_WRAPPING = /^([("'`[{,;:]*)([\s\S]*?)([)"'`\]},;:.]*)$/;
+export function secretlintStage(policy, opts = {}) {
+    const entropyFallback = opts.entropyFallback ?? true;
+    const config = { rules: [{ id: PRESET_RULE_ID, rule: creator }] };
+    return {
+        name: 'secretlint',
+        version: VERSION,
+        async scrub(attributes) {
+            const out = {};
+            const redactions = [];
+            for (const [key, value] of Object.entries(attributes)) {
+                if (typeof value !== 'string' || classifyKey(key, policy) !== 'content') {
+                    out[key] = value;
+                    continue;
+                }
+                // Pass 1 — rule-based detection.
+                const result = await lintSource({
+                    source: { filePath: '/span', content: value, ext: '.txt', contentType: 'text' },
+                    options: { config },
+                });
+                let text = value;
+                // Replace from last range to first so earlier indices stay valid.
+                const ranges = [...result.messages].sort((a, b) => b.range[0] - a.range[0]);
+                for (const m of ranges) {
+                    const label = shortRule(m.ruleId);
+                    text = text.slice(0, m.range[0]) + `[SECRET:${label}]` + text.slice(m.range[1]);
+                    redactions.push({ key, stage: 'secretlint', kind: 'secret', detail: label });
+                }
+                // Pass 2 — entropy + secret-shape fallback on whatever survived.
+                // Wrapping punctuation is preserved around the placeholder (#1378).
+                // Skipped entirely under the seed profile (#1409).
+                if (entropyFallback) {
+                    text = text.replace(/\S+/g, (token) => {
+                        const [, lead = '', core = token, trail = ''] = TOKEN_WRAPPING.exec(token) ?? [];
+                        if (isSecretShapedToken(core)) {
+                            redactions.push({ key, stage: 'secretlint', kind: 'secret', detail: 'high-entropy' });
+                            return `${lead}[SECRET:high-entropy]${trail}`;
+                        }
+                        return token;
+                    });
+                }
+                out[key] = text;
+            }
+            return { attributes: out, redactions };
+        },
+    };
+}

package/node_modules/@jinn-network/core/dist/scrub/transformers-detector.d.ts

@@ -0,0 +1,35 @@
+import type { PiiDetector, PiiEntity } from './ml-pii-stage.js';
+/** Default Transformers.js-compatible ONNX NER model (person/org/location/misc). */
+export declare const DEFAULT_NER_MODEL = "Xenova/bert-base-NER";
+/**
+ * Entity groups treated as PII to redact. Structured PII (emails, cards, SSNs)
+ * is handled upstream by openredaction; this tier catches the free-text
+ * entities regex can't — names, organizations, places. MISC is excluded (noisy).
+ */
+export declare const DEFAULT_PII_ENTITY_GROUPS: string[];
+export interface TransformersPiiDetectorOptions {
+    model?: string;
+    /** Minimum NER confidence to redact (0–1). */
+    threshold?: number;
+    /** Entity groups to treat as PII. */
+    entityGroups?: string[];
+}
+/**
+ * Real ML PII detector — the production implementation of the `PiiDetector`
+ * seam. Wraps a Transformers.js token-classification (NER) pipeline running an
+ * ONNX model entirely in-process (no Python, no separate process). Loaded lazily
+ * (or eagerly via `init()`); the heavy onnxruntime-node dependency is pulled in
+ * only when the detector is actually used.
+ */
+export declare class TransformersPiiDetector implements PiiDetector {
+    private pipe;
+    private initPromise;
+    private readonly model;
+    private readonly threshold;
+    private readonly entityGroups;
+    constructor(opts?: TransformersPiiDetectorOptions);
+    /** Eagerly load the model (e.g. at daemon boot) so the first publish isn't slow. */
+    init(): Promise<void>;
+    private ensureReady;
+    detect(text: string): Promise<PiiEntity[]>;
+}

package/node_modules/@jinn-network/core/dist/scrub/transformers-detector.js

@@ -0,0 +1,67 @@
+/** Default Transformers.js-compatible ONNX NER model (person/org/location/misc). */
+export const DEFAULT_NER_MODEL = 'Xenova/bert-base-NER';
+/**
+ * Entity groups treated as PII to redact. Structured PII (emails, cards, SSNs)
+ * is handled upstream by openredaction; this tier catches the free-text
+ * entities regex can't — names, organizations, places. MISC is excluded (noisy).
+ */
+export const DEFAULT_PII_ENTITY_GROUPS = ['PER', 'ORG', 'LOC'];
+/**
+ * Real ML PII detector — the production implementation of the `PiiDetector`
+ * seam. Wraps a Transformers.js token-classification (NER) pipeline running an
+ * ONNX model entirely in-process (no Python, no separate process). Loaded lazily
+ * (or eagerly via `init()`); the heavy onnxruntime-node dependency is pulled in
+ * only when the detector is actually used.
+ */
+export class TransformersPiiDetector {
+    pipe;
+    initPromise;
+    model;
+    threshold;
+    entityGroups;
+    constructor(opts = {}) {
+        this.model = opts.model ?? DEFAULT_NER_MODEL;
+        this.threshold = opts.threshold ?? 0.6;
+        this.entityGroups = new Set(opts.entityGroups ?? DEFAULT_PII_ENTITY_GROUPS);
+    }
+    /** Eagerly load the model (e.g. at daemon boot) so the first publish isn't slow. */
+    async init() {
+        await this.ensureReady();
+    }
+    ensureReady() {
+        if (this.pipe)
+            return Promise.resolve(this.pipe);
+        if (!this.initPromise) {
+            this.initPromise = (async () => {
+                const { pipeline } = await import('@huggingface/transformers');
+                const pipe = (await pipeline('token-classification', this.model));
+                this.pipe = pipe;
+                return pipe;
+            })();
+        }
+        return this.initPromise;
+    }
+    async detect(text) {
+        if (!text.trim())
+            return [];
+        const pipe = await this.ensureReady();
+        const results = await pipe(text, { aggregation_strategy: 'simple' });
+        const out = [];
+        const seen = new Set();
+        for (const r of results) {
+            if (r.score < this.threshold)
+                continue;
+            if (!this.entityGroups.has(r.entity_group))
+                continue;
+            const t = r.word.trim();
+            if (!t)
+                continue;
+            const key = `${r.entity_group}:${t}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            out.push({ label: r.entity_group, text: t });
+        }
+        return out;
+    }
+}

package/node_modules/@jinn-network/core/dist/scrub/types.d.ts

@@ -0,0 +1,25 @@
+export type Attributes = Record<string, unknown>;
+export interface RedactionRecord {
+    /** attribute key affected */
+    key: string;
+    /** stage that made the redaction (matches ScrubStage.name) */
+    stage: string;
+    /** category, e.g. 'dropped-key' | 'secret' | 'pii' */
+    kind: string;
+    /** optional detail, e.g. a rule id or entity type */
+    detail?: string;
+}
+export interface ScrubResult {
+    attributes: Attributes;
+    redactions: RedactionRecord[];
+}
+/**
+ * A single stage in the seller-side scrub pipeline. `name` + `version` expose
+ * the active components to local inspection and tests. The current published
+ * trace-envelope schema does not carry this component list.
+ */
+export interface ScrubStage {
+    readonly name: string;
+    readonly version: string;
+    scrub(attributes: Attributes): ScrubResult | Promise<ScrubResult>;
+}

package/node_modules/@jinn-network/core/dist/scrub/types.js

@@ -0,0 +1 @@
+export {};