@jinn-network/core 0.1.0-canary.3afae198

package/dist/scrub/apply-dispositions.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Apply policy dispositions to an attribute bag after one detection pass
+ * (#1969 / design §6.5).
+ */
+import type { Finding } from './finding.js';
+import { type PolicyTable } from './policy.js';
+import { type ReviewQueueStore } from './review-queue.js';
+import type { Attributes, RedactionRecord } from './types.js';
+export { RejectPublishError, assertNoRejectPublish, rejectPublishFindings } from './reject-publish-error.js';
+export interface ApplyDispositionsOptions {
+    policy?: PolicyTable;
+    /**
+     * Check-mode consumers (layer-2 distill, episode refuse): any non-pass
+     * disposition rejects. Still applies redacts so the body change is visible.
+     */
+    checkMode?: boolean;
+    /**
+     * Optional review-queue store. When provided, resolved flags are honored
+     * (`approve-instance` → pass, `redact-instance` → redact, allowlist /
+     * identity-pack → pass). Unresolved flags stay as `flag` and are listed in
+     * {@link ApplyDispositionsResult.unresolvedFlags}.
+     */
+    reviewStore?: ReviewQueueStore;
+}
+export interface ApplyDispositionsResult {
+    attributes: Attributes;
+    redactions: RedactionRecord[];
+    findings: Finding[];
+    /** True when a reject-publish disposition fired, or check-mode saw a non-pass. */
+    rejected: boolean;
+    /** Flag findings that remain unresolved after consulting the review queue. */
+    unresolvedFlags: Finding[];
+    /**
+     * Applied disposition counts keyed `${ScrubClass}:${redact|flag|reject}`
+     * (#1974). Pass dispositions are omitted.
+     */
+    perClassCounts: Record<string, number>;
+}
+/** Stub text for a redact disposition, keyed by class (+ optional evidence hint). */
+export declare function stubForFinding(finding: Finding, occurrenceIndex: number): string;
+/**
+ * Apply dispositions. Span redacts are applied right-to-left per key so earlier
+ * offsets stay valid. A5 reject-publish on a drop-key finding removes the key.
+ */
+export declare function applyDispositions(attributes: Attributes, findings: Finding[], opts?: ApplyDispositionsOptions): ApplyDispositionsResult;
+/**
+ * Allowlist-pass records are auditable Legibility receipts, not detections.
+ * They must not trip refuse-on-detection / distill check-mode gates.
+ */
+export declare function countsTowardRefusal(record: RedactionRecord): boolean;
+/** Redaction records that imply content was scrubbed or must refuse. */
+export declare function refusalRedactions(redactions: RedactionRecord[]): RedactionRecord[];
+/**
+ * True when publish/check should refuse the item.
+ *
+ * Prefer the explicit `rejected` bit (set by dispositions / check-mode).
+ * Fall back to refusal-relevant redaction records only — never `allowlist-pass`.
+ * For reject-publish classes (A4/A5 content), prefer
+ * {@link assertNoRejectPublish} so the abort is a loud class-named error.
+ * For unresolved flags, prefer {@link assertNoUnresolvedFlags} from
+ * `review-queue.ts`.
+ */
+export declare function shouldRejectPublish(result: {
+    rejected?: boolean;
+    redactions: RedactionRecord[];
+    findings?: Finding[];
+    unresolvedFlags?: Finding[];
+}): boolean;
+/**
+ * Apply dispositions, then abort loudly when a reject-publish class fired.
+ * Use at publish altitude (capture/emit) — not for check-mode distill, which
+ * maps redactions to rejection reasons without throwing.
+ */
+export declare function applyDispositionsOrReject(attributes: Attributes, findings: Finding[], opts?: ApplyDispositionsOptions): ApplyDispositionsResult;

package/dist/scrub/apply-dispositions.js

@@ -0,0 +1,309 @@
+/**
+ * Apply policy dispositions to an attribute bag after one detection pass
+ * (#1969 / design §6.5).
+ */
+import { DEFAULT_POLICY, checkModeRejects, resolveDisposition, } from './policy.js';
+import { incrementPerClassCount } from './provenance.js';
+import { assertNoRejectPublish } from './reject-publish-error.js';
+import { findingFingerprint, } from './review-queue.js';
+export { RejectPublishError, assertNoRejectPublish, rejectPublishFindings } from './reject-publish-error.js';
+/** Stub text for a redact disposition, keyed by class (+ optional evidence hint). */
+export function stubForFinding(finding, occurrenceIndex) {
+    const hint = finding.evidence[0] ?? '';
+    switch (finding.class) {
+        case 'B1':
+            return '[EMAIL]';
+        case 'B2':
+            // Joint carrier: user.email values stub as email; names as NAME.
+            if (hint.includes('email'))
+                return '[EMAIL]';
+            return '[NAME]';
+        case 'D1':
+            return '/users/anon';
+        case 'C1':
+            return `[ETH_ADDR_${occurrenceIndex}]`;
+        case 'B3':
+            return '[NAME]';
+        case 'B4':
+            return '[USERNAME]';
+        case 'D2':
+            return '[IP]';
+        case 'D3':
+            return '[HOSTNAME]';
+        case 'A1':
+            if (hint.includes('aws-access-key-id'))
+                return '[SECRET:aws-access-key-id]';
+            if (hint.includes('gcp-api-key'))
+                return '[SECRET:gcp-api-key]';
+            if (hint.startsWith('secret:'))
+                return `[SECRET:${hint.slice('secret:'.length)}]`;
+            return '[SECRET:redacted]';
+        case 'A2':
+            return '[SECRET:high-entropy]';
+        case 'A3':
+            return '[SECRET:url-credential]';
+        case 'B7':
+            if (hint.includes('iban'))
+                return '[IBAN]';
+            return '[CARD]';
+        default: {
+            if (hint.startsWith('ml:')) {
+                return `[PII:${hint.slice('ml:'.length)}]`;
+            }
+            if (hint.startsWith('gitleaks:')) {
+                return `[SECRET:${hint.slice('gitleaks:'.length)}]`;
+            }
+            const label = hint || finding.class;
+            return `[PII:${label}]`;
+        }
+    }
+}
+function redactionKind(scrubClass, _finding) {
+    if (scrubClass.startsWith('A'))
+        return 'secret';
+    return 'pii';
+}
+function redactionDetail(finding) {
+    const hint = finding.evidence[0] ?? finding.class;
+    if (hint === 'drop-key' || hint === 'machine-identity-key')
+        return undefined;
+    // Normalize C1 to the shipped detail id so seed/trace/layer2 records match.
+    if (finding.class === 'C1')
+        return 'eth-address';
+    if (hint.startsWith('secret:'))
+        return hint.slice('secret:'.length);
+    if (hint.startsWith('gitleaks:'))
+        return hint.slice('gitleaks:'.length);
+    if (hint.startsWith('ml:'))
+        return hint.slice('ml:'.length);
+    return hint;
+}
+function isKeyDropFinding(finding) {
+    return (finding.evidence.includes('drop-key') ||
+        finding.evidence.includes('machine-identity-key'));
+}
+function decisionOverridesFlag(decision) {
+    if (decision === 'redact-instance')
+        return 'redact';
+    if (decision === 'approve-instance' ||
+        decision === 'add-to-allowlist' ||
+        decision === 'add-to-identity-pack') {
+        return 'pass';
+    }
+    return undefined;
+}
+function effectiveDisposition(finding, policy, checkMode, reviewStore) {
+    let disposition = resolveDisposition(finding.class, finding.confidence, policy);
+    if (disposition === 'flag' && reviewStore) {
+        const override = decisionOverridesFlag(reviewStore.resolutionFor(finding));
+        if (override)
+            disposition = override;
+    }
+    if (checkMode && disposition !== 'pass') {
+        // Check-mode still applies the underlying redact/reject action; the
+        // rejected bit is set separately via checkModeRejects.
+        return disposition;
+    }
+    return disposition;
+}
+/**
+ * Apply dispositions. Span redacts are applied right-to-left per key so earlier
+ * offsets stay valid. A5 reject-publish on a drop-key finding removes the key.
+ */
+export function applyDispositions(attributes, findings, opts = {}) {
+    const policy = opts.policy ?? DEFAULT_POLICY;
+    const checkMode = opts.checkMode ?? false;
+    const reviewStore = opts.reviewStore;
+    const out = { ...attributes };
+    const redactions = [];
+    const unresolvedFlags = [];
+    const perClassCounts = {};
+    let rejected = false;
+    // Key-drop findings first (A5 structural drop-key, D3 machine-identity).
+    // Structural key drops remove the attribute; they do NOT reject-publish in
+    // redact-mode (content-level A4/A5 spans own the loud abort). Check-mode
+    // still rejects so distill stays fail-closed on any non-pass.
+    for (const finding of findings) {
+        if (!isKeyDropFinding(finding))
+            continue;
+        const disposition = effectiveDisposition(finding, policy, checkMode, reviewStore);
+        if (disposition === 'pass')
+            continue;
+        delete out[finding.span.key];
+        redactions.push({
+            key: finding.span.key,
+            stage: finding.detector.name,
+            kind: 'dropped-key',
+        });
+        // Structural drops are applied as redacts (key removed), even when the
+        // policy row for A5 content is reject-publish.
+        incrementPerClassCount(perClassCounts, finding.class, 'redact');
+        if (checkMode)
+            rejected = true;
+    }
+    // Group remaining span findings by key, apply right-to-left.
+    const byKey = new Map();
+    for (const finding of findings) {
+        if (isKeyDropFinding(finding))
+            continue;
+        if (!(finding.span.key in out))
+            continue;
+        const list = byKey.get(finding.span.key) ?? [];
+        list.push(finding);
+        byKey.set(finding.span.key, list);
+    }
+    for (const [key, keyFindings] of byKey) {
+        const value = out[key];
+        if (typeof value !== 'string')
+            continue;
+        const sorted = [...keyFindings].sort((a, b) => b.span.start - a.span.start);
+        const covered = [];
+        let text = value;
+        // Collect redact records left-to-right (unshift while applying right-to-left)
+        // so callers that pin redaction order keep a stable, start-ascending list.
+        const redactRecords = [];
+        for (const finding of sorted) {
+            const disposition = effectiveDisposition(finding, policy, checkMode, reviewStore);
+            if (disposition === 'pass') {
+                // Auditable allowlist hit (§6.4): record "we saw it and passed it on
+                // purpose". These must NOT count toward refuse-on-detection /
+                // check-mode rejection (kind `allowlist-pass` is filtered by
+                // {@link countsTowardRefusal}).
+                const allowEvidence = finding.evidence.find((e) => e.startsWith('allowlist:'));
+                if (allowEvidence) {
+                    redactions.push({
+                        key,
+                        stage: finding.detector.name,
+                        kind: 'allowlist-pass',
+                        detail: allowEvidence.slice('allowlist:'.length),
+                    });
+                }
+                continue;
+            }
+            if (disposition === 'reject-publish') {
+                // Always stub the span so A4/A5 plaintext never survives into
+                // check-mode / in-memory capture envelopes; abort is still signaled
+                // via `rejected` + assertNoRejectPublish at publish altitude.
+                rejected = true;
+                const { start, end } = finding.span;
+                if (start >= 0 && end <= text.length && start < end &&
+                    !covered.some((c) => start < c.end && end > c.start)) {
+                    const leftIndex = keyFindings.filter((f) => {
+                        const d = effectiveDisposition(f, policy, checkMode, reviewStore);
+                        return (d === 'redact' || d === 'reject-publish') && f.span.start < start;
+                    }).length;
+                    const stub = stubForFinding(finding, leftIndex);
+                    text = text.slice(0, start) + stub + text.slice(end);
+                    covered.push({ start, end });
+                }
+                redactRecords.unshift({
+                    key,
+                    stage: finding.detector.name,
+                    kind: redactionKind(finding.class, finding),
+                    detail: redactionDetail(finding),
+                });
+                incrementPerClassCount(perClassCounts, finding.class, disposition);
+                continue;
+            }
+            if (disposition === 'flag') {
+                unresolvedFlags.push(finding);
+                incrementPerClassCount(perClassCounts, finding.class, disposition);
+                // In redact-mode leave text (review queue owns the hold). In check-mode,
+                // record so consumers reject.
+                if (checkMode) {
+                    rejected = true;
+                    redactions.push({
+                        key,
+                        stage: finding.detector.name,
+                        kind: 'flag',
+                        detail: redactionDetail(finding),
+                    });
+                }
+                continue;
+            }
+            // redact
+            const { start, end } = finding.span;
+            if (start < 0 || end > text.length || start >= end)
+                continue;
+            if (covered.some((c) => start < c.end && end > c.start))
+                continue;
+            const leftIndex = keyFindings.filter((f) => {
+                if (effectiveDisposition(f, policy, checkMode, reviewStore) !== 'redact')
+                    return false;
+                return f.span.start < start;
+            }).length;
+            const stub = stubForFinding(finding, leftIndex);
+            text = text.slice(0, start) + stub + text.slice(end);
+            covered.push({ start, end });
+            redactRecords.unshift({
+                key,
+                stage: finding.detector.name,
+                kind: redactionKind(finding.class, finding),
+                detail: redactionDetail(finding),
+            });
+            incrementPerClassCount(perClassCounts, finding.class, disposition);
+            if (checkMode)
+                rejected = true;
+        }
+        redactions.push(...redactRecords);
+        out[key] = text;
+    }
+    if (checkMode && checkModeRejects(findings, policy)) {
+        rejected = true;
+    }
+    // Dedupe unresolved flags by fingerprint (nested walks can re-emit).
+    const seen = new Set();
+    const uniqueUnresolved = unresolvedFlags.filter((f) => {
+        const fp = findingFingerprint(f);
+        if (seen.has(fp))
+            return false;
+        seen.add(fp);
+        return true;
+    });
+    return {
+        attributes: out,
+        redactions,
+        findings,
+        rejected,
+        unresolvedFlags: uniqueUnresolved,
+        perClassCounts,
+    };
+}
+/**
+ * Allowlist-pass records are auditable Legibility receipts, not detections.
+ * They must not trip refuse-on-detection / distill check-mode gates.
+ */
+export function countsTowardRefusal(record) {
+    return record.kind !== 'allowlist-pass';
+}
+/** Redaction records that imply content was scrubbed or must refuse. */
+export function refusalRedactions(redactions) {
+    return redactions.filter(countsTowardRefusal);
+}
+/**
+ * True when publish/check should refuse the item.
+ *
+ * Prefer the explicit `rejected` bit (set by dispositions / check-mode).
+ * Fall back to refusal-relevant redaction records only — never `allowlist-pass`.
+ * For reject-publish classes (A4/A5 content), prefer
+ * {@link assertNoRejectPublish} so the abort is a loud class-named error.
+ * For unresolved flags, prefer {@link assertNoUnresolvedFlags} from
+ * `review-queue.ts`.
+ */
+export function shouldRejectPublish(result) {
+    if (result.rejected)
+        return true;
+    if (result.unresolvedFlags && result.unresolvedFlags.length > 0)
+        return true;
+    return refusalRedactions(result.redactions).length > 0;
+}
+/**
+ * Apply dispositions, then abort loudly when a reject-publish class fired.
+ * Use at publish altitude (capture/emit) — not for check-mode distill, which
+ * maps redactions to rejection reasons without throwing.
+ */
+export function applyDispositionsOrReject(attributes, findings, opts = {}) {
+    const applied = applyDispositions(attributes, findings, opts);
+    assertNoRejectPublish(applied, opts.policy ?? DEFAULT_POLICY);
+    return applied;
+}

package/dist/scrub/build.d.ts

@@ -0,0 +1,75 @@
+import { ScrubPipeline } from './pipeline.js';
+import { type KeyPolicy } from './key-policy.js';
+import { type PiiDetector } from './ml-pii-stage.js';
+import { type AssembleKnownIdentityOptions, type AssembledKnownIdentity } from './known-identity-detector.js';
+import type { Detector } from './finding.js';
+/**
+ * Default key policy. `jinn.*` identity/chain attributes are structural and pass
+ * raw. The `drop` tier deletes the spec's stage-1 high-confidence keys outright
+ * (auth headers, cookies, env dumps — see `spec/2026-06-15-ts-trajectory-scrub-stack.md`):
+ * these never carry sellable content and are never safe to publish. Globs use the
+ * trailing-`*` prefix form `classifyKey` supports; the HTTP header keys are listed
+ * per request/response direction (a leading `*.header.…` glob is not matched, so
+ * we enumerate the concrete keys). Machine-identity keys (D3 carrier) drop
+ * attempt-manifest `host` / hostname telemetry. Everything else is `content` and
+ * flows through the value-scrubbing detectors.
+ */
+export declare const DEFAULT_KEY_POLICY: KeyPolicy;
+export interface BuildScrubPipelineOptions {
+    policy?: KeyPolicy;
+    /** When provided, the ML PII (GLiNER) detector is appended. */
+    piiDetector?: PiiDetector;
+    /** Known-identity pack + non-address allowlist (#1971). */
+    knownIdentity?: AssembleKnownIdentityOptions | AssembledKnownIdentity;
+    /** Review-queue store for flag resolutions (#1973). */
+    reviewStore?: import('./review-queue.js').ReviewQueueStore;
+    /**
+     * When false, unresolved flags do not abort (tests). Default true for
+     * redact-mode publish lanes.
+     */
+    failClosedOnUnresolvedFlags?: boolean;
+}
+export declare function resolveKnownIdentity(opts?: AssembleKnownIdentityOptions | AssembledKnownIdentity): AssembledKnownIdentity;
+/** Build provenance extras from known-identity + optional ML detector (#1974). */
+export declare function buildProvenanceExtras(knownIdentity: AssembledKnownIdentity, piiDetector?: PiiDetector): {
+    modelId: string | null;
+    labels: readonly string[];
+    allowlistDigest: string;
+};
+/**
+ * Shared detector inventory (#1969 / #1970 / #1971 / #1972 / #1973). Every
+ * publish/check consumer runs the same owned detectors (key-policy,
+ * plain-patterns including C1 wallet + A1 credential IDs, git-identity B2
+ * carriers, known-identity pack + non-address allowlist, Tier-1
+ * reject/URL/IP/instruments/gitleaks, secretlint). What varies is disposition /
+ * check-mode and whether an ML PII detector is injected. Seed keeps the entropy
+ * fallback off until A2 mid-band flags are absorbed without refuse-on-detection
+ * (#1409 shipped behavior). openredaction was retired in #1973.
+ */
+export declare function sharedDetectorInventory(policy: KeyPolicy, opts?: {
+    entropyFallback?: boolean;
+    piiDetector?: PiiDetector;
+    knownIdentity?: AssembleKnownIdentityOptions | AssembledKnownIdentity;
+}): Detector[];
+/**
+ * Trace / redact-mode preset over the shared inventory.
+ *
+ * @deprecated Prefer thinking in terms of one inventory + policy; this builder
+ * remains as a compatibility preset through the migration (#1969).
+ */
+export declare function buildScrubPipeline(opts?: BuildScrubPipelineOptions): ScrubPipeline;
+export interface BuildSeedScrubPipelineOptions {
+    policy?: KeyPolicy;
+    knownIdentity?: AssembleKnownIdentityOptions | AssembledKnownIdentity;
+    piiDetector?: PiiDetector;
+    reviewStore?: import('./review-queue.js').ReviewQueueStore;
+    failClosedOnUnresolvedFlags?: boolean;
+}
+/**
+ * Seed / redact-mode preset (#1409 / #1969). Same owned inventory as layer-2.
+ * Entropy fallback stays off to preserve the shipped zero-corruption seed
+ * behavior until A2 mid-band can flag without tripping refuse-on-detection.
+ *
+ * @deprecated Compatibility preset over the one inventory + policy table.
+ */
+export declare function buildSeedScrubPipeline(policyOrOpts?: KeyPolicy | BuildSeedScrubPipelineOptions): ScrubPipeline;

package/dist/scrub/build.js

@@ -0,0 +1,143 @@
+import { ScrubPipeline } from './pipeline.js';
+import { keyPolicyDetector } from './key-policy.js';
+import { plainPatternsDetector } from './plain-patterns-stage.js';
+import { gitIdentityDetector } from './git-identity-detector.js';
+import { secretlintDetector } from './secretlint-stage.js';
+import { mlPiiDetector } from './ml-pii-stage.js';
+import { assembleKnownIdentity, knownIdentityDetector, } from './known-identity-detector.js';
+import { urlCredentialsDetector } from './url-credentials-detector.js';
+import { rejectClassesDetector } from './reject-classes-detector.js';
+import { checksummedInstrumentsDetector } from './checksummed-instruments-detector.js';
+import { ipAddressDetector } from './ip-address-detector.js';
+import { gitleaksDetector } from './gitleaks-detector.js';
+import { DEFAULT_POLICY } from './policy.js';
+import { computeAllowlistDigest } from './provenance.js';
+/**
+ * Default key policy. `jinn.*` identity/chain attributes are structural and pass
+ * raw. The `drop` tier deletes the spec's stage-1 high-confidence keys outright
+ * (auth headers, cookies, env dumps — see `spec/2026-06-15-ts-trajectory-scrub-stack.md`):
+ * these never carry sellable content and are never safe to publish. Globs use the
+ * trailing-`*` prefix form `classifyKey` supports; the HTTP header keys are listed
+ * per request/response direction (a leading `*.header.…` glob is not matched, so
+ * we enumerate the concrete keys). Machine-identity keys (D3 carrier) drop
+ * attempt-manifest `host` / hostname telemetry. Everything else is `content` and
+ * flows through the value-scrubbing detectors.
+ */
+export const DEFAULT_KEY_POLICY = {
+    safe: ['jinn.*'],
+    drop: [
+        'http.request.header.authorization',
+        'http.response.header.authorization',
+        'http.request.header.cookie',
+        'http.response.header.cookie',
+        'http.request.header.set-cookie',
+        'http.response.header.set-cookie',
+        'env.*',
+    ],
+    machineIdentity: [
+        'host',
+        'hostname',
+        'os.hostname',
+        'attempt.host',
+        'attempt.hostname',
+        'system.hostname',
+        'device.hostname',
+        'device.host',
+    ],
+};
+export function resolveKnownIdentity(opts) {
+    // AssembledKnownIdentity is a subset of AssembleKnownIdentityOptions;
+    // re-assembly is idempotent (allowlist entries are deduped).
+    return assembleKnownIdentity(opts);
+}
+/** Duck-type ML detector metadata for the policy hash (#1974). */
+function provenanceFromPiiDetector(detector) {
+    if (!detector)
+        return { modelId: null, labels: [] };
+    const withMeta = detector;
+    if (typeof withMeta.modelId === 'string' && withMeta.labelSet) {
+        return { modelId: withMeta.modelId, labels: withMeta.labelSet };
+    }
+    return { modelId: null, labels: [] };
+}
+/** Build provenance extras from known-identity + optional ML detector (#1974). */
+export function buildProvenanceExtras(knownIdentity, piiDetector) {
+    const ml = provenanceFromPiiDetector(piiDetector);
+    return {
+        modelId: ml.modelId,
+        labels: ml.labels,
+        allowlistDigest: computeAllowlistDigest(knownIdentity.allowlist.entries),
+    };
+}
+/**
+ * Shared detector inventory (#1969 / #1970 / #1971 / #1972 / #1973). Every
+ * publish/check consumer runs the same owned detectors (key-policy,
+ * plain-patterns including C1 wallet + A1 credential IDs, git-identity B2
+ * carriers, known-identity pack + non-address allowlist, Tier-1
+ * reject/URL/IP/instruments/gitleaks, secretlint). What varies is disposition /
+ * check-mode and whether an ML PII detector is injected. Seed keeps the entropy
+ * fallback off until A2 mid-band flags are absorbed without refuse-on-detection
+ * (#1409 shipped behavior). openredaction was retired in #1973.
+ */
+export function sharedDetectorInventory(policy, opts = {}) {
+    const detectors = [keyPolicyDetector(policy)];
+    detectors.push(plainPatternsDetector(policy));
+    detectors.push(gitIdentityDetector(policy));
+    detectors.push(knownIdentityDetector(policy, { assembled: resolveKnownIdentity(opts.knownIdentity) }));
+    detectors.push(urlCredentialsDetector(policy));
+    detectors.push(rejectClassesDetector(policy));
+    detectors.push(checksummedInstrumentsDetector(policy));
+    detectors.push(ipAddressDetector(policy));
+    detectors.push(gitleaksDetector(policy));
+    detectors.push(secretlintDetector(policy, { entropyFallback: opts.entropyFallback ?? true }));
+    if (opts.piiDetector) {
+        detectors.push(mlPiiDetector(policy, opts.piiDetector));
+    }
+    return detectors;
+}
+/**
+ * Trace / redact-mode preset over the shared inventory.
+ *
+ * @deprecated Prefer thinking in terms of one inventory + policy; this builder
+ * remains as a compatibility preset through the migration (#1969).
+ */
+export function buildScrubPipeline(opts = {}) {
+    const policy = opts.policy ?? DEFAULT_KEY_POLICY;
+    const knownIdentity = resolveKnownIdentity(opts.knownIdentity);
+    return new ScrubPipeline(sharedDetectorInventory(policy, {
+        entropyFallback: true,
+        piiDetector: opts.piiDetector,
+        knownIdentity,
+    }), {
+        policy: DEFAULT_POLICY,
+        checkMode: false,
+        reviewStore: opts.reviewStore,
+        failClosedOnUnresolvedFlags: opts.failClosedOnUnresolvedFlags,
+        provenance: buildProvenanceExtras(knownIdentity, opts.piiDetector),
+    });
+}
+/**
+ * Seed / redact-mode preset (#1409 / #1969). Same owned inventory as layer-2.
+ * Entropy fallback stays off to preserve the shipped zero-corruption seed
+ * behavior until A2 mid-band can flag without tripping refuse-on-detection.
+ *
+ * @deprecated Compatibility preset over the one inventory + policy table.
+ */
+export function buildSeedScrubPipeline(policyOrOpts = DEFAULT_KEY_POLICY) {
+    const opts = policyOrOpts && 'safe' in policyOrOpts
+        ? { policy: policyOrOpts }
+        : policyOrOpts;
+    const policy = opts.policy ?? DEFAULT_KEY_POLICY;
+    const knownIdentity = resolveKnownIdentity(opts.knownIdentity);
+    return new ScrubPipeline(sharedDetectorInventory(policy, {
+        entropyFallback: false,
+        piiDetector: opts.piiDetector,
+        knownIdentity,
+    }), {
+        policy: DEFAULT_POLICY,
+        checkMode: false,
+        reviewStore: opts.reviewStore,
+        failClosedOnUnresolvedFlags: opts.failClosedOnUnresolvedFlags,
+        provenance: buildProvenanceExtras(knownIdentity, opts.piiDetector),
+    });
+}

package/dist/scrub/checksummed-instruments-detector.d.ts

@@ -0,0 +1,13 @@
+/**
+ * B7 — checksummed payment instruments (#1972 / design §6.2).
+ *
+ * Card numbers (Luhn) and IBANs (mod-97). SSN-shape stays context-gated and is
+ * not emitted here.
+ */
+import { type KeyPolicy } from './key-policy.js';
+import type { Detector } from './finding.js';
+export declare function checksummedInstrumentsDetector(policy: KeyPolicy): Detector;
+/** ISO/IEC 7812 Luhn checksum. */
+export declare function luhnOk(digits: string): boolean;
+/** ISO 13616 IBAN mod-97 check. */
+export declare function ibanMod97Ok(iban: string): boolean;