@jinn-network/core 0.1.0-canary.3afae198

package/dist/scrub/eval/metrics.d.ts

@@ -0,0 +1,19 @@
+import type { ClassCounts, ClassMetrics, ScrubClass } from './types.js';
+export declare function emptyCounts(): ClassCounts;
+export declare function metricsFromCounts(c: ClassCounts): ClassMetrics;
+export declare function mergeCounts(a: ClassCounts, b: ClassCounts): ClassCounts;
+/**
+ * Score predicted spans against gold labels for one class using interval overlap.
+ * A prediction that overlaps any unmatched gold label is TP; unmatched gold → FN;
+ * unmatched predictions → FP. Distinct-source dedupe: gold labels with the same
+ * `sourceId` count once (first occurrence wins).
+ */
+export declare function scoreClass(gold: Array<{
+    start: number;
+    end: number;
+    sourceId?: string;
+}>, pred: Array<{
+    start: number;
+    end: number;
+}>): ClassCounts;
+export declare function aggregateClassMap(perFixture: Array<Partial<Record<ScrubClass, ClassCounts>>>): Partial<Record<ScrubClass, ClassMetrics>>;

package/dist/scrub/eval/metrics.js

@@ -0,0 +1,77 @@
+export function emptyCounts() {
+    return { tp: 0, fp: 0, fn: 0 };
+}
+export function metricsFromCounts(c) {
+    const recall = c.tp + c.fn === 0 ? 1 : c.tp / (c.tp + c.fn);
+    const precision = c.tp + c.fp === 0 ? 1 : c.tp / (c.tp + c.fp);
+    const beta = 2;
+    const betaSq = beta * beta;
+    const fBeta2 = precision + recall === 0
+        ? 0
+        : ((1 + betaSq) * precision * recall) / (betaSq * precision + recall);
+    return { ...c, recall, precision, fBeta2 };
+}
+export function mergeCounts(a, b) {
+    return { tp: a.tp + b.tp, fp: a.fp + b.fp, fn: a.fn + b.fn };
+}
+/**
+ * Score predicted spans against gold labels for one class using interval overlap.
+ * A prediction that overlaps any unmatched gold label is TP; unmatched gold → FN;
+ * unmatched predictions → FP. Distinct-source dedupe: gold labels with the same
+ * `sourceId` count once (first occurrence wins).
+ */
+export function scoreClass(gold, pred) {
+    const seenSources = new Set();
+    const dedupedGold = [];
+    for (const g of gold) {
+        if (g.sourceId) {
+            if (seenSources.has(g.sourceId))
+                continue;
+            seenSources.add(g.sourceId);
+        }
+        dedupedGold.push({ start: g.start, end: g.end });
+    }
+    const goldMatched = new Array(dedupedGold.length).fill(false);
+    const predMatched = new Array(pred.length).fill(false);
+    for (let pi = 0; pi < pred.length; pi += 1) {
+        for (let gi = 0; gi < dedupedGold.length; gi += 1) {
+            if (goldMatched[gi])
+                continue;
+            if (overlaps(pred[pi], dedupedGold[gi])) {
+                goldMatched[gi] = true;
+                predMatched[pi] = true;
+                break;
+            }
+        }
+    }
+    let tp = 0;
+    let fn = 0;
+    let fp = 0;
+    for (const m of goldMatched) {
+        if (m)
+            tp += 1;
+        else
+            fn += 1;
+    }
+    for (const m of predMatched) {
+        if (!m)
+            fp += 1;
+    }
+    return { tp, fp, fn };
+}
+function overlaps(a, b) {
+    return a.start < b.end && b.start < a.end;
+}
+export function aggregateClassMap(perFixture) {
+    const acc = {};
+    for (const row of perFixture) {
+        for (const [cls, counts] of Object.entries(row)) {
+            acc[cls] = acc[cls] ? mergeCounts(acc[cls], counts) : { ...counts };
+        }
+    }
+    const out = {};
+    for (const [cls, counts] of Object.entries(acc)) {
+        out[cls] = metricsFromCounts(counts);
+    }
+    return out;
+}

package/dist/scrub/eval/run-bench.d.ts

@@ -0,0 +1,8 @@
+import type { ScrubPipeline } from '../pipeline.js';
+import type { BenchReport, ClassCounts, EvalFixture, ScrubClass } from './types.js';
+export declare function pipelineForProfile(profile: EvalFixture['profile'], fixture?: EvalFixture): ScrubPipeline;
+export declare function scoreFixture(fixture: EvalFixture): Promise<{
+    counts: Partial<Record<ScrubClass, ClassCounts>>;
+    corruptionFailure: boolean;
+}>;
+export declare function runBench(fixtures: EvalFixture[]): Promise<BenchReport>;

package/dist/scrub/eval/run-bench.js

@@ -0,0 +1,125 @@
+import { buildLayer2ScrubPipeline } from '../layer2.js';
+import { buildScrubPipeline, buildSeedScrubPipeline } from '../build.js';
+import { RejectPublishError } from '../reject-publish-error.js';
+import { UnresolvedFlagError } from '../review-queue.js';
+import { aggregateClassMap, emptyCounts, scoreClass } from './metrics.js';
+import { findingsFromScrubResult } from './findings-from-scrub.js';
+import { createMemoryReviewQueueStore } from '../review-queue.js';
+export function pipelineForProfile(profile, fixture) {
+    const knownIdentity = fixture?.identityPack || fixture?.allowlist
+        ? { pack: fixture.identityPack, allowlist: fixture.allowlist }
+        : undefined;
+    // Bench must not fail-closed on flags (metrics need the scrubbed text +
+    // unresolvedFlags); use an in-memory review store and disable abort.
+    const reviewOpts = {
+        reviewStore: createMemoryReviewQueueStore(),
+        failClosedOnUnresolvedFlags: false,
+    };
+    switch (profile ?? 'seed') {
+        case 'trace':
+            return buildScrubPipeline({ knownIdentity, ...reviewOpts });
+        case 'layer2':
+            return buildLayer2ScrubPipeline({ knownIdentity });
+        case 'seed':
+        default:
+            return buildSeedScrubPipeline({ knownIdentity, ...reviewOpts });
+    }
+}
+export async function scoreFixture(fixture) {
+    const pipeline = pipelineForProfile(fixture.profile, fixture);
+    const key = fixture.key ?? 'content';
+    let scrubbed;
+    let redactions = [];
+    let rejectClass;
+    try {
+        const result = await pipeline.run({ [key]: fixture.text });
+        scrubbed = String(result.attributes[key] ?? '');
+        redactions = result.redactions;
+    }
+    catch (err) {
+        if (err instanceof RejectPublishError) {
+            // Reject-publish aborts without redacting the span — count as a hit on
+            // the labeled class (or the error's class when unlabeled).
+            rejectClass = err.scrubClass;
+            scrubbed = fixture.text;
+            redactions = [];
+        }
+        else if (err instanceof UnresolvedFlagError) {
+            // Flag-hold aborts publish; for bench metrics treat as a class hit on
+            // the first flagged finding (flag-or-redact recall).
+            rejectClass = err.findings[0]?.class;
+            scrubbed = fixture.text;
+            redactions = [];
+        }
+        else {
+            throw err;
+        }
+    }
+    if (fixture.mustSurvive) {
+        return {
+            counts: {},
+            corruptionFailure: scrubbed !== fixture.text || rejectClass !== undefined,
+        };
+    }
+    if (rejectClass) {
+        const counts = {};
+        const labeled = fixture.labels.filter((l) => l.class === rejectClass);
+        if (labeled.length > 0) {
+            counts[rejectClass] = scoreClass(labeled, labeled.map((l) => ({ class: rejectClass, start: l.start, end: l.end })));
+        }
+        else {
+            counts[rejectClass] = { tp: 0, fp: 1, fn: 0 };
+        }
+        for (const l of fixture.labels) {
+            if (!counts[l.class])
+                counts[l.class] = emptyCounts();
+            if (l.class !== rejectClass) {
+                // Other labeled classes missed because publish aborted first.
+                counts[l.class] = scoreClass([l], []);
+            }
+        }
+        return { counts, corruptionFailure: false };
+    }
+    const findings = findingsFromScrubResult(fixture, scrubbed, redactions);
+    const classes = new Set([
+        ...fixture.labels.map((l) => l.class),
+        ...findings.map((f) => f.class),
+    ]);
+    const counts = {};
+    for (const cls of classes) {
+        const gold = fixture.labels.filter((l) => l.class === cls);
+        const pred = findings.filter((f) => f.class === cls);
+        counts[cls] = scoreClass(gold, pred);
+    }
+    for (const l of fixture.labels) {
+        if (!counts[l.class])
+            counts[l.class] = emptyCounts();
+    }
+    return { counts, corruptionFailure: false };
+}
+export async function runBench(fixtures) {
+    const started = Date.now();
+    const perFixture = [];
+    let corruptionFixtures = 0;
+    let corruptionFailures = 0;
+    const profiles = new Set();
+    for (const fixture of fixtures) {
+        profiles.add(fixture.profile ?? 'seed');
+        if (fixture.mustSurvive) {
+            corruptionFixtures += 1;
+            const { corruptionFailure } = await scoreFixture(fixture);
+            if (corruptionFailure)
+                corruptionFailures += 1;
+            continue;
+        }
+        const { counts } = await scoreFixture(fixture);
+        perFixture.push(counts);
+    }
+    return {
+        schemaVersion: 1,
+        profiles: [...profiles].sort(),
+        classes: aggregateClassMap(perFixture),
+        corruption: { fixtures: corruptionFixtures, failures: corruptionFailures },
+        elapsedMs: Date.now() - started,
+    };
+}

package/dist/scrub/eval/types.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Scrub eval harness types (#1968 / design §7).
+ *
+ * Synthetic fixtures and operator-local labels never leave the machine as text
+ * in published artifacts — only metrics-only JSON (counts) is safe to share.
+ */
+export type { ScrubClass } from '../finding.js';
+import type { ScrubClass } from '../finding.js';
+export interface LabeledSpan {
+    class: ScrubClass;
+    /** Inclusive start offset in the fixture text. */
+    start: number;
+    /** Exclusive end offset. */
+    end: number;
+    /** Optional stable id for distinct-source weighting (dedupe replayed boilerplate). */
+    sourceId?: string;
+}
+export interface EvalFixture {
+    id: string;
+    /** Attribute key the pipeline sees (default `content`). */
+    key?: string;
+    text: string;
+    labels: LabeledSpan[];
+    /**
+     * When true, the scrubbed output must be byte-identical to the input
+     * (corruption corpus / #1784 clean prose).
+     */
+    mustSurvive?: boolean;
+    /** Profile to run: trace (strict), seed, or layer2. Default seed for CI. */
+    profile?: 'trace' | 'seed' | 'layer2';
+    /**
+     * Optional known-identity pack for #1971 fixtures (self-handle exact match).
+     * When set, the seed/trace/layer2 builder injects the pack into the inventory.
+     */
+    identityPack?: import('../known-identity-detector.js').KnownIdentityPack;
+    /** Optional extra allowlist entries for #1971 fixtures. */
+    allowlist?: import('../known-identity-detector.js').InstanceAllowlist;
+}
+export interface ClassCounts {
+    tp: number;
+    fp: number;
+    fn: number;
+}
+export interface ClassMetrics extends ClassCounts {
+    recall: number;
+    precision: number;
+    /** Fβ with β=2 (recall-weighted). */
+    fBeta2: number;
+}
+export interface BenchReport {
+    /** Schema version for metrics-only artifacts. */
+    schemaVersion: 1;
+    /** Which pipeline builders were measured. */
+    profiles: string[];
+    /** Per-class counts + rates. No text, no spans. */
+    classes: Partial<Record<ScrubClass, ClassMetrics>>;
+    /** Corruption corpus: fixtures that must pass through unchanged. */
+    corruption: {
+        fixtures: number;
+        failures: number;
+    };
+    /** Wall time for the run (ms). */
+    elapsedMs: number;
+}
+export interface ScoredFinding {
+    class: ScrubClass;
+    start: number;
+    end: number;
+}

package/dist/scrub/eval/types.js

@@ -0,0 +1,7 @@
+/**
+ * Scrub eval harness types (#1968 / design §7).
+ *
+ * Synthetic fixtures and operator-local labels never leave the machine as text
+ * in published artifacts — only metrics-only JSON (counts) is safe to share.
+ */
+export {};

package/dist/scrub/finding.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Detector finding contract (#1969 / design §6.1).
+ *
+ * Detectors emit findings; they never edit attributes. Disposition is applied
+ * in one pass from the versioned policy table (§6.5).
+ */
+/** Class taxonomy from design §3.2. */
+export type ScrubClass = 'A1' | 'A2' | 'A3' | 'A4' | 'A5' | 'B1' | 'B2' | 'B3' | 'B4' | 'B5' | 'B6' | 'B7' | 'C1' | 'C2' | 'D1' | 'D2' | 'D3' | 'E1';
+/** DLP-style confidence bands (design §6.1). */
+export type Band = 'VERY_LOW' | 'LOW' | 'MEDIUM' | 'HIGH' | 'VERY_HIGH';
+export interface FindingSpan {
+    /** Attribute key the span lives in. */
+    key: string;
+    /** Inclusive start offset in the string value. */
+    start: number;
+    /** Exclusive end offset. */
+    end: number;
+}
+export interface Finding {
+    class: ScrubClass;
+    span: FindingSpan;
+    confidence: Band;
+    /** Explainability: which shape/checksum/context/model fired. */
+    evidence: string[];
+    detector: {
+        name: string;
+        version: string;
+    };
+}
+/**
+ * Detector contract: emit findings over an attribute bag. Must not mutate
+ * values — disposition owns edits.
+ */
+export interface Detector {
+    readonly name: string;
+    readonly version: string;
+    detect(attributes: Record<string, unknown>): Finding[] | Promise<Finding[]>;
+}

package/dist/scrub/finding.js

@@ -0,0 +1,7 @@
+/**
+ * Detector finding contract (#1969 / design §6.1).
+ *
+ * Detectors emit findings; they never edit attributes. Disposition is applied
+ * in one pass from the versioned policy table (§6.5).
+ */
+export {};

package/dist/scrub/git-identity-detector.d.ts

@@ -0,0 +1,16 @@
+/**
+ * git-identity detector — deterministic B2 findings for personal names in
+ * structured git carriers (#1970 / design §3.2 B2, §6.2):
+ *
+ *  - `Author:` / `Committer:` / `Co-Authored-By:` / `Signed-off-by:` lines
+ *  - `git config user.name` / `git config user.email` (and `user.name=` /
+ *    `user.email=` config-list forms)
+ *
+ * Emits name (and email-on-user.email carriers) as B2 VERY_HIGH. Emails on
+ * Author-style trailers stay with the B1 plain-patterns detector so spans do
+ * not overlap; both still redact on the same line (joint effect). Free-prose
+ * names outside these carriers are untouched.
+ */
+import { type KeyPolicy } from './key-policy.js';
+import type { Detector } from './finding.js';
+export declare function gitIdentityDetector(policy: KeyPolicy): Detector;

package/dist/scrub/git-identity-detector.js

@@ -0,0 +1,116 @@
+/**
+ * git-identity detector — deterministic B2 findings for personal names in
+ * structured git carriers (#1970 / design §3.2 B2, §6.2):
+ *
+ *  - `Author:` / `Committer:` / `Co-Authored-By:` / `Signed-off-by:` lines
+ *  - `git config user.name` / `git config user.email` (and `user.name=` /
+ *    `user.email=` config-list forms)
+ *
+ * Emits name (and email-on-user.email carriers) as B2 VERY_HIGH. Emails on
+ * Author-style trailers stay with the B1 plain-patterns detector so spans do
+ * not overlap; both still redact on the same line (joint effect). Free-prose
+ * names outside these carriers are untouched.
+ */
+import { classifyKey } from './key-policy.js';
+const VERSION = '0.1.0';
+/** Trailer labels that carry a display name (optional `<email>`). */
+const TRAILER_LABEL = /^(Author|Committer|Co-Authored-By|Signed-off-by):\s*/gim;
+/**
+ * `git config [--global|--local|…] user.name VALUE` — VALUE may be quoted.
+ * Captures only the value, not the carrier keywords.
+ */
+const GIT_CONFIG_NAME = /\bgit\s+config\s+(?:--\w+\s+)*user\.name\s+(?:"([^"\n]+)"|'([^'\n]+)'|(\S+))/gi;
+/** Same shape for `user.email`. */
+const GIT_CONFIG_EMAIL = /\bgit\s+config\s+(?:--\w+\s+)*user\.email\s+(?:"([^"\n]+)"|'([^'\n]+)'|(\S+))/gi;
+/** `git config --list` / env-dump style: `user.name=…` at line start. */
+const USER_NAME_ASSIGN = /^user\.name\s*=\s*(?:"([^"\n]+)"|'([^'\n]+)'|([^\n]+?))\s*$/gim;
+const USER_EMAIL_ASSIGN = /^user\.email\s*=\s*(?:"([^"\n]+)"|'([^'\n]+)'|([^\n]+?))\s*$/gim;
+function firstCapture(match) {
+    for (let i = 1; i < match.length; i += 1) {
+        const g = match[i];
+        if (g !== undefined && g.length > 0)
+            return { value: g, groupIndex: i };
+    }
+    return null;
+}
+function captureOffset(match, groupIndex) {
+    // Reconstruct start of the chosen capture group within match[0].
+    // Groups are alternatives — only one is set — so search the full match text.
+    const full = match[0];
+    const value = match[groupIndex];
+    const at = full.lastIndexOf(value);
+    return match.index + (at >= 0 ? at : 0);
+}
+function pushFinding(findings, key, start, end, evidence, detector) {
+    if (start < 0 || end <= start)
+        return;
+    findings.push({
+        class: 'B2',
+        span: { key, start, end },
+        confidence: 'VERY_HIGH',
+        evidence: [evidence],
+        detector,
+    });
+}
+function collectTrailers(text, key, detector) {
+    const findings = [];
+    const re = new RegExp(TRAILER_LABEL.source, TRAILER_LABEL.flags);
+    let match;
+    while ((match = re.exec(text)) !== null) {
+        const valueStart = match.index + match[0].length;
+        const lineEnd = text.indexOf('\n', valueStart);
+        const end = lineEnd < 0 ? text.length : lineEnd;
+        const rest = text.slice(valueStart, end);
+        // Prefer `Name <email>` — redact name only (email → B1).
+        const angle = /^(.*?)\s*<[^>\n]*>\s*$/.exec(rest);
+        if (angle) {
+            const rawName = angle[1] ?? '';
+            const name = rawName.trim();
+            if (name.length > 0) {
+                const leading = rawName.length - rawName.trimStart().length;
+                const start = valueStart + leading;
+                pushFinding(findings, key, start, start + name.length, 'git-identity:trailer-name', detector);
+            }
+            continue;
+        }
+        const name = rest.trim();
+        if (name.length > 0) {
+            const leading = rest.length - rest.trimStart().length;
+            const start = valueStart + leading;
+            pushFinding(findings, key, start, start + name.length, 'git-identity:trailer-name', detector);
+        }
+    }
+    return findings;
+}
+function collectConfigCaptures(text, key, pattern, evidence, detector) {
+    const findings = [];
+    const re = new RegExp(pattern.source, pattern.flags.includes('g') ? pattern.flags : `${pattern.flags}g`);
+    let match;
+    while ((match = re.exec(text)) !== null) {
+        const captured = firstCapture(match);
+        if (!captured)
+            continue;
+        const start = captureOffset(match, captured.groupIndex);
+        pushFinding(findings, key, start, start + captured.value.length, evidence, detector);
+    }
+    return findings;
+}
+export function gitIdentityDetector(policy) {
+    const meta = { name: 'git-identity', version: VERSION };
+    return {
+        ...meta,
+        detect(attributes) {
+            const findings = [];
+            for (const [key, value] of Object.entries(attributes)) {
+                if (typeof value !== 'string' || classifyKey(key, policy) !== 'content')
+                    continue;
+                findings.push(...collectTrailers(value, key, meta));
+                findings.push(...collectConfigCaptures(value, key, GIT_CONFIG_NAME, 'git-identity:user-name', meta));
+                findings.push(...collectConfigCaptures(value, key, GIT_CONFIG_EMAIL, 'git-identity:user-email', meta));
+                findings.push(...collectConfigCaptures(value, key, USER_NAME_ASSIGN, 'git-identity:user-name', meta));
+                findings.push(...collectConfigCaptures(value, key, USER_EMAIL_ASSIGN, 'git-identity:user-email', meta));
+            }
+            return findings;
+        },
+    };
+}

package/dist/scrub/gitleaks-detector.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Vendored gitleaks rule pack — A1 (#1972 / design §6.2, Q6).
+ *
+ * Small pinned MIT subset. Refresh manually; no build-time sync.
+ * Regexes are JS-adapted (no Go inline flag verbs).
+ */
+import { GITLEAKS_PACK } from './data/gitleaks-rules.js';
+import { type KeyPolicy } from './key-policy.js';
+import type { Detector } from './finding.js';
+export type GitleaksRule = (typeof GITLEAKS_PACK.rules)[number];
+export type GitleaksPack = typeof GITLEAKS_PACK;
+export declare function loadGitleaksPack(): GitleaksPack;
+export declare function gitleaksDetector(policy: KeyPolicy): Detector;

package/dist/scrub/gitleaks-detector.js

@@ -0,0 +1,45 @@
+/**
+ * Vendored gitleaks rule pack — A1 (#1972 / design §6.2, Q6).
+ *
+ * Small pinned MIT subset. Refresh manually; no build-time sync.
+ * Regexes are JS-adapted (no Go inline flag verbs).
+ */
+import { GITLEAKS_PACK } from './data/gitleaks-rules.js';
+import { classifyKey } from './key-policy.js';
+const VERSION = '1.0.0';
+export function loadGitleaksPack() {
+    return GITLEAKS_PACK;
+}
+export function gitleaksDetector(policy) {
+    const meta = { name: 'gitleaks', version: VERSION };
+    const pack = loadGitleaksPack();
+    return {
+        ...meta,
+        detect(attributes) {
+            const findings = [];
+            for (const [key, value] of Object.entries(attributes)) {
+                if (typeof value !== 'string' || classifyKey(key, policy) !== 'content')
+                    continue;
+                for (const rule of pack.rules) {
+                    const re = new RegExp(rule.regex, 'gi');
+                    let m;
+                    while ((m = re.exec(value)) !== null) {
+                        const full = m[0];
+                        if (!full)
+                            continue;
+                        findings.push({
+                            class: 'A1',
+                            span: { key, start: m.index, end: m.index + full.length },
+                            confidence: 'VERY_HIGH',
+                            evidence: [`gitleaks:${rule.id}`],
+                            detector: meta,
+                        });
+                        if (m[0].length === 0)
+                            re.lastIndex += 1;
+                    }
+                }
+            }
+            return findings;
+        },
+    };
+}

package/dist/scrub/gliner-detector.d.ts

@@ -0,0 +1,65 @@
+/**
+ * GLiNER ONNX ML PII detector (#1973 / design §5.1, §6.3).
+ *
+ * Local-only inference behind the {@link PiiDetector} seam. Default model is
+ * `urchade/gliner_multi_pii-v1` (Apache-2.0, PII-tuned, multilingual). ONNX
+ * weights load from the community mirror `onnx-community/gliner_multi_pii-v1`
+ * (same weights; Transformers.js-compatible layout).
+ *
+ * Benchmark note (locked Q3): `urchade/gliner_multi_pii-v1` is the pinned
+ * default. The smaller `knowledgator/gliner-pii-edge-v1.0` family remains an
+ * alternate via `captures.piiDetection.model` — operators should measure
+ * Fβ=2 + latency on their local corpus before switching.
+ *
+ * Download-on-first-run is intentional (same posture as the retired
+ * bert-base-NER path). Init failure is fail-closed via
+ * {@link maybeBuildPiiDetector}.
+ */
+import type { PiiDetector, PiiEntity } from './ml-pii-stage.js';
+/**
+ * Logical model id operators configure. ONNX weights for the default pin live
+ * under the onnx-community mirror (see {@link resolveOnnxModelId}).
+ */
+export declare const DEFAULT_GLINER_MODEL = "urchade/gliner_multi_pii-v1";
+/** Alternate smaller pin — set via config `captures.piiDetection.model`. */
+export declare const ALTERNATE_GLINER_EDGE_MODEL = "knowledgator/gliner-pii-edge-v1.0";
+/**
+ * Zero-shot labels pinned in config (#1974 will hash these into the policy
+ * hash). Keep the list stable and reviewable — do not derive from model
+ * metadata at runtime.
+ */
+export declare const DEFAULT_GLINER_PII_LABELS: readonly string[];
+export interface GlinerPiiDetectorOptions {
+    /**
+     * Hugging Face model id. Default {@link DEFAULT_GLINER_MODEL}.
+     * Pass an onnx-community / knowledgator id to override the pin.
+     */
+    model?: string;
+    /** Zero-shot labels. Defaults to {@link DEFAULT_GLINER_PII_LABELS}. */
+    labels?: readonly string[];
+    /** Minimum score to emit (pre-band). Default 0.5. */
+    threshold?: number;
+}
+/** Map a logical / source model id onto an ONNX-capable Hugging Face repo. */
+export declare function resolveOnnxModelId(modelId: string): string;
+/**
+ * Production GLiNER PII detector. Loads ONNX weights via `@lmoe/gliner-onnx`
+ * (dynamic import so unit tests never pull the runtime). Call {@link init}
+ * before {@link detect}; {@link maybeBuildPiiDetector} owns that lifecycle.
+ */
+export declare class GlinerPiiDetector implements PiiDetector {
+    private runtime;
+    private initPromise;
+    private readonly model;
+    private readonly labels;
+    private readonly threshold;
+    constructor(opts?: GlinerPiiDetectorOptions);
+    /** Logical model id (hashed into the policy digest — #1974). */
+    get modelId(): string;
+    /** Zero-shot labels (hashed into the policy digest — #1974). */
+    get labelSet(): readonly string[];
+    /** Eagerly load the model (daemon boot / first publish). */
+    init(): Promise<void>;
+    private ensureReady;
+    detect(text: string): Promise<PiiEntity[]>;
+}