@jinn-network/core 0.1.0-canary.3afae198

package/dist/scrub/pipeline.d.ts

@@ -0,0 +1,77 @@
+import { assertNoRejectPublish, shouldRejectPublish } from './apply-dispositions.js';
+import type { Detector } from './finding.js';
+import { type PolicyTable } from './policy.js';
+import { type PolicyHashInput } from './provenance.js';
+import { type ReviewQueueStore } from './review-queue.js';
+import type { Attributes, ScrubResult, ScrubStage } from './types.js';
+export { shouldRejectPublish, assertNoRejectPublish };
+export interface ScrubPipelineOptions {
+    policy?: PolicyTable;
+    /** Check-mode: any non-pass disposition rejects (design §6.5). */
+    checkMode?: boolean;
+    /**
+     * Review-queue store for flag resolutions (#1973). Defaults to the
+     * operator-local `~/.jinn-client/scrub-review/queue.jsonl` store in
+     * redact-mode. Pass an in-memory store in tests.
+     */
+    reviewStore?: ReviewQueueStore;
+    /**
+     * When true (default in redact-mode), unresolved flags enqueue + throw
+     * {@link UnresolvedFlagError}. Check-mode leaves this off.
+     */
+    failClosedOnUnresolvedFlags?: boolean;
+    /**
+     * Inputs for the published policy hash (#1974). When omitted, emit helpers
+     * still bump `schemaVersion` but leave `policyHash` unset.
+     */
+    provenance?: Omit<PolicyHashInput, 'policy' | 'detectors'>;
+}
+/**
+ * Runs one detector inventory, then one disposition pass (#1969).
+ *
+ * Nested values (#1378): after the flat detect→dispose pass, surviving
+ * object/array values are walked and every string leaf is scrubbed through
+ * the same detect→dispose path, keyed by the TOP-LEVEL attribute key.
+ *
+ * Constructor also accepts legacy {@link ScrubStage} arrays (stage.scrub chain)
+ * so existing unit tests and injectors keep working through the migration.
+ */
+export declare class ScrubPipeline {
+    private readonly policy;
+    private readonly checkMode;
+    private readonly detectors;
+    private readonly stages;
+    private readonly reviewStore;
+    private readonly failClosedOnUnresolvedFlags;
+    private readonly provenanceExtras;
+    constructor(detectorsOrStages: Array<Detector | ScrubStage>, opts?: ScrubPipelineOptions);
+    get components(): Array<{
+        name: string;
+        version: string;
+    }>;
+    /** Disposition policy table used by this pipeline (#1974). */
+    get policyTable(): PolicyTable;
+    /**
+     * Additive provenance fields for a redaction manifest (#1974). Always
+     * includes `schemaVersion`; `policyHash` is present when provenance
+     * extras were supplied at construction.
+     */
+    manifestProvenance(perClassCounts?: Record<string, number>): {
+        schemaVersion: number;
+        policyHash?: string;
+        perClassCounts?: Record<string, number>;
+    };
+    /**
+     * Reproducible policy hash, or undefined when provenance inputs were not
+     * configured (legacy stage-only pipelines).
+     */
+    policyHash(): string | undefined;
+    run(attributes: Attributes): Promise<ScrubResult>;
+    private assertAndEnqueueUnresolvedFlags;
+    /** Legacy ScrubStage chain (tests / residual injectors). */
+    private runLegacyStages;
+    private runStagesFlat;
+    private scrubNestedLegacy;
+    private runDetectDispose;
+    private scrubNested;
+}

package/dist/scrub/pipeline.js

@@ -0,0 +1,225 @@
+import { applyDispositions, assertNoRejectPublish, shouldRejectPublish } from './apply-dispositions.js';
+import { DEFAULT_POLICY } from './policy.js';
+import { REDACTION_MANIFEST_SCHEMA_VERSION, computePolicyHash, mergePerClassCounts, } from './provenance.js';
+import { UnresolvedFlagError, createReviewQueueStore, } from './review-queue.js';
+export { shouldRejectPublish, assertNoRejectPublish };
+function isDetector(item) {
+    return typeof item.detect === 'function';
+}
+/**
+ * Runs one detector inventory, then one disposition pass (#1969).
+ *
+ * Nested values (#1378): after the flat detect→dispose pass, surviving
+ * object/array values are walked and every string leaf is scrubbed through
+ * the same detect→dispose path, keyed by the TOP-LEVEL attribute key.
+ *
+ * Constructor also accepts legacy {@link ScrubStage} arrays (stage.scrub chain)
+ * so existing unit tests and injectors keep working through the migration.
+ */
+export class ScrubPipeline {
+    policy;
+    checkMode;
+    detectors;
+    stages;
+    reviewStore;
+    failClosedOnUnresolvedFlags;
+    provenanceExtras;
+    constructor(detectorsOrStages, opts = {}) {
+        this.policy = opts.policy ?? DEFAULT_POLICY;
+        this.checkMode = opts.checkMode ?? false;
+        this.reviewStore = opts.reviewStore;
+        this.failClosedOnUnresolvedFlags =
+            opts.failClosedOnUnresolvedFlags ?? !this.checkMode;
+        this.provenanceExtras = opts.provenance;
+        if (detectorsOrStages.length > 0 && detectorsOrStages.every(isDetector)) {
+            this.detectors = detectorsOrStages;
+            this.stages = null;
+        }
+        else {
+            this.detectors = null;
+            this.stages = detectorsOrStages;
+        }
+    }
+    get components() {
+        const items = this.detectors ?? this.stages ?? [];
+        return items.map((d) => ({ name: d.name, version: d.version }));
+    }
+    /** Disposition policy table used by this pipeline (#1974). */
+    get policyTable() {
+        return this.policy;
+    }
+    /**
+     * Additive provenance fields for a redaction manifest (#1974). Always
+     * includes `schemaVersion`; `policyHash` is present when provenance
+     * extras were supplied at construction.
+     */
+    manifestProvenance(perClassCounts) {
+        const out = { schemaVersion: REDACTION_MANIFEST_SCHEMA_VERSION };
+        const hash = this.policyHash();
+        if (hash)
+            out.policyHash = hash;
+        if (perClassCounts && Object.keys(perClassCounts).length > 0) {
+            out.perClassCounts = perClassCounts;
+        }
+        return out;
+    }
+    /**
+     * Reproducible policy hash, or undefined when provenance inputs were not
+     * configured (legacy stage-only pipelines).
+     */
+    policyHash() {
+        if (!this.provenanceExtras)
+            return undefined;
+        return computePolicyHash({
+            policy: this.policy,
+            detectors: this.components,
+            modelId: this.provenanceExtras.modelId,
+            labels: this.provenanceExtras.labels,
+            allowlistDigest: this.provenanceExtras.allowlistDigest,
+        });
+    }
+    async run(attributes) {
+        if (this.stages) {
+            return this.runLegacyStages(attributes);
+        }
+        const flat = await this.runDetectDispose(attributes);
+        const out = {};
+        const redactions = [...flat.redactions];
+        const findings = [...flat.findings];
+        const unresolvedFlags = [...flat.unresolvedFlags];
+        let perClassCounts = { ...flat.perClassCounts };
+        let rejected = flat.rejected;
+        for (const [key, value] of Object.entries(flat.attributes)) {
+            out[key] =
+                typeof value === 'string'
+                    ? value
+                    : await this.scrubNested(key, value, redactions, findings, unresolvedFlags, (nestedCounts) => {
+                        perClassCounts =
+                            mergePerClassCounts(perClassCounts, nestedCounts) ?? perClassCounts;
+                    });
+        }
+        // Check-mode: trust the disposition `rejected` bit. Do not re-derive from
+        // raw redactions.length — allowlist-pass records are auditable passes.
+        if (this.checkMode && flat.rejected)
+            rejected = true;
+        const result = {
+            attributes: out,
+            redactions,
+            findings,
+            rejected,
+            unresolvedFlags,
+            perClassCounts,
+        };
+        // Publish altitude: reject-publish classes abort loudly with a class name.
+        // Check-mode distill maps redactions → rejection reasons without throwing.
+        if (!this.checkMode)
+            assertNoRejectPublish(result, this.policy);
+        if (!this.checkMode && this.failClosedOnUnresolvedFlags) {
+            this.assertAndEnqueueUnresolvedFlags(result.unresolvedFlags ?? [], attributes);
+        }
+        return result;
+    }
+    assertAndEnqueueUnresolvedFlags(unresolved, attributes) {
+        if (unresolved.length === 0)
+            return;
+        // Lazy default: operator-local queue so unattended publishes leave a
+        // reviewable trail. Tests inject `reviewStore` (memory) or disable
+        // fail-closed via `failClosedOnUnresolvedFlags: false`.
+        const store = this.reviewStore ?? createReviewQueueStore();
+        const enqueued = store.enqueue(unresolved.map((finding) => {
+            const value = attributes[finding.span.key];
+            const text = typeof value === 'string' ? value : '';
+            const snippet = text.slice(Math.max(0, finding.span.start - 40), Math.min(text.length, finding.span.end + 40));
+            return {
+                finding,
+                context: { attributeKey: finding.span.key, snippet },
+            };
+        }));
+        throw new UnresolvedFlagError(unresolved, enqueued.map((e) => e.id));
+    }
+    /** Legacy ScrubStage chain (tests / residual injectors). */
+    async runLegacyStages(attributes) {
+        const flat = await this.runStagesFlat(attributes);
+        const out = {};
+        const redactions = [...flat.redactions];
+        for (const [key, value] of Object.entries(flat.attributes)) {
+            out[key] = typeof value === 'string' ? value : await this.scrubNestedLegacy(key, value, redactions);
+        }
+        return { attributes: out, redactions };
+    }
+    async runStagesFlat(attributes) {
+        let current = attributes;
+        const redactions = [];
+        for (const stage of this.stages) {
+            const result = await stage.scrub(current);
+            current = result.attributes;
+            redactions.push(...result.redactions);
+        }
+        return { attributes: current, redactions };
+    }
+    async scrubNestedLegacy(key, value, redactions) {
+        if (typeof value === 'string') {
+            const result = await this.runStagesFlat({ [key]: value });
+            redactions.push(...result.redactions);
+            const scrubbed = result.attributes[key];
+            return typeof scrubbed === 'string' ? scrubbed : value;
+        }
+        if (Array.isArray(value)) {
+            const items = [];
+            for (const item of value)
+                items.push(await this.scrubNestedLegacy(key, item, redactions));
+            return items;
+        }
+        if (value !== null && typeof value === 'object') {
+            const proto = Object.getPrototypeOf(value);
+            if (proto !== Object.prototype && proto !== null)
+                return value;
+            const entries = {};
+            for (const [k, v] of Object.entries(value)) {
+                entries[k] = await this.scrubNestedLegacy(key, v, redactions);
+            }
+            return entries;
+        }
+        return value;
+    }
+    async runDetectDispose(attributes) {
+        const findings = [];
+        for (const detector of this.detectors) {
+            findings.push(...(await detector.detect(attributes)));
+        }
+        return applyDispositions(attributes, findings, {
+            policy: this.policy,
+            checkMode: this.checkMode,
+            reviewStore: this.reviewStore,
+        });
+    }
+    async scrubNested(key, value, redactions, findings, unresolvedFlags, onCounts) {
+        if (typeof value === 'string') {
+            const result = await this.runDetectDispose({ [key]: value });
+            redactions.push(...result.redactions);
+            findings.push(...result.findings);
+            unresolvedFlags.push(...result.unresolvedFlags);
+            onCounts(result.perClassCounts);
+            const scrubbed = result.attributes[key];
+            return typeof scrubbed === 'string' ? scrubbed : value;
+        }
+        if (Array.isArray(value)) {
+            const items = [];
+            for (const item of value) {
+                items.push(await this.scrubNested(key, item, redactions, findings, unresolvedFlags, onCounts));
+            }
+            return items;
+        }
+        if (value !== null && typeof value === 'object') {
+            const proto = Object.getPrototypeOf(value);
+            if (proto !== Object.prototype && proto !== null)
+                return value;
+            const entries = {};
+            for (const [k, v] of Object.entries(value)) {
+                entries[k] = await this.scrubNested(key, v, redactions, findings, unresolvedFlags, onCounts);
+            }
+            return entries;
+        }
+        return value;
+    }
+}

package/dist/scrub/plain-patterns-stage.d.ts

@@ -0,0 +1,33 @@
+/**
+ * plain-patterns detector — deterministic regex findings for shapes the
+ * probabilistic detectors miss (#1330 / #1415 / #1959 / #1969):
+ *
+ *  - email (B1)
+ *  - POSIX home-directory paths (D1)
+ *  - AWS/GCP credential-ID prefixes (A1)
+ *  - Ethereum-style wallet addresses `0x`+40 hex (C1)
+ *
+ * Emits findings only — disposition owns stubs. Wallet + credential-ID shapes
+ * are always registered in the shared inventory (#1969); policy decides.
+ */
+import { type KeyPolicy } from './key-policy.js';
+import type { Detector } from './finding.js';
+import type { ScrubStage } from './types.js';
+export interface PlainPatternsOptions {
+    /**
+     * @deprecated (#1969) Credential IDs are always in the shared inventory.
+     * Kept so call sites that pass `{ credentialIds: true }` still type-check.
+     */
+    credentialIds?: boolean;
+    /**
+     * @deprecated (#1969) Wallet addresses are always in the shared inventory.
+     * Kept so call sites that pass `{ walletAddresses: true }` still type-check.
+     */
+    walletAddresses?: boolean;
+}
+export declare function plainPatternsDetector(policy: KeyPolicy, _opts?: PlainPatternsOptions): Detector;
+/**
+ * Legacy ScrubStage wrapper: detect + apply default dispositions. New callers
+ * should use {@link plainPatternsDetector} via ScrubPipeline.
+ */
+export declare function plainPatternsStage(policy: KeyPolicy, opts?: PlainPatternsOptions): ScrubStage;

package/dist/scrub/plain-patterns-stage.js

@@ -0,0 +1,88 @@
+/**
+ * plain-patterns detector — deterministic regex findings for shapes the
+ * probabilistic detectors miss (#1330 / #1415 / #1959 / #1969):
+ *
+ *  - email (B1)
+ *  - POSIX home-directory paths (D1)
+ *  - AWS/GCP credential-ID prefixes (A1)
+ *  - Ethereum-style wallet addresses `0x`+40 hex (C1)
+ *
+ * Emits findings only — disposition owns stubs. Wallet + credential-ID shapes
+ * are always registered in the shared inventory (#1969); policy decides.
+ */
+import { applyDispositions } from './apply-dispositions.js';
+import { classifyKey } from './key-policy.js';
+const VERSION = '0.2.0';
+/** Plain email shape. */
+const EMAIL_PATTERN = /[A-Za-z0-9._%+-]+@[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])+)+/g;
+/** POSIX home-dir path segment carrying a username. */
+const HOME_PATH_PATTERN = /\/(?:Users|home)\/[^/\s"'`]+/g;
+/**
+ * Bare AWS access-key ID — the fixed four-char prefixes + 16 key chars that
+ * secretlint's aws rule only scans for under `enableIDScanRule: true`.
+ */
+const AWS_KEY_ID_PATTERN = /\b(?:A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}\b/g;
+/**
+ * GCP API key: fixed `AIza` prefix + 35 key chars. No trailing `\b` — the key
+ * charset includes `-`, which breaks word-boundary semantics at the end.
+ */
+const GCP_API_KEY_PATTERN = /\bAIza[0-9A-Za-z_-]{35}/g;
+/**
+ * Ethereum-style wallet address: `0x` + exactly 40 hex chars (#1959 / C1).
+ * Bare 40-hex git SHAs and `0x`+64 tx hashes must survive.
+ */
+const ETH_ADDRESS_PATTERN = /\b0x[a-fA-F0-9]{40}\b/g;
+const RULES = [
+    { pattern: EMAIL_PATTERN, class: 'B1', evidence: 'email' },
+    { pattern: HOME_PATH_PATTERN, class: 'D1', evidence: 'home-path' },
+    { pattern: AWS_KEY_ID_PATTERN, class: 'A1', evidence: 'aws-access-key-id' },
+    { pattern: GCP_API_KEY_PATTERN, class: 'A1', evidence: 'gcp-api-key' },
+    { pattern: ETH_ADDRESS_PATTERN, class: 'C1', evidence: 'eth-address' },
+];
+function collectMatches(text, key, rule, detector) {
+    const findings = [];
+    const re = new RegExp(rule.pattern.source, rule.pattern.flags.includes('g') ? rule.pattern.flags : `${rule.pattern.flags}g`);
+    let match;
+    while ((match = re.exec(text)) !== null) {
+        findings.push({
+            class: rule.class,
+            span: { key, start: match.index, end: match.index + match[0].length },
+            confidence: 'VERY_HIGH',
+            evidence: [rule.evidence],
+            detector,
+        });
+    }
+    return findings;
+}
+export function plainPatternsDetector(policy, _opts = {}) {
+    const meta = { name: 'plain-patterns', version: VERSION };
+    return {
+        ...meta,
+        detect(attributes) {
+            const findings = [];
+            for (const [key, value] of Object.entries(attributes)) {
+                if (typeof value !== 'string' || classifyKey(key, policy) !== 'content')
+                    continue;
+                for (const rule of RULES) {
+                    findings.push(...collectMatches(value, key, rule, meta));
+                }
+            }
+            return findings;
+        },
+    };
+}
+/**
+ * Legacy ScrubStage wrapper: detect + apply default dispositions. New callers
+ * should use {@link plainPatternsDetector} via ScrubPipeline.
+ */
+export function plainPatternsStage(policy, opts = {}) {
+    const detector = plainPatternsDetector(policy, opts);
+    return {
+        name: detector.name,
+        version: detector.version,
+        scrub(attributes) {
+            const findings = detector.detect(attributes);
+            return applyDispositions(attributes, findings);
+        },
+    };
+}

package/dist/scrub/policy.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Versioned disposition policy (#1969 / design §6.5).
+ *
+ * disposition(class, band) -> redact | reject-publish | flag | pass
+ *
+ * Defaults follow §3.2's rightmost columns. C2 stays `pass` until the flag
+ * review surface exists (do not redact 0x+64 tx hashes).
+ */
+import type { Band, Finding, ScrubClass } from './finding.js';
+export type Disposition = 'redact' | 'reject-publish' | 'flag' | 'pass';
+export declare const POLICY_VERSION = "1.0.0";
+/** Per-band dispositions for one class. Missing bands fall back to `pass`. */
+export type ClassDispositionRow = Partial<Record<Band, Disposition>>;
+export interface PolicyTable {
+    version: string;
+    dispositions: Partial<Record<ScrubClass, ClassDispositionRow>>;
+}
+/**
+ * Default policy. High-confidence deterministic classes redact; reject classes
+ * (A4/A5) reject-publish; A2 mid-band flags; C2 passes pending flag surface.
+ */
+export declare const DEFAULT_POLICY: PolicyTable;
+export declare function resolveDisposition(scrubClass: ScrubClass, band: Band, policy?: PolicyTable): Disposition;
+/**
+ * Check-mode mapping (design §6.5): any non-`pass` disposition → reject.
+ * One mapping line — not a second pipeline.
+ */
+export declare function checkModeRejects(findings: Finding[], policy?: PolicyTable): boolean;

package/dist/scrub/policy.js

@@ -0,0 +1,156 @@
+/**
+ * Versioned disposition policy (#1969 / design §6.5).
+ *
+ * disposition(class, band) -> redact | reject-publish | flag | pass
+ *
+ * Defaults follow §3.2's rightmost columns. C2 stays `pass` until the flag
+ * review surface exists (do not redact 0x+64 tx hashes).
+ */
+export const POLICY_VERSION = '1.0.0';
+/**
+ * Default policy. High-confidence deterministic classes redact; reject classes
+ * (A4/A5) reject-publish; A2 mid-band flags; C2 passes pending flag surface.
+ */
+export const DEFAULT_POLICY = {
+    version: POLICY_VERSION,
+    dispositions: {
+        A1: {
+            VERY_HIGH: 'redact',
+            HIGH: 'redact',
+            MEDIUM: 'redact',
+            LOW: 'flag',
+            VERY_LOW: 'pass',
+        },
+        A2: {
+            VERY_HIGH: 'redact',
+            HIGH: 'redact',
+            MEDIUM: 'flag',
+            LOW: 'pass',
+            VERY_LOW: 'pass',
+        },
+        A3: {
+            VERY_HIGH: 'redact',
+            HIGH: 'redact',
+            MEDIUM: 'redact',
+            LOW: 'flag',
+            VERY_LOW: 'pass',
+        },
+        A4: {
+            VERY_HIGH: 'reject-publish',
+            HIGH: 'reject-publish',
+            MEDIUM: 'reject-publish',
+            LOW: 'flag',
+            VERY_LOW: 'pass',
+        },
+        A5: {
+            VERY_HIGH: 'reject-publish',
+            HIGH: 'reject-publish',
+            MEDIUM: 'reject-publish',
+            LOW: 'flag',
+            VERY_LOW: 'pass',
+        },
+        B1: {
+            VERY_HIGH: 'redact',
+            HIGH: 'redact',
+            MEDIUM: 'redact',
+            LOW: 'flag',
+            VERY_LOW: 'pass',
+        },
+        B2: {
+            VERY_HIGH: 'redact',
+            HIGH: 'redact',
+            MEDIUM: 'redact',
+            LOW: 'flag',
+            VERY_LOW: 'pass',
+        },
+        B3: {
+            VERY_HIGH: 'redact',
+            HIGH: 'flag',
+            MEDIUM: 'flag',
+            LOW: 'pass',
+            VERY_LOW: 'pass',
+        },
+        B4: {
+            VERY_HIGH: 'redact',
+            HIGH: 'redact',
+            MEDIUM: 'flag',
+            LOW: 'pass',
+            VERY_LOW: 'pass',
+        },
+        B5: {
+            VERY_HIGH: 'redact',
+            HIGH: 'redact',
+            MEDIUM: 'flag',
+            LOW: 'pass',
+            VERY_LOW: 'pass',
+        },
+        B6: {
+            VERY_HIGH: 'flag',
+            HIGH: 'flag',
+            MEDIUM: 'flag',
+            LOW: 'pass',
+            VERY_LOW: 'pass',
+        },
+        B7: {
+            VERY_HIGH: 'redact',
+            HIGH: 'redact',
+            MEDIUM: 'flag',
+            LOW: 'pass',
+            VERY_LOW: 'pass',
+        },
+        C1: {
+            VERY_HIGH: 'redact',
+            HIGH: 'redact',
+            MEDIUM: 'redact',
+            LOW: 'flag',
+            VERY_LOW: 'pass',
+        },
+        // C2: §3.2 default is flag, but provenance receipts (0x+64 tx hashes) must
+        // survive — leave as pass (locked Q / deferred from review-queue landing).
+        C2: {
+            VERY_HIGH: 'pass',
+            HIGH: 'pass',
+            MEDIUM: 'pass',
+            LOW: 'pass',
+            VERY_LOW: 'pass',
+        },
+        D1: {
+            VERY_HIGH: 'redact',
+            HIGH: 'redact',
+            MEDIUM: 'redact',
+            LOW: 'flag',
+            VERY_LOW: 'pass',
+        },
+        D2: {
+            VERY_HIGH: 'redact',
+            HIGH: 'redact',
+            MEDIUM: 'flag',
+            LOW: 'pass',
+            VERY_LOW: 'pass',
+        },
+        D3: {
+            VERY_HIGH: 'redact',
+            HIGH: 'redact',
+            MEDIUM: 'flag',
+            LOW: 'pass',
+            VERY_LOW: 'pass',
+        },
+        E1: {
+            VERY_HIGH: 'flag',
+            HIGH: 'flag',
+            MEDIUM: 'flag',
+            LOW: 'pass',
+            VERY_LOW: 'pass',
+        },
+    },
+};
+export function resolveDisposition(scrubClass, band, policy = DEFAULT_POLICY) {
+    return policy.dispositions[scrubClass]?.[band] ?? 'pass';
+}
+/**
+ * Check-mode mapping (design §6.5): any non-`pass` disposition → reject.
+ * One mapping line — not a second pipeline.
+ */
+export function checkModeRejects(findings, policy = DEFAULT_POLICY) {
+    return findings.some((f) => resolveDisposition(f.class, f.confidence, policy) !== 'pass');
+}

package/dist/scrub/provenance.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Scrub provenance for the published redaction manifest (#1974 / design §6.7).
+ *
+ * Locked Q5: additive optional fields on the existing redaction-manifest shape
+ * (`schemaVersion` 2) — no TraceEnvelope rev. Old envelopes remain readable.
+ */
+import type { ScrubClass } from './finding.js';
+import type { Disposition, PolicyTable } from './policy.js';
+/** Manifest schema version that includes optional provenance fields. */
+export declare const REDACTION_MANIFEST_SCHEMA_VERSION = 2;
+/** Disposition kinds counted in `perClassCounts` (pass is omitted). */
+export type CountedDisposition = 'redact' | 'flag' | 'reject';
+export interface PolicyHashInput {
+    /** Versioned disposition policy table. */
+    policy: PolicyTable;
+    /** Detector inventory (name + pinned version), order-insensitive. */
+    detectors: ReadonlyArray<{
+        name: string;
+        version: string;
+    }>;
+    /** ML model id when the ML tier is present; null otherwise. */
+    modelId: string | null;
+    /** Zero-shot / NER label set hashed into the policy digest. */
+    labels: readonly string[];
+    /** Digest of the instance allowlist (see {@link computeAllowlistDigest}). */
+    allowlistDigest: string;
+}
+/**
+ * Stable key for one class × applied disposition in `perClassCounts`.
+ * Reject-publish dispositions are recorded as `reject`.
+ */
+export declare function perClassCountKey(scrubClass: ScrubClass, disposition: CountedDisposition): string;
+/** Map a policy disposition onto the counted kind (or null for pass). */
+export declare function countedDisposition(disposition: Disposition): CountedDisposition | null;
+/**
+ * sha256 hex over a canonical JSON of allowlist entries sorted by
+ * (value, kind). Provenance notes are excluded so the digest is about
+ * *what* is allowlisted, not the human rationale string.
+ */
+export declare function computeAllowlistDigest(entries: ReadonlyArray<{
+    value: string;
+    kind: string;
+}>): string;
+/**
+ * Reproducible policy/composition hash: same inputs → same hex digest.
+ * Payload is RFC 8785 canonical JSON of policy + sorted detectors + model
+ * id + sorted labels + allowlist digest, then sha256.
+ */
+export declare function computePolicyHash(input: PolicyHashInput): string;
+/** Increment one class:disposition counter (mutates `counts`). */
+export declare function incrementPerClassCount(counts: Record<string, number>, scrubClass: ScrubClass, disposition: Disposition): void;
+/** Sum two per-class count maps (missing → empty). */
+export declare function mergePerClassCounts(a?: Record<string, number>, b?: Record<string, number>): Record<string, number> | undefined;