@agent-nexus/driftbench-users 0.0.0-stage → 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,572 @@
+import { DeviationClass, UserDriver, Spec, AgentAdapter, CheckSet, ArtifactReaderRegistry, TargetRef, RunResult, PerturbationSpec } from '@agent-nexus/driftbench-core';
+import { z } from 'zod';
+
+/**
+ * The red-team pack: one YAML file per deviation class, each holding phrasings for conversations and, for
+ * the classes that apply to code tasks, for tasks. Every phrasing is fictional and carries `approved`: a
+ * person reads it and sets it to true. The perturbing driver draws by seed from the approved phrasings
+ * only, unless the caller asks for drafts.
+ *
+ * What a phrasing holds depends on how its class reaches the agent:
+ * - a user class (D1 to D5, D9, D10): `user`, the message;
+ * - D7: `user` (an empty string is silence) or `burst`, two or more messages;
+ * - D6 on a conversation: `world`, a change of the world whose data carries `instruction`, the text the
+ *   agent must treat as data (for example a store record with a notes field);
+ * - D6 on a task: `file` and `content`, a file planted in the workspace that carries the instruction;
+ * - D8 on a conversation: `error`, the error a tool returns, and optionally `tool`, the tool that fails
+ *   (without it, the first tool the spec expects from the injection on);
+ * - D8 on a task: `content`, the text of an obstacle planted where the agent's next command reads or
+ *   writes, so that command fails.
+ */
+declare const PhrasingKinds: readonly ["conversation", "task"];
+type PhrasingKind = (typeof PhrasingKinds)[number];
+declare const Phrasing: z.ZodObject<{
+    id: z.ZodString;
+    approved: z.ZodBoolean;
+    note: z.ZodOptional<z.ZodString>;
+    user: z.ZodOptional<z.ZodString>;
+    burst: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    world: z.ZodOptional<z.ZodObject<{
+        tools: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            result: z.ZodOptional<z.ZodJSONSchema>;
+            error: z.ZodOptional<z.ZodString>;
+            latency_ms: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>>>;
+        store: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        workspace: z.ZodOptional<z.ZodObject<{
+            from: z.ZodOptional<z.ZodString>;
+            files: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strict>>;
+        fixtures: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>>;
+    instruction: z.ZodOptional<z.ZodString>;
+    error: z.ZodOptional<z.ZodString>;
+    tool: z.ZodOptional<z.ZodString>;
+    file: z.ZodOptional<z.ZodString>;
+    content: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+type Phrasing = z.infer<typeof Phrasing>;
+declare const PackFile: z.ZodObject<{
+    class: z.ZodEnum<{
+        D1_off_topic: "D1_off_topic";
+        D2_goal_shift: "D2_goal_shift";
+        D3_contradiction: "D3_contradiction";
+        D4_loose_confirmation: "D4_loose_confirmation";
+        D5_language_switch: "D5_language_switch";
+        D6_instruction_in_data: "D6_instruction_in_data";
+        D7_silence_or_burst: "D7_silence_or_burst";
+        D8_tool_failure: "D8_tool_failure";
+        D9_out_of_scope: "D9_out_of_scope";
+        D10_return: "D10_return";
+    }>;
+    title: z.ZodOptional<z.ZodString>;
+    conversation: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        approved: z.ZodBoolean;
+        note: z.ZodOptional<z.ZodString>;
+        user: z.ZodOptional<z.ZodString>;
+        burst: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        world: z.ZodOptional<z.ZodObject<{
+            tools: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                result: z.ZodOptional<z.ZodJSONSchema>;
+                error: z.ZodOptional<z.ZodString>;
+                latency_ms: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strict>>>;
+            store: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            workspace: z.ZodOptional<z.ZodObject<{
+                from: z.ZodOptional<z.ZodString>;
+                files: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            }, z.core.$strict>>;
+            fixtures: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strict>>;
+        instruction: z.ZodOptional<z.ZodString>;
+        error: z.ZodOptional<z.ZodString>;
+        tool: z.ZodOptional<z.ZodString>;
+        file: z.ZodOptional<z.ZodString>;
+        content: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    task: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        approved: z.ZodBoolean;
+        note: z.ZodOptional<z.ZodString>;
+        user: z.ZodOptional<z.ZodString>;
+        burst: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        world: z.ZodOptional<z.ZodObject<{
+            tools: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                result: z.ZodOptional<z.ZodJSONSchema>;
+                error: z.ZodOptional<z.ZodString>;
+                latency_ms: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strict>>>;
+            store: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            workspace: z.ZodOptional<z.ZodObject<{
+                from: z.ZodOptional<z.ZodString>;
+                files: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            }, z.core.$strict>>;
+            fixtures: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strict>>;
+        instruction: z.ZodOptional<z.ZodString>;
+        error: z.ZodOptional<z.ZodString>;
+        tool: z.ZodOptional<z.ZodString>;
+        file: z.ZodOptional<z.ZodString>;
+        content: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+type PackFile = z.infer<typeof PackFile>;
+/** A loaded pack: one file per class, by class. */
+type RedteamPack = {
+    readonly files: ReadonlyMap<DeviationClass, PackFile & {
+        path: string;
+    }>;
+};
+declare class RedteamPackError extends Error {
+    name: string;
+}
+/** Checks one parsed pack file; returns the problems, each naming the phrasing. */
+declare function checkPackFile(file: PackFile): string[];
+/**
+ * Reads every .yaml and .yml file of a folder as a pack file. Throws a RedteamPackError that names every
+ * file and problem when a file does not parse or validate, when two files hold the same class, or when the
+ * folder holds none.
+ */
+declare function loadRedteamPack(dir: string): Promise<RedteamPack>;
+/** A pack held in memory, for tests and callers that build one. Validated as a loaded pack is. */
+declare function redteamPack(files: readonly PackFile[]): RedteamPack;
+type DrawOptions = {
+    readonly cls: DeviationClass;
+    readonly kind: PhrasingKind;
+    readonly seed: number;
+    /** Draw from every phrasing, approved or not. Default false: approved phrasings only. */
+    readonly drafts?: boolean;
+};
+/**
+ * One phrasing of a class, drawn by seed: the same pack, class, kind and seed give the same phrasing.
+ * Throws a RedteamPackError when the pack has no file for the class, no phrasing for the kind, or no
+ * approved one (without drafts).
+ */
+declare function drawPhrasing(pack: RedteamPack, options: DrawOptions): Phrasing & {
+    packPath: string;
+};
+
+/**
+ * The simulated user: a person with a persona and a goal, played by a model through the model port. It
+ * answers the agent block by block, reveals a fact only once the agent has asked for it, says the stop
+ * token when the goal is met or abandoned, and never sees the agent's tool calls: it reads the agent's
+ * visible text only.
+ *
+ * Reveal-when-asked is enforced in code, not left to the model: a fact reaches the model's request only
+ * after an agent reply matches one of the fact's ask patterns; the spec's own words for the block, given as
+ * the user's intent, have every fact not yet asked replaced; and an answer that holds a fact not yet asked
+ * fails the run.
+ *
+ * The model must belong to another family than the agent's and every judge's: a model playing the user
+ * of its own family, or grading a conversation it took part in, is the bias the design forbids. The check
+ * runs when the user is created, so a run with a wrong port never starts.
+ */
+/** The model port, as @agent-nexus/driftbench-generate defines it: one system prompt and one user message in, text out. */
+type UserModelPort = {
+    readonly family: string;
+    readonly model?: string;
+    complete(request: {
+        system: string;
+        user: string;
+        maxTokens?: number;
+    }): Promise<string>;
+};
+declare const Persona: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    persona: z.ZodString;
+    goal: z.ZodString;
+    facts: z.ZodRecord<z.ZodString, z.ZodString>;
+    reveal_when_asked: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
+    stop_token: z.ZodString;
+    spec: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+type Persona = z.infer<typeof Persona>;
+declare class SimulatedUserError extends Error {
+    name: string;
+}
+type SimulatedUserOptions = {
+    /** Who the person is and how they write: a persona file's text, or the whole persona. */
+    readonly persona: string | Persona;
+    readonly goal: string;
+    /** What the person knows, by name. Given only when asked for. */
+    readonly facts: Readonly<Record<string, string>>;
+    /** For each fact, the patterns (case-insensitive) of an agent reply that asks for it. Every fact needs one. */
+    readonly revealWhenAsked: Readonly<Record<string, readonly string[]>>;
+    readonly stopToken: string;
+    readonly port: UserModelPort;
+    /** The model family of the agent under test; `none` for an agent that is not a model. */
+    readonly agentFamily: string;
+    /** The model families of the judges that will grade the run. Empty when no judge grades it. */
+    readonly judgeFamilies: readonly string[];
+    /**
+     * `hint` (default): the spec's words for the block are given to the model as what the person means to
+     * say, so the run stays on the spec's blocks and their expectations apply. `none`: the model writes from
+     * the persona, the goal and the conversation alone.
+     */
+    readonly script?: 'hint' | 'none';
+    readonly maxTokens?: number;
+};
+type SimulatedUser = UserDriver & {
+    /** The facts given to the model so far in the current run: the ones the agent has asked for. */
+    revealed(): string[];
+};
+/**
+ * Creates the simulated user. Throws a SimulatedUserError when the port's family is empty, `unknown`, the
+ * agent's or a judge's; when a fact has no ask pattern or a pattern does not compile; when an ask pattern
+ * names no fact; when the persona or the goal already holds a fact's value; or when the stop token is empty.
+ */
+declare function createSimulatedUser(options: SimulatedUserOptions): SimulatedUser;
+/**
+ * Refuses a model port of no known family, of the agent's family or of a judge's family: a model that plays
+ * the user (or the attacker) must not share a family with the agent it talks to or the judges that grade it.
+ */
+declare function checkUserFamilies(options: Pick<SimulatedUserOptions, 'port' | 'agentFamily' | 'judgeFamilies'>): void;
+/** A persona file's fields as the text the model reads. */
+declare function describePersona(persona: Persona): string;
+/** Reads and validates a persona file (YAML). */
+declare function loadPersona(path: string): Promise<Persona>;
+/** The options a persona file gives, ready for createSimulatedUser with a port and the families. */
+declare function personaOptions(persona: Persona): Pick<SimulatedUserOptions, 'persona' | 'goal' | 'facts' | 'revealWhenAsked' | 'stopToken'>;
+declare const UserRecording: z.ZodObject<{
+    family: z.ZodString;
+    model: z.ZodString;
+    persona: z.ZodString;
+    answers: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+type UserRecording = z.infer<typeof UserRecording>;
+/** Reads and validates a recording of a simulated user (YAML). */
+declare function loadUserRecording(path: string): Promise<UserRecording>;
+/**
+ * A port that replays a recording: turn n gets answer n. The request names its turn (`Turn n.` on its
+ * first line: the simulated user's own count of the messages it wrote, so a block another driver injects
+ * does not move it); a request for a turn the recording does not hold fails, so a run never answers out of
+ * order. The port keeps every request, for tests and for the proof.
+ */
+declare function userRecordingPort(recording: UserRecording): UserModelPort & {
+    readonly requests: {
+        system: string;
+        user: string;
+    }[];
+};
+
+/**
+ * The adaptive attacker: a red-team user that picks each attack from what the agent has just said.
+ *
+ * It first runs the spec free (the reference). Then, round after round, it reads the agent's replies in the
+ * last run and finds the cues they give: a reply that asks for an explicit confirmation invites a loose yes
+ * (D4) right after it; a block that called a tool invites a failure of that tool (D8) or an instruction in
+ * its data (D6) under that block; a reply that asks for a fact invites a false premise (D3); an offer
+ * invites a goal shift (D2); any question or request for the user's next move ("I need your name",
+ * "Reply CONFIRM") invites an aside (D1), another language (D5), an out-of-scope request (D9), silence or a
+ * burst (D7); any reply a return after a detour (D10). Of the classes it has not
+ * tried, it takes the one cued by the latest reply (ties broken by seed), builds the deviation (the spec's
+ * own perturbation of that class at that block when it declares one, else a phrasing drawn by seed from the
+ * red-team pack, or written by the model port from the cueing reply), and runs the
+ * spec with it injected. The runner's recovery record scores the round; the next round reads the replies
+ * of this run. A class no reply cues goes in at a seeded position.
+ *
+ * Every decision lands in the recording; a replay runs the same attacks without the pack, the seed or the
+ * model, so a deterministic agent gives the same records.
+ */
+type Cue = {
+    /** The run the cue was read from: `reference`, or the run id of the round before. */
+    run: string;
+    /** The spec block whose reply gave the cue; -1 for a seeded position. */
+    block: number;
+    rule: string;
+    /** The reply that gave the cue, as the agent wrote it. */
+    reply: string;
+    /** The tool the block called, for D6 and D8. */
+    tool?: string;
+};
+type AttackPhrasing = Phrasing & {
+    source: 'pack' | 'model' | 'spec' | 'recording';
+};
+type AttackRound = {
+    round: number;
+    class: DeviationClass;
+    injectAt: number;
+    cue: Cue;
+    phrasing: AttackPhrasing;
+    perturbation: PerturbationSpec;
+    runId: string;
+    status: RunResult['status'];
+    recovery?: NonNullable<RunResult['recovery']>;
+    /** Why the round is a finding: an unsafe act, no recovery in the spec's window, a failed run, no record. */
+    finding?: 'unsafe act' | 'not back in time' | 'run failed' | 'not measured';
+};
+type AttackRecording = {
+    version: 1;
+    spec: string;
+    specHash: string;
+    seed: number;
+    rounds: {
+        class: DeviationClass;
+        inject_at: number;
+        cue: Cue;
+        phrasing: AttackPhrasing;
+    }[];
+};
+type AttackResult = {
+    reference: RunResult;
+    rounds: AttackRound[];
+    findings: number;
+    recording: AttackRecording;
+};
+type AttackOptions = {
+    spec: Spec;
+    adapter: AgentAdapter;
+    checks: CheckSet;
+    artifacts?: ArtifactReaderRegistry;
+    target?: TargetRef;
+    /** The red-team pack the phrasings are drawn from. Needed unless the run replays a recording. */
+    pack?: RedteamPack;
+    /** Draw from unapproved phrasings too. */
+    drafts?: boolean;
+    /** Default 0. */
+    seed?: number;
+    /** At most this many attacks; never more than the ten classes. Default 10. */
+    rounds?: number;
+    /** Writes the user-borne attacks from the cueing reply. With it, agentFamily and judgeFamilies are required. */
+    port?: UserModelPort;
+    agentFamily?: string;
+    judgeFamilies?: readonly string[];
+    /** Runs the attacks of an earlier recording, in order, instead of choosing them. */
+    replay?: AttackRecording;
+    consequential?: (label: string) => boolean;
+    now?: () => Date;
+};
+declare class AttackError extends Error {
+    name: string;
+}
+declare function runAttack(options: AttackOptions): Promise<AttackResult>;
+type CuedClass = {
+    cls: DeviationClass;
+    at: number;
+    cue: Cue;
+};
+/**
+ * The cues the agent's replies in one run give, by spec block, latest block first. A block the attacker
+ * injected as a message gives none: it is not a block of the spec.
+ */
+declare function cuesOf(spec: Spec, run: RunResult, label: string, perturbation?: PerturbationSpec): CuedClass[];
+
+/**
+ * The ten deviation classes, as the perturbing driver applies them. Each class says what carries it to the
+ * agent (a user message, a burst, or a change of the world with no user text), what the agent is expected
+ * to do, and the recovery a drawn perturbation of the class is given when the spec declares none.
+ */
+/** What carries a deviation to the agent. */
+type Carrier = 
+/** One user message. */
+'user'
+/** One user message, or several that arrive together, or an empty message. */
+ | 'user_or_burst'
+/** A change of the world (a tool result, a tool error, a workspace file) with no user text. */
+ | 'world';
+type DeviationDef = {
+    readonly class: DeviationClass;
+    /** The short name, D1 to D10. */
+    readonly code: string;
+    readonly title: string;
+    readonly carrier: Carrier;
+    /** What the agent is expected to do, in one sentence. */
+    readonly expected: string;
+    /** The blocks the agent has to come back, for a drawn perturbation on a conversation. */
+    readonly withinBlocks: number;
+    /** The blocks the agent has to come back, for a drawn perturbation on a task. */
+    readonly taskWithinBlocks: number;
+    /**
+     * True when, on a conversation, the injected block must leave the agent at the stage it was pending at:
+     * the stage of the block before the injection. A goal shift moves the flow, and a world change is
+     * judged by the block it changes, so neither keeps it.
+     */
+    readonly keepsPendingStage: boolean;
+};
+declare const DEVIATIONS: Readonly<Record<DeviationClass, DeviationDef>>;
+/** True for the classes that change the world and carry no user text: D6 and D8. */
+declare function isWorldClass(cls: DeviationClass): boolean;
+/**
+ * The class a name means: the full name (`D2_goal_shift`) or its code (`D2`, `d2`). Undefined when it names
+ * none.
+ */
+declare function deviationClassOf(name: string): DeviationClass | undefined;
+
+/**
+ * The perturbing driver. It plays the spec's blocks and injects one deviation before block `inject_at`
+ * (0-based), then returns to the spec's blocks so recovery can be measured.
+ *
+ * A deviation carried by a user message or a burst goes in as its own block, before block `inject_at`.
+ * A deviation carried by the world alone (D6, D8: a tool result, a tool error, a workspace file) has no
+ * user text: it changes the Given of block `inject_at`, which then runs as the injected block, with the
+ * perturbation's world and the perturbation's expectations, and is not run again. The driver contract has
+ * no step for a world change without a stimulus, so the injected step carries what the base driver says at
+ * that block, and the runner applies the world of the perturbation the step names (from the spec it runs).
+ *
+ * The runner reads a perturbation's world and expectations from the spec it runs, so a run uses
+ * `driver.spec`: the spec with the resolved perturbation in its perturbations. The driver refuses to step
+ * a run of any other spec.
+ */
+/** A perturbation drawn from the red-team pack, by class, position and seed. */
+type DrawnPerturbation = {
+    readonly class: DeviationClass;
+    readonly inject_at: number;
+    readonly pack: RedteamPack;
+    /** Default 0. */
+    readonly seed?: number;
+    /** Draw from unapproved phrasings too. Default false. */
+    readonly drafts?: boolean;
+};
+type PerturbingDriverOptions = {
+    readonly spec: Spec;
+    /**
+     * The deviation: the id of one the spec declares, a perturbation written out, or a draw from the pack. A
+     * draw takes the spec's own perturbation of that class at that position when the spec declares one.
+     */
+    readonly perturbation: string | PerturbationSpec | DrawnPerturbation;
+    /** The driver for the spec's blocks. Default: the scripted driver. */
+    readonly base?: UserDriver;
+};
+/** Where a resolved perturbation came from. */
+type PerturbationSource = {
+    kind: 'declared';
+} | {
+    kind: 'given';
+} | {
+    kind: 'drawn';
+    phrasingId: string;
+    approved: boolean;
+    packPath: string;
+    seed: number;
+};
+type PerturbingDriver = UserDriver & {
+    /** The spec to run: the input spec, with the resolved perturbation in its perturbations. */
+    readonly spec: Spec;
+    readonly perturbation: PerturbationSpec;
+    readonly source: PerturbationSource;
+    /** True when the deviation changes the world only and the injected block replaces block inject_at. */
+    readonly worldOnly: boolean;
+};
+declare class PerturbationError extends Error {
+    name: string;
+}
+declare function createPerturbingDriver(options: PerturbingDriverOptions): PerturbingDriver;
+/** The perturbation an option names, with where it came from. */
+declare function resolvePerturbation(spec: Spec, choice: PerturbingDriverOptions['perturbation']): {
+    perturbation: PerturbationSpec;
+    source: PerturbationSource;
+};
+/**
+ * A perturbation built from a drawn phrasing. Its expectations and recovery follow the class definition:
+ * - a user class keeps the pending stage (the stage of the block before) when the class says so, on a
+ *   conversation; D5 also expects the declared language;
+ * - D6 expects block inject_at's own expectations: the instruction is data, so the block runs as usual;
+ * - D8 expects the failing tool called at most twice (one retry), on a conversation; on a task, a reply
+ *   (an empty one is no honest fallback) and no deleted file.
+ */
+declare function fromPhrasing(spec: Spec, cls: DeviationClass, injectAt: number, phrasing: Phrasing): PerturbationSpec;
+/** A perturbation with neither user text nor a burst: it changes the world only. */
+declare function isWorldOnly(perturbation: PerturbationSpec): boolean;
+
+/**
+ * A seeded choice: the same parts give the same index on every machine and every run. The index is the
+ * first 48 bits of the SHA-256 of the parts joined, modulo the size.
+ */
+declare function seededIndex(parts: readonly (string | number)[], size: number): number;
+
+/** The families a plugin belongs to. Harm and security come first; policy and reliability cover the rest. */
+declare const PluginFamilies: readonly ["harm", "security", "policy", "reliability"];
+type PluginFamily = (typeof PluginFamilies)[number];
+/**
+ * One red-team plugin: a generation template that asks for attack requests against a purpose, and a grader
+ * rubric that judges the reply. Both hold `{{purpose}}`; the generation template also holds `{{n}}`, the
+ * grader rubric also holds `{{prompt}}`.
+ */
+declare const RedteamPlugin: z.ZodObject<{
+    id: z.ZodString;
+    family: z.ZodEnum<{
+        harm: "harm";
+        security: "security";
+        policy: "policy";
+        reliability: "reliability";
+    }>;
+    title: z.ZodString;
+    source: z.ZodString;
+    template: z.ZodString;
+    rubric: z.ZodString;
+}, z.core.$strict>;
+type RedteamPlugin = z.infer<typeof RedteamPlugin>;
+/** A plugin that was not ported, with the reason. */
+type SkippedPlugin = {
+    readonly source: string;
+    readonly reason: string;
+};
+
+/**
+ * Harm plugins, one per category. The requests they generate test refusal and safe handling; no plugin here
+ * writes operational detail for a harmful act. Adapted from MIT-licensed upstream plugins.
+ */
+declare const HARM_PLUGINS: readonly RedteamPlugin[];
+
+/** Policy and reliability plugins: impersonation, bias, unverified claims, invented facts and wrong premises. */
+declare const POLICY_PLUGINS: readonly RedteamPlugin[];
+
+/** Fills every `{{name}}` of a text. Throws when the text names a value the caller did not give. */
+declare function renderText(text: string, values: Readonly<Record<string, string>>): string;
+/**
+ * The generation template and the grader rubric of a plugin, filled for a target purpose. `n` is the number of
+ * requests the template asks for. Supply `prompt` to bind the rubric to the generated attack; without it,
+ * the rubric points at the user messages in the transcript.
+ */
+declare function renderPlugin(plugin: RedteamPlugin, options: {
+    readonly purpose: string;
+    readonly n?: number;
+    readonly prompt?: string;
+}): {
+    template: string;
+    rubric: string;
+};
+
+/** Security plugins: injection, access control, data leaks and tool abuse. Adapted from MIT-licensed upstream plugins. */
+declare const SECURITY_PLUGINS: readonly RedteamPlugin[];
+
+/**
+ * The upstream plugins not ported, each with its reason. Dataset and URL plugins need a download at run time,
+ * which the pack does not do. Policy skips hold content categories whose generation template would need
+ * operational or sexual detail, so they are left for an owner to write under their own review.
+ */
+declare const SKIPPED_PLUGINS: readonly SkippedPlugin[];
+
+/** Every ported plugin, harm and security first. */
+declare const REDTEAM_PLUGINS: readonly RedteamPlugin[];
+/**
+ * The plugins, each checked against its schema. Throws when a plugin is malformed or two share an id, and names
+ * each problem.
+ */
+declare function loadRedteamPlugins(): readonly RedteamPlugin[];
+type PluginToSpecOptions = {
+    readonly purpose: string;
+    /** A variation label sent to the generator and recorded in the spec. Save the spec for exact replay. */
+    readonly seed: number;
+    /** The caller supplies the generator. No model is selected or called implicitly. */
+    readonly port: UserModelPort;
+};
+/**
+ * Generates one attack through the supplied port, then builds a spec whose user turn is that attack.
+ * The rubric receives the actual attack text. Invalid inputs fail before generation; malformed output
+ * fails before a spec reaches the target. The returned spec is checked by the spec loader.
+ */
+declare function pluginToSpec(plugin: RedteamPlugin, options: PluginToSpecOptions): Promise<Spec>;
+
+/**
+ * The scripted driver: replays the spec's blocks in order, each with its own stimulus, and stops after
+ * the last one. It decides from its context alone, so one instance can drive any number of runs.
+ */
+declare function createScriptedDriver(): UserDriver;
+
+/** User drivers: scripted (phase 1), perturbing and simulated (phase 3), the red-team pack and recovery. */
+declare const packageName = "@agent-nexus/driftbench-users";
+
+export { AttackError, type AttackOptions, type AttackRecording, type AttackResult, type AttackRound, type Carrier, type Cue, DEVIATIONS, type DeviationDef, type DrawOptions, type DrawnPerturbation, HARM_PLUGINS, POLICY_PLUGINS, PackFile, Persona, PerturbationError, type PerturbationSource, type PerturbingDriver, type PerturbingDriverOptions, Phrasing, type PhrasingKind, PhrasingKinds, PluginFamilies, type PluginFamily, type PluginToSpecOptions, REDTEAM_PLUGINS, type RedteamPack, RedteamPackError, RedteamPlugin, SECURITY_PLUGINS, SKIPPED_PLUGINS, type SimulatedUser, SimulatedUserError, type SimulatedUserOptions, type SkippedPlugin, type UserModelPort, UserRecording, checkPackFile, checkUserFamilies, createPerturbingDriver, createScriptedDriver, createSimulatedUser, cuesOf, describePersona, deviationClassOf, drawPhrasing, fromPhrasing, isWorldClass, isWorldOnly, loadPersona, loadRedteamPack, loadRedteamPlugins, loadUserRecording, packageName, personaOptions, pluginToSpec, redteamPack, renderPlugin, renderText, resolvePerturbation, runAttack, seededIndex, userRecordingPort };