@intelligo-dev/core 1.0.0-beta.5 → 1.0.0-beta.6

package/README.md

@@ -14,20 +14,21 @@ pnpm add @intelligo-dev/core
 
 ## Exports
 
-| Subpath            | What                                                                       |
-| ------------------ | -------------------------------------------------------------------------- |
-| `/db`              | Drizzle client and the workspace-scoped query helpers                      |
-| `/db/schema`       | Every framework table                                                      |
-| `/conversations`   | Conversation and message persistence (ADR-0009)                            |
-| `/documents`       | Document persistence and the title classifier                              |
-| `/identity`        | The identity graph: facts, memories, profile snapshots                     |
-| `/email`           | Transactional email and its templates                                      |
-| `/notifications`   | In-app notification records and triggers                                   |
-| `/logger`          | Structured logging with credential redaction                               |
-| `/registry`        | Registries that survive a bundler duplicating a module                     |
-| `/money`           | Amount-plus-currency value object in micros; imports nothing               |
-| `/request-context` | Where the framework reads the request's headers from; bound by the adapter |
-| `/env`             | Environment validation                                                     |
+| Subpath            | What                                                                                   |
+| ------------------ | -------------------------------------------------------------------------------------- |
+| `/db`              | Drizzle client and the workspace-scoped query helpers                                  |
+| `/db/schema`       | Every framework table                                                                  |
+| `/conversations`   | Conversation and message persistence (ADR-0009)                                        |
+| `/documents`       | Document persistence and the title classifier                                          |
+| `/identity`        | The identity graph: facts, memories, profile snapshots                                 |
+| `/email`           | Transactional email and its templates                                                  |
+| `/notifications`   | In-app notification records and triggers                                               |
+| `/logger`          | Structured logging with credential redaction                                           |
+| `/registry`        | Registries that survive a bundler duplicating a module                                 |
+| `/money`           | Amount-plus-currency value object in micros; imports nothing                           |
+| `/request-context` | Where the framework reads the request's headers from; bound by the adapter             |
+| `/prompt`          | Prompt-injection sanitisation for user text bound for a system prompt; imports nothing |
+| `/env`             | Environment validation                                                                 |
 
 ## Migrations
 

package/dist/prompt.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Prompt-injection sanitisation for user-authored text that reaches a
+ * system prompt.
+ *
+ * A stored conversation summary, a profile field a student typed, a
+ * tool result quoting a web page — each is text the model will read as
+ * instructions if it is concatenated into the system prompt as-is.
+ * This strips role markers, override phrases and obfuscated separators
+ * before that concatenation, and reports which patterns it saw so a
+ * transport can log the attempt.
+ *
+ * Dependency-free on purpose: it is reached from the chat transport's
+ * `prepareMessages` seam, from tools, and from any package that
+ * assembles a prompt, none of which should pull anything else in for
+ * it. ADR-0008 routed it here from the product's runtime package.
+ *
+ * Returns an empty string when more than half of the original was
+ * injection patterns: that is a hostile payload, and feeding the
+ * remaining fragments to the model is worse than dropping it.
+ */
+export type InjectionPattern = {
+    name: string;
+    pattern: RegExp;
+};
+/**
+ * What is stripped. Exported so a product can extend the list for its
+ * own model or language without re-implementing the sweep.
+ */
+export declare const INJECTION_PATTERNS: readonly InjectionPattern[];
+export type InjectionReport = {
+    isInjection: boolean;
+    /** Names of the patterns that matched, for a log line. */
+    patterns: string[];
+};
+/**
+ * Which patterns the text carries, without changing it. Zero-width
+ * characters are both removed and replaced by spaces before matching,
+ * so neither obfuscation hides a marker.
+ */
+export declare function detectPromptInjection(text: string, patterns?: readonly InjectionPattern[]): InjectionReport;
+/**
+ * The text with every pattern replaced by a space and whitespace
+ * collapsed — or an empty string when the text was mostly patterns.
+ */
+export declare function sanitizeForSystemPrompt(text: string, patterns?: readonly InjectionPattern[]): string;
+//# sourceMappingURL=prompt.d.ts.map

package/dist/prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.d.ts","sourceRoot":"","sources":["../src/prompt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAYH,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjE;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,gBAAgB,EAuCzD,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,EAAE,OAAO,CAAC;IACrB,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,SAAS,gBAAgB,EAAuB,GACzD,eAAe,CAajB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,SAAS,gBAAgB,EAAuB,GACzD,MAAM,CAsBR"}

package/dist/prompt.js

@@ -0,0 +1,116 @@
+/**
+ * Prompt-injection sanitisation for user-authored text that reaches a
+ * system prompt.
+ *
+ * A stored conversation summary, a profile field a student typed, a
+ * tool result quoting a web page — each is text the model will read as
+ * instructions if it is concatenated into the system prompt as-is.
+ * This strips role markers, override phrases and obfuscated separators
+ * before that concatenation, and reports which patterns it saw so a
+ * transport can log the attempt.
+ *
+ * Dependency-free on purpose: it is reached from the chat transport's
+ * `prepareMessages` seam, from tools, and from any package that
+ * assembles a prompt, none of which should pull anything else in for
+ * it. ADR-0008 routed it here from the product's runtime package.
+ *
+ * Returns an empty string when more than half of the original was
+ * injection patterns: that is a hostile payload, and feeding the
+ * remaining fragments to the model is worse than dropping it.
+ */
+const ZERO_WIDTH_CHARS = /[\u200B\u200C\u200D\u200E\u200F\uFEFF\u00AD\u2060\u2061\u2062\u2063\u2064]/g;
+function normalizeText(text) {
+    return {
+        withSpaces: text.replace(ZERO_WIDTH_CHARS, " ").normalize("NFKC"),
+        stripped: text.replace(ZERO_WIDTH_CHARS, "").normalize("NFKC"),
+    };
+}
+/**
+ * What is stripped. Exported so a product can extend the list for its
+ * own model or language without re-implementing the sweep.
+ */
+export const INJECTION_PATTERNS = [
+    { name: "[SYSTEM]", pattern: /\[SYSTEM\]/gi },
+    { name: "<<SYS>>", pattern: /<<SYS>>/gi },
+    { name: "<|system|>", pattern: /<\|system\|>/gi },
+    { name: "<|im_start|>", pattern: /<\|im_start\|>/gi },
+    { name: "<|im_end|>", pattern: /<\|im_end\|>/gi },
+    { name: "system: prefix", pattern: /^(SYSTEM|System|system)\s*:\s*/gm },
+    {
+        name: "ignore previous instructions",
+        pattern: /ignore\s+(?:all\s+)?previous\s+instructions?/gi,
+    },
+    { name: "disregard above", pattern: /disregard\s+(?:everything\s+)?above/gi },
+    { name: "forget everything", pattern: /forget\s+(?:all|everything)/gi },
+    {
+        name: "override instructions",
+        pattern: /override\s+(?:your\s+)?instructions?/gi,
+    },
+    {
+        name: "new instructions",
+        pattern: /(?:your\s+)?new\s+instructions?\s+(?:are|follow)/gi,
+    },
+    { name: "you are now", pattern: /you\s+are\s+now\s+/gi },
+    { name: "act as", pattern: /\bact\s+as\s+(?:a\s+|an\s+)?/gi },
+    { name: "pretend to be", pattern: /pretend\s+to\s+be\s+/gi },
+    { name: "roleplay as", pattern: /roleplay\s+as\s+/gi },
+    { name: "play the role", pattern: /play\s+(?:the\s+)?role\s+of\s+/gi },
+    { name: "separator ---", pattern: /\n{0,2}-{3,}\n{0,2}/g },
+    { name: "separator ===", pattern: /\n{0,2}={3,}\n{0,2}/g },
+    { name: "separator ###", pattern: /\n{0,2}#{3,}\n{0,2}/g },
+    { name: "script tag", pattern: /<script[\s>]/gi },
+    { name: "base64 data", pattern: /data:[^;]+;base64,/gi },
+    {
+        name: "do not follow",
+        pattern: /do\s+not\s+follow\s+(?:your\s+)?(?:previous\s+)?instructions?/gi,
+    },
+    {
+        name: "new system prompt",
+        pattern: /(?:new|updated?)\s+system\s+prompt/gi,
+    },
+];
+/**
+ * Which patterns the text carries, without changing it. Zero-width
+ * characters are both removed and replaced by spaces before matching,
+ * so neither obfuscation hides a marker.
+ */
+export function detectPromptInjection(text, patterns = INJECTION_PATTERNS) {
+    if (!text || text.trim().length === 0) {
+        return { isInjection: false, patterns: [] };
+    }
+    const { withSpaces, stripped } = normalizeText(text);
+    const matched = [];
+    for (const { name, pattern } of patterns) {
+        // Fresh instances: a global RegExp carries lastIndex between tests.
+        const a = new RegExp(pattern.source, pattern.flags);
+        const b = new RegExp(pattern.source, pattern.flags);
+        if (a.test(withSpaces) || b.test(stripped))
+            matched.push(name);
+    }
+    return { isInjection: matched.length > 0, patterns: matched };
+}
+/**
+ * The text with every pattern replaced by a space and whitespace
+ * collapsed — or an empty string when the text was mostly patterns.
+ */
+export function sanitizeForSystemPrompt(text, patterns = INJECTION_PATTERNS) {
+    if (!text || text.trim().length === 0)
+        return text;
+    const originalLength = text.length;
+    let sanitized = normalizeText(text).withSpaces;
+    for (const { pattern } of patterns) {
+        sanitized = sanitized.replace(new RegExp(pattern.source, pattern.flags), " ");
+    }
+    sanitized = sanitized
+        // A pattern replaced between two newlines leaves a whitespace-only
+        // line behind; drop those before collapsing blank lines.
+        .replace(/\n[ \t]+\n/g, "\n\n")
+        .replace(/\n{3,}/g, "\n\n")
+        .replace(/ {2,}/g, " ")
+        .trim();
+    const removed = originalLength - sanitized.length;
+    if (removed / originalLength > 0.5)
+        return "";
+    return sanitized;
+}
+//# sourceMappingURL=prompt.js.map

package/dist/prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.js","sourceRoot":"","sources":["../src/prompt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,gBAAgB,GACpB,6EAA6E,CAAC;AAEhF,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;QACjE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;KAC/D,CAAC;AACJ,CAAC;AAID;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAgC;IAC7D,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE;IAC7C,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE;IACzC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,gBAAgB,EAAE;IACjD,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,kBAAkB,EAAE;IACrD,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,gBAAgB,EAAE;IACjD,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,kCAAkC,EAAE;IACvE;QACE,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,gDAAgD;KAC1D;IACD,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,uCAAuC,EAAE;IAC7E,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,+BAA+B,EAAE;IACvE;QACE,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,wCAAwC;KAClD;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,oDAAoD;KAC9D;IACD,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,sBAAsB,EAAE;IACxD,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,gCAAgC,EAAE;IAC7D,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,wBAAwB,EAAE;IAC5D,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,oBAAoB,EAAE;IACtD,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,kCAAkC,EAAE;IACtE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,sBAAsB,EAAE;IAC1D,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,sBAAsB,EAAE;IAC1D,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,sBAAsB,EAAE;IAC1D,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,gBAAgB,EAAE;IACjD,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,sBAAsB,EAAE;IACxD;QACE,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,iEAAiE;KAC3E;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,sCAAsC;KAChD;CACF,CAAC;AAQF;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAY,EACZ,WAAwC,kBAAkB;IAE1D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;QACzC,oEAAoE;QACpE,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAY,EACZ,WAAwC,kBAAkB;IAE1D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnD,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC;IACnC,IAAI,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;IAC/C,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;QACnC,SAAS,GAAG,SAAS,CAAC,OAAO,CAC3B,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EACzC,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,SAAS,GAAG,SAAS;QACnB,mEAAmE;QACnE,yDAAyD;SACxD,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC;SAC9B,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;SAC1B,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,IAAI,EAAE,CAAC;IAEV,MAAM,OAAO,GAAG,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC;IAClD,IAAI,OAAO,GAAG,cAAc,GAAG,GAAG;QAAE,OAAO,EAAE,CAAC;IAC9C,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intelligo-dev/core",
-  "version": "1.0.0-beta.5",
+  "version": "1.0.0-beta.6",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -61,6 +61,10 @@
       "types": "./dist/request-context.d.ts",
       "default": "./dist/request-context.js"
     },
+    "./prompt": {
+      "types": "./dist/prompt.d.ts",
+      "default": "./dist/prompt.js"
+    },
     "./logger": {
       "types": "./dist/logger.d.ts",
       "import": "./dist/logger.js",