@mux/ai 0.17.1 → 0.18.0

package/README.md

@@ -229,6 +229,7 @@ import { workflows, primitives } from "@mux/ai";
 | [Audio-Only Workflows](./docs/AUDIO-ONLY.md) | Working with audio-only assets (no video track) |
 | [Evaluations](./docs/EVALS.md) | AI eval testing with the 3 E's framework — [public dashboard](https://evaluating-mux-ai.vercel.app/) |
 | [Examples](./docs/EXAMPLES.md) | Running the example scripts from the repository |
+| [Security](./docs/SECURITY.md) | Prompt-injection threat model, trust boundaries for workflow options, and the `safety` field on results |
 
 ### Additional Resources
 

package/dist/{index-BfsJvx3r.d.ts → index-BjwbvdoQ.d.ts}

@@ -17,6 +17,56 @@ interface ImageDownloadOptions {
     exponentialBackoff?: boolean;
 }
 
+/**
+ * Which detector fired on a leak, or `null` when the text is clean.
+ *
+ * - `canary` — the system-prompt canary token appeared in the output.
+ *   Near-zero false-positive rate; treat as a confirmed leak.
+ * - `prompt_tag` — an XML-like tag taken from our prompt structure
+ *   appeared in the output. Low false-positive rate.
+ * - `encoded_blob` — a long run of base64- or hex-shaped characters
+ *   appeared in a field expected to hold prose. Heuristic; some false
+ *   positives on hashes or tokens in tech-content transcripts.
+ * - `unexpected_key` — the model emitted a JSON field not declared in
+ *   the schema (see {@link detectUnexpectedKeys}). Stripped silently
+ *   by zod's default `.strip()` mode; this signal surfaces the
+ *   smuggling attempt rather than letting it go unseen.
+ */
+type LeakReason = "canary" | "prompt_tag" | "encoded_blob" | "unexpected_key" | null;
+/**
+ * Per-field record of a detected leak. Collected across every scrub
+ * performed inside a single workflow invocation and returned to the
+ * caller in the workflow result's `safety` field.
+ */
+interface ScrubbedFieldReport {
+    /**
+     * Identifier for the field that leaked. Format is workflow-specific
+     * (e.g. "reasoning[0]", "moment_insight[2]", "description"). Intended
+     * for debugging and observability; do not parse programmatically.
+     */
+    field: string;
+    /** Which detector fired — see {@link LeakReason}. */
+    reason: Exclude<LeakReason, null>;
+}
+/**
+ * Aggregate safety report returned from workflows that perform
+ * output-side scrubbing.
+ *
+ * Operators can use this to alert on suspected prompt-injection traffic
+ * without inspecting log warnings. Shape is stable across workflows so a
+ * single observer can consume it uniformly.
+ */
+interface SafetyReport {
+    /** `true` when at least one field was suppressed by the scrubber. */
+    leaksDetected: boolean;
+    /**
+     * One entry per suppressed field. Empty (but present) when no leaks
+     * were detected. Iteration order matches the order scrubs ran, so
+     * callers can correlate entries with workflow structure if they wish.
+     */
+    scrubbedFields: ScrubbedFieldReport[];
+}
+
 type SupportedProvider = "openai" | "anthropic" | "google";
 type SupportedEmbeddingProvider = "openai" | "google";
 type OpenAIModelId = Parameters<ReturnType<typeof createOpenAI>["chat"]>[0];
@@ -72,6 +122,20 @@ interface AskQuestionsOptions extends MuxAIOptions {
     imageDownloadOptions?: ImageDownloadOptions;
     /** Storyboard width in pixels (defaults to 640). */
     storyboardWidth?: number;
+    /**
+     * Maximum length (in characters) allowed for each entry in a question's
+     * `answerOptions` array. Defaults to 150.
+     *
+     * The cap exists to reject instruction-shaped answer options — a common
+     * prompt-injection shape pairs sentence-length options that presuppose
+     * the desired outcome, making "answering correctly" equivalent to
+     * leaking. Domain-specific category labels (e.g. moderation labels like
+     * "Depicts underage individuals in sexual content") can legitimately
+     * run 40–80 characters, so the default is set generously. Raise this
+     * if your use case has genuinely longer category labels; never widen
+     * it to accept arbitrary untrusted input without other safeguards.
+     */
+    maxAnswerOptionLength?: number;
 }
 /** Structured return payload for askQuestions workflow. */
 interface AskQuestionsResult {
@@ -85,8 +149,37 @@ interface AskQuestionsResult {
     usage?: TokenUsage;
     /** Raw transcript text used for analysis (when includeTranscript is true). */
     transcriptText?: string;
+    /**
+     * Aggregate report of output-side scrubbing performed during this call.
+     * Populated by {@link scrubFreeTextField}. When present with
+     * `leaksDetected: true`, at least one free-text field was suppressed as
+     * a suspected prompt leak — consult `scrubbedFields` for details.
+     */
+    safety?: SafetyReport;
 }
-/** Zod schema for a single answer (matches the public QuestionAnswer interface). */
+/**
+ * Zod schema for a single answer (matches the public QuestionAnswer interface).
+ *
+ * Uses zod's default `.strip()` mode (rather than `.strict()`) so that
+ * an extra key emitted by the model does not fail the whole workflow —
+ * it is silently stripped during parse. The smuggling-channel concern
+ * (a coerced model emitting a prompt fragment under an unexpected key)
+ * is handled out-of-band: the call site re-parses `response.text`,
+ * runs {@link detectUnexpectedKeysFromRawText}, and records each extra
+ * as an `unexpected_key` entry in the workflow's safety report.
+ *
+ * The `.max(1000)` cap on `reasoning` is a mechanical limit on how much
+ * content can be exfiltrated through this channel.
+ *
+ * Tuning notes:
+ * - `REASONING_FIELD_SCOPE` asks the model to keep reasoning to 1–3
+ *   concise sentences. Observed lengths are typically 50–200 chars.
+ * - The 1000-char cap leaves ~5x headroom over typical output while
+ *   making a full system-prompt dump (3000+ chars) unable to fit.
+ * - A plausible tighter value is 500. Before tightening, confirm via
+ *   the `safety` telemetry that 90th-percentile observed lengths on
+ *   legitimate traffic stay well under the new target.
+ */
 declare const questionAnswerSchema: z.ZodObject<{
     question: z.ZodString;
     answer: z.ZodNullable<z.ZodString>;
@@ -210,6 +303,15 @@ interface BurnedInCaptionsResult {
     storyboardUrl: string;
     /** Token usage from the AI provider (for efficiency/cost analysis). */
     usage?: TokenUsage;
+    /**
+     * Aggregate report of output-side safety signals detected during this
+     * call. The workflow's free-text surface is limited to
+     * `detectedLanguage`, so most entries here will be `unexpected_key`
+     * records — the model emitting a field not declared in
+     * `burnedInCaptionsSchema` (which is then silently stripped by
+     * zod.strip() but surfaced here as a smuggling signal).
+     */
+    safety?: SafetyReport;
 }
 /**
  * Sections of the burned-in captions user prompt that can be overridden.
@@ -247,7 +349,27 @@ interface BurnedInCaptionsOptions extends MuxAIOptions {
      */
     promptOverrides?: BurnedInCaptionsPromptOverrides;
 }
-/** Schema used to validate burned-in captions analysis responses. */
+/**
+ * Schema used to validate burned-in captions analysis responses.
+ *
+ * Uses zod's default `.strip()` mode rather than `.strict()`: extra keys
+ * the model emits are silently dropped during parse so a provider
+ * quirk doesn't fail the whole workflow. The smuggling-channel concern
+ * (a coerced model emitting e.g. `{ ..., system_prompt_verbatim: "..." }`)
+ * is addressed out-of-band by the `detectUnexpectedKeys` call at the
+ * parse site — which logs the extras and records them in the workflow's
+ * safety report as `unexpected_key` leaks.
+ *
+ * `.max(100)` on `detectedLanguage` caps the one free-text field.
+ *
+ * Tuning notes:
+ * - Real language names are short ("English", "Mandarin Chinese",
+ *   "Brazilian Portuguese"), typically 5–30 chars.
+ * - 100 chars leaves ~3x headroom while preventing a multi-hundred-
+ *   character dump.
+ * - Could plausibly tighten to 60 once telemetry shows legitimate
+ *   outputs consistently well under that.
+ */
 declare const burnedInCaptionsSchema: z.ZodObject<{
     hasBurnedInCaptions: z.ZodBoolean;
     confidence: z.ZodNumber;
@@ -265,6 +387,23 @@ declare const burnedInCaptionsSchema: z.ZodObject<{
 type BurnedInCaptionsAnalysis = z.infer<typeof burnedInCaptionsSchema>;
 declare function hasBurnedInCaptions(assetId: string, options?: BurnedInCaptionsOptions): Promise<BurnedInCaptionsResult>;
 
+/**
+ * Uses zod's default `.strip()` on both schemas so extra keys the model
+ * emits are silently stripped rather than failing the workflow. The
+ * smuggling-channel concern (a coerced model emitting prompt fragments
+ * under an unexpected key) is surfaced by the call site's
+ * `detectUnexpectedKeysFromRawText` pass, which records each extra as
+ * an `unexpected_key` entry in the workflow's safety report.
+ *
+ * `.max(300)` on `title` caps the exfiltration channel.
+ *
+ * Tuning notes:
+ * - Chapter titles are short labels ("Introduction", "Main Topic
+ *   Discussion") and typically run 10–50 characters.
+ * - 300 chars leaves generous headroom (~6x typical). Could plausibly
+ *   tighten to 150 once telemetry shows no legitimate output
+ *   approaches that length.
+ */
 declare const chapterSchema: z.ZodObject<{
     startTime: z.ZodNumber;
     title: z.ZodString;
@@ -306,6 +445,14 @@ interface ChaptersResult {
     chapters: Chapter[];
     /** Token usage from the AI provider (for efficiency/cost analysis). */
     usage?: TokenUsage;
+    /**
+     * Aggregate report of output-side scrubbing performed during this call.
+     * When `leaksDetected` is `true`, at least one chapter title was
+     * suppressed. Suppressed chapters are dropped from the returned
+     * `chapters` array so playback timelines are not decorated with blank
+     * titles; consult `scrubbedFields` to know how many were removed.
+     */
+    safety?: SafetyReport;
 }
 /**
  * Sections of the chaptering user prompt that can be overridden.
@@ -360,7 +507,7 @@ interface ChaptersOptions extends MuxAIOptions {
  * Sections of the chaptering system prompt that can be overridden.
  * Use these to customize the AI's persona and constraints.
  */
-type ChapterSystemPromptSections = "role" | "context" | "constraints" | "qualityGuidelines";
+type ChapterSystemPromptSections = "role" | "context" | "security" | "constraints" | "qualityGuidelines";
 declare function generateChapters(assetId: string, options?: ChaptersOptions): Promise<ChaptersResult>;
 
 /** Replacement strategy for censored words. */
@@ -432,8 +579,35 @@ interface EditCaptionsResult {
     uploadedTrackId?: string;
     presignedUrl?: string;
     usage?: TokenUsage;
+    /**
+     * Aggregate report of output-side scrubbing performed during this call.
+     * When `leaksDetected` is `true`, at least one entry returned by the
+     * profanity detector contained signs of a system-prompt leak (for
+     * example, a tag marker emitted in place of a profane word). Leaked
+     * entries are dropped before regex construction so they never drive
+     * transcript edits.
+     */
+    safety?: SafetyReport;
 }
-/** Schema used when requesting profanity detection from a language model. */
+/**
+ * Schema used when requesting profanity detection from a language model.
+ *
+ * Uses zod's default `.strip()` mode. Extra keys emitted by the model
+ * are silently dropped at parse time; the call site re-parses
+ * `response.text` and records each extra as an `unexpected_key` entry
+ * in the workflow's safety report.
+ *
+ * `.max(100)` on each array entry caps how much content can be smuggled
+ * through a single "word" slot.
+ *
+ * Tuning notes:
+ * - Legitimate profane words and short phrases are typically 4–20
+ *   chars, rarely more than 30.
+ * - 100 chars leaves ~3x headroom while preventing multi-hundred-char
+ *   prompt fragments from hiding in a single entry.
+ * - Could plausibly tighten to 50 once telemetry shows no legitimate
+ *   detection approaches that length.
+ */
 declare const profanityDetectionSchema: z.ZodObject<{
     profanity: z.ZodArray<z.ZodString, "many">;
 }, "strip", z.ZodTypeAny, {
@@ -565,6 +739,14 @@ interface EngagementInsightsResult {
     overallInsight: OverallInsight;
     /** Token usage from the AI provider (for efficiency/cost analysis). */
     usage?: TokenUsage;
+    /**
+     * Aggregate report of output-side scrubbing performed during this call.
+     * When `leaksDetected` is `true`, at least one `insight`, the overall
+     * `summary`, or an entry of `trends` was suppressed as a suspected
+     * prompt leak. Suppressed insights and the summary are replaced with
+     * a neutral placeholder; suppressed trends are dropped.
+     */
+    safety?: SafetyReport;
 }
 /**
  * Extracts transcript segments that align with hotspot time ranges.
@@ -712,11 +894,36 @@ declare function getModerationScores(assetId: string, options?: ModerationOption
 declare const DEFAULT_SUMMARY_KEYWORD_LIMIT = 10;
 declare const DEFAULT_TITLE_LENGTH = 10;
 declare const DEFAULT_DESCRIPTION_LENGTH = 50;
+/**
+ * Length caps (`.max(...)`) on each free-text field are a mechanical
+ * defence-in-depth against exfiltration: even if an injection payload
+ * coerces the model into leaking, it cannot fit more than the declared
+ * number of characters.
+ *
+ * Typical legitimate lengths and current margin:
+ *
+ * - `title`: real titles are 25–150 chars (10–20 words). Cap is 500 —
+ *   very generous. Could plausibly tighten to 200 once telemetry from
+ *   the `safety` field shows no legitimate outputs approach 200.
+ * - `description`: configurable via `descriptionLength` (word count).
+ *   Default 50 words ≈ 300 chars. The exported schema uses a permissive
+ *   10000-char ceiling so consumers who call `summarySchema.parse`
+ *   directly don't hit surprise failures on large `descriptionLength`
+ *   configs; the workflow itself parses with a tighter dynamic cap —
+ *   see {@link buildSummarySchema}.
+ * - `keywords` entries: legitimate tags are 10–30 chars. Cap is 200.
+ *   Could tighten to 80 if we wanted less slack.
+ *
+ * Tuning signal: a `safety.leaksDetected` hit with `reason: "canary"`
+ * or `"prompt_tag"` while legitimate 90th-percentile lengths stay well
+ * below the cap is evidence the cap can be tightened without breaking
+ * real outputs.
+ */
 declare const summarySchema: z.ZodObject<{
     keywords: z.ZodArray<z.ZodString, "many">;
     title: z.ZodString;
     description: z.ZodString;
-}, "strict", z.ZodTypeAny, {
+}, "strip", z.ZodTypeAny, {
     title: string;
     description: string;
     keywords: string[];
@@ -742,6 +949,15 @@ interface SummaryAndTagsResult {
     usage?: TokenUsage;
     /** Raw transcript text used for analysis (when includeTranscript is true). */
     transcriptText?: string;
+    /**
+     * Aggregate report of output-side scrubbing performed during this call.
+     * When `leaksDetected` is `true`, at least one of `title`, `description`,
+     * or an element of `tags` was suppressed because the scrubber detected
+     * signs of a prompt leak — consult `scrubbedFields` for which.
+     * Suppressed fields are returned as empty strings or omitted from the
+     * tags array.
+     */
+    safety?: SafetyReport;
 }
 /**
  * Sections of the summarization user prompt that can be overridden.
@@ -975,6 +1191,15 @@ interface TranslationResult {
     presignedUrl?: string;
     /** Token usage from the AI provider (for efficiency/cost analysis). */
     usage?: TokenUsage;
+    /**
+     * Aggregate report of output-side scrubbing performed during this call.
+     * When `leaksDetected` is `true`, at least one translated cue was
+     * suppressed because the scrubber detected signs of a prompt leak; the
+     * cue's source text is substituted back in place so the 1:1 cue
+     * contract and timeline alignment are preserved. Consult
+     * `scrubbedFields` to know which cues were affected.
+     */
+    safety?: SafetyReport;
 }
 /** Configuration accepted by `translateCaptions`. */
 interface TranslationOptions<P extends SupportedProvider = SupportedProvider> extends MuxAIOptions {
@@ -1027,7 +1252,16 @@ interface TranslationChunkingOptions {
     /** Approximate cap for cue text tokens included in a single AI translation chunk. Defaults to 2000. */
     maxCueTextTokensPerChunk?: number;
 }
-/** Schema used when requesting caption translation from a language model. */
+/**
+ * Schema used when requesting caption translation from a language model.
+ *
+ * Uses zod's default `.strip()` mode. Extras emitted by the model are
+ * silently dropped during parse so a benign provider quirk does not
+ * fail the workflow; the call site re-parses `response.text` via
+ * `detectUnexpectedKeysFromRawText` and records each extra as an
+ * `unexpected_key` entry in the safety report — see the matching note
+ * on `burnedInCaptionsSchema` for the full rationale.
+ */
 declare const translationSchema: z.ZodObject<{
     translation: z.ZodString;
 }, "strip", z.ZodTypeAny, {
@@ -1039,6 +1273,39 @@ declare const translationSchema: z.ZodObject<{
 type TranslationPayload = z.infer<typeof translationSchema>;
 declare function shouldSplitChunkTranslationError(error: unknown): boolean;
 declare function aggregateTokenUsage(usages: TokenUsage[]): TokenUsage;
+/**
+ * Normalise a model-returned VTT string for robustness against
+ * provider wrapping quirks.
+ *
+ * We have observed Anthropic (and occasionally other providers) wrap
+ * their translated VTT output in code fences or HTML tags, lower-case
+ * the `WEBVTT` header, or drop the header entirely. The Mux Video
+ * track ingestion API and web-native VTT players both require the
+ * exact uppercase `WEBVTT` header at the start of the file, so leaving
+ * these quirks in place produces downstream breakage even though the
+ * cue content is correct.
+ *
+ * Transformations (idempotent on already-valid VTT):
+ *
+ * - Strip a surrounding markdown fence with an optional language hint:
+ *     "```vtt\\nWEBVTT\\n...\\n```"     -> "WEBVTT\\n..."
+ *     "```webvtt\\n...\\n```"           -> "WEBVTT\\n..."
+ *     "```\\nWEBVTT\\n...\\n```"        -> "WEBVTT\\n..."
+ *
+ * - Strip a surrounding <code> / <pre> wrapper (Anthropic's common
+ *   habit on this task):
+ *     "<code>webvtt\\n...\\n</code>"    -> "webvtt\\n..." (then normalised)
+ *
+ * - Upper-case a lowercase `webvtt` / `Webvtt` header prefix.
+ *
+ * - Prepend `WEBVTT\\n\\n` if the header is missing entirely (model
+ *   jumped straight to the first cue block).
+ *
+ * Only the whole-VTT translation path calls this — the cue-chunked
+ * path rebuilds the VTT locally via `buildVttFromTranslatedCueBlocks`,
+ * so the header comes from our code and needs no fix-up.
+ */
+declare function normalizeTranslatedVtt(translation: string): string;
 declare function translateCaptions<P extends SupportedProvider = SupportedProvider>(assetId: string, trackId: string, toLanguageCode: string, options: TranslationOptions<P>): Promise<TranslationResult>;
 
 type index_AskQuestionsOptions = AskQuestionsOptions;
@@ -1114,6 +1381,7 @@ declare const index_getModerationScores: typeof getModerationScores;
 declare const index_getSummaryAndTags: typeof getSummaryAndTags;
 declare const index_hasBurnedInCaptions: typeof hasBurnedInCaptions;
 declare const index_mapShotsToHotspots: typeof mapShotsToHotspots;
+declare const index_normalizeTranslatedVtt: typeof normalizeTranslatedVtt;
 declare const index_profanityDetectionSchema: typeof profanityDetectionSchema;
 declare const index_questionAnswerSchema: typeof questionAnswerSchema;
 declare const index_shouldSplitChunkTranslationError: typeof shouldSplitChunkTranslationError;
@@ -1123,7 +1391,7 @@ declare const index_translateAudio: typeof translateAudio;
 declare const index_translateCaptions: typeof translateCaptions;
 declare const index_translationSchema: typeof translationSchema;
 declare namespace index {
-  export { type index_AskQuestionsOptions as AskQuestionsOptions, type index_AskQuestionsResult as AskQuestionsResult, type index_AskQuestionsType as AskQuestionsType, type index_AudioTranslationOptions as AudioTranslationOptions, type index_AudioTranslationResult as AudioTranslationResult, type index_AutoCensorProfanityOptions as AutoCensorProfanityOptions, type index_BurnedInCaptionsAnalysis as BurnedInCaptionsAnalysis, type index_BurnedInCaptionsOptions as BurnedInCaptionsOptions, type index_BurnedInCaptionsPromptOverrides as BurnedInCaptionsPromptOverrides, type index_BurnedInCaptionsPromptSections as BurnedInCaptionsPromptSections, type index_BurnedInCaptionsResult as BurnedInCaptionsResult, type index_CaptionReplacement as CaptionReplacement, type index_CensorMode as CensorMode, type index_Chapter as Chapter, type index_ChapterSystemPromptSections as ChapterSystemPromptSections, type index_ChaptersOptions as ChaptersOptions, type index_ChaptersPromptOverrides as ChaptersPromptOverrides, type index_ChaptersPromptSections as ChaptersPromptSections, type index_ChaptersResult as ChaptersResult, type index_ChaptersType as ChaptersType, index_DEFAULT_DESCRIPTION_LENGTH as DEFAULT_DESCRIPTION_LENGTH, index_DEFAULT_SUMMARY_KEYWORD_LIMIT as DEFAULT_SUMMARY_KEYWORD_LIMIT, index_DEFAULT_TITLE_LENGTH as DEFAULT_TITLE_LENGTH, type index_EditCaptionsOptions as EditCaptionsOptions, type index_EditCaptionsResult as EditCaptionsResult, type index_EmbeddingsOptions as EmbeddingsOptions, type index_EmbeddingsResult as EmbeddingsResult, type index_EngagementInsightsOptions as EngagementInsightsOptions, type index_EngagementInsightsResult as EngagementInsightsResult, index_HIVE_SEXUAL_CATEGORIES as HIVE_SEXUAL_CATEGORIES, index_HIVE_VIOLENCE_CATEGORIES as HIVE_VIOLENCE_CATEGORIES, type index_HiveModerationOutput as HiveModerationOutput, type index_HiveModerationSource as HiveModerationSource, type index_ModerationOptions as ModerationOptions, type index_ModerationProvider as ModerationProvider, type index_ModerationResult as ModerationResult, type index_MomentInsight as MomentInsight, type index_OverallInsight as OverallInsight, type index_ProfanityDetectionPayload as ProfanityDetectionPayload, type index_Question as Question, type index_QuestionAnswer as QuestionAnswer, type index_QuestionAnswerType as QuestionAnswerType, type index_ReplacementRecord as ReplacementRecord, type index_SummarizationOptions as SummarizationOptions, type index_SummarizationPromptOverrides as SummarizationPromptOverrides, type index_SummarizationPromptSections as SummarizationPromptSections, type index_SummaryAndTagsResult as SummaryAndTagsResult, type index_SummaryType as SummaryType, type index_ThumbnailModerationScore as ThumbnailModerationScore, type index_TranslationChunkingOptions as TranslationChunkingOptions, type index_TranslationOptions as TranslationOptions, type index_TranslationPayload as TranslationPayload, type index_TranslationResult as TranslationResult, index_aggregateTokenUsage as aggregateTokenUsage, index_applyOverrideLists as applyOverrideLists, index_applyReplacements as applyReplacements, index_askQuestions as askQuestions, index_buildReplacementRegex as buildReplacementRegex, index_burnedInCaptionsSchema as burnedInCaptionsSchema, index_censorVttContent as censorVttContent, index_chapterSchema as chapterSchema, index_chaptersSchema as chaptersSchema, index_createReplacer as createReplacer, index_editCaptions as editCaptions, index_extractTranscriptSegmentsForHotspots as extractTranscriptSegmentsForHotspots, index_generateChapters as generateChapters, index_generateEmbeddings as generateEmbeddings, index_generateEngagementInsights as generateEngagementInsights, index_generateVideoEmbeddings as generateVideoEmbeddings, index_getModerationScores as getModerationScores, index_getSummaryAndTags as getSummaryAndTags, index_hasBurnedInCaptions as hasBurnedInCaptions, index_mapShotsToHotspots as mapShotsToHotspots, index_profanityDetectionSchema as profanityDetectionSchema, index_questionAnswerSchema as questionAnswerSchema, index_shouldSplitChunkTranslationError as shouldSplitChunkTranslationError, index_summarySchema as summarySchema, index_transformCueText as transformCueText, index_translateAudio as translateAudio, index_translateCaptions as translateCaptions, index_translationSchema as translationSchema };
+  export { type index_AskQuestionsOptions as AskQuestionsOptions, type index_AskQuestionsResult as AskQuestionsResult, type index_AskQuestionsType as AskQuestionsType, type index_AudioTranslationOptions as AudioTranslationOptions, type index_AudioTranslationResult as AudioTranslationResult, type index_AutoCensorProfanityOptions as AutoCensorProfanityOptions, type index_BurnedInCaptionsAnalysis as BurnedInCaptionsAnalysis, type index_BurnedInCaptionsOptions as BurnedInCaptionsOptions, type index_BurnedInCaptionsPromptOverrides as BurnedInCaptionsPromptOverrides, type index_BurnedInCaptionsPromptSections as BurnedInCaptionsPromptSections, type index_BurnedInCaptionsResult as BurnedInCaptionsResult, type index_CaptionReplacement as CaptionReplacement, type index_CensorMode as CensorMode, type index_Chapter as Chapter, type index_ChapterSystemPromptSections as ChapterSystemPromptSections, type index_ChaptersOptions as ChaptersOptions, type index_ChaptersPromptOverrides as ChaptersPromptOverrides, type index_ChaptersPromptSections as ChaptersPromptSections, type index_ChaptersResult as ChaptersResult, type index_ChaptersType as ChaptersType, index_DEFAULT_DESCRIPTION_LENGTH as DEFAULT_DESCRIPTION_LENGTH, index_DEFAULT_SUMMARY_KEYWORD_LIMIT as DEFAULT_SUMMARY_KEYWORD_LIMIT, index_DEFAULT_TITLE_LENGTH as DEFAULT_TITLE_LENGTH, type index_EditCaptionsOptions as EditCaptionsOptions, type index_EditCaptionsResult as EditCaptionsResult, type index_EmbeddingsOptions as EmbeddingsOptions, type index_EmbeddingsResult as EmbeddingsResult, type index_EngagementInsightsOptions as EngagementInsightsOptions, type index_EngagementInsightsResult as EngagementInsightsResult, index_HIVE_SEXUAL_CATEGORIES as HIVE_SEXUAL_CATEGORIES, index_HIVE_VIOLENCE_CATEGORIES as HIVE_VIOLENCE_CATEGORIES, type index_HiveModerationOutput as HiveModerationOutput, type index_HiveModerationSource as HiveModerationSource, type index_ModerationOptions as ModerationOptions, type index_ModerationProvider as ModerationProvider, type index_ModerationResult as ModerationResult, type index_MomentInsight as MomentInsight, type index_OverallInsight as OverallInsight, type index_ProfanityDetectionPayload as ProfanityDetectionPayload, type index_Question as Question, type index_QuestionAnswer as QuestionAnswer, type index_QuestionAnswerType as QuestionAnswerType, type index_ReplacementRecord as ReplacementRecord, type index_SummarizationOptions as SummarizationOptions, type index_SummarizationPromptOverrides as SummarizationPromptOverrides, type index_SummarizationPromptSections as SummarizationPromptSections, type index_SummaryAndTagsResult as SummaryAndTagsResult, type index_SummaryType as SummaryType, type index_ThumbnailModerationScore as ThumbnailModerationScore, type index_TranslationChunkingOptions as TranslationChunkingOptions, type index_TranslationOptions as TranslationOptions, type index_TranslationPayload as TranslationPayload, type index_TranslationResult as TranslationResult, index_aggregateTokenUsage as aggregateTokenUsage, index_applyOverrideLists as applyOverrideLists, index_applyReplacements as applyReplacements, index_askQuestions as askQuestions, index_buildReplacementRegex as buildReplacementRegex, index_burnedInCaptionsSchema as burnedInCaptionsSchema, index_censorVttContent as censorVttContent, index_chapterSchema as chapterSchema, index_chaptersSchema as chaptersSchema, index_createReplacer as createReplacer, index_editCaptions as editCaptions, index_extractTranscriptSegmentsForHotspots as extractTranscriptSegmentsForHotspots, index_generateChapters as generateChapters, index_generateEmbeddings as generateEmbeddings, index_generateEngagementInsights as generateEngagementInsights, index_generateVideoEmbeddings as generateVideoEmbeddings, index_getModerationScores as getModerationScores, index_getSummaryAndTags as getSummaryAndTags, index_hasBurnedInCaptions as hasBurnedInCaptions, index_mapShotsToHotspots as mapShotsToHotspots, index_normalizeTranslatedVtt as normalizeTranslatedVtt, index_profanityDetectionSchema as profanityDetectionSchema, index_questionAnswerSchema as questionAnswerSchema, index_shouldSplitChunkTranslationError as shouldSplitChunkTranslationError, index_summarySchema as summarySchema, index_transformCueText as transformCueText, index_translateAudio as translateAudio, index_translateCaptions as translateCaptions, index_translationSchema as translationSchema };
 }
 
-export { type TranslationResult as $, type AskQuestionsOptions as A, type BurnedInCaptionsAnalysis as B, type CaptionReplacement as C, DEFAULT_DESCRIPTION_LENGTH as D, type EditCaptionsOptions as E, type HiveModerationOutput as F, type HiveModerationSource as G, HIVE_SEXUAL_CATEGORIES as H, type ModerationProvider as I, type ModerationResult as J, type MomentInsight as K, type QuestionAnswer as L, type ModerationOptions as M, type QuestionAnswerType as N, type OverallInsight as O, type ProfanityDetectionPayload as P, type Question as Q, type ReplacementRecord as R, type SummarizationOptions as S, type SummarizationPromptOverrides as T, type SummarizationPromptSections as U, type SummaryAndTagsResult as V, type SummaryType as W, type ThumbnailModerationScore as X, type TranslationChunkingOptions as Y, type TranslationOptions as Z, type TranslationPayload as _, type AskQuestionsResult as a, aggregateTokenUsage as a0, applyOverrideLists as a1, applyReplacements as a2, askQuestions as a3, buildReplacementRegex as a4, burnedInCaptionsSchema as a5, censorVttContent as a6, chapterSchema as a7, chaptersSchema as a8, createReplacer as a9, editCaptions as aa, extractTranscriptSegmentsForHotspots as ab, generateChapters as ac, generateEmbeddings as ad, generateEngagementInsights as ae, generateVideoEmbeddings as af, getModerationScores as ag, getSummaryAndTags as ah, hasBurnedInCaptions as ai, mapShotsToHotspots as aj, profanityDetectionSchema as ak, questionAnswerSchema as al, shouldSplitChunkTranslationError as am, summarySchema as an, transformCueText as ao, translateAudio as ap, translateCaptions as aq, translationSchema as ar, type AskQuestionsType as b, type AudioTranslationOptions as c, type AudioTranslationResult as d, type AutoCensorProfanityOptions as e, type BurnedInCaptionsOptions as f, type BurnedInCaptionsPromptOverrides as g, type BurnedInCaptionsPromptSections as h, index as i, type BurnedInCaptionsResult as j, type CensorMode as k, type Chapter as l, type ChapterSystemPromptSections as m, type ChaptersOptions as n, type ChaptersPromptOverrides as o, type ChaptersPromptSections as p, type ChaptersResult as q, type ChaptersType as r, DEFAULT_SUMMARY_KEYWORD_LIMIT as s, DEFAULT_TITLE_LENGTH as t, type EditCaptionsResult as u, type EmbeddingsOptions as v, type EmbeddingsResult as w, type EngagementInsightsOptions as x, type EngagementInsightsResult as y, HIVE_VIOLENCE_CATEGORIES as z };
+export { type TranslationResult as $, type AskQuestionsOptions as A, type BurnedInCaptionsAnalysis as B, type CaptionReplacement as C, DEFAULT_DESCRIPTION_LENGTH as D, type EditCaptionsOptions as E, type HiveModerationOutput as F, type HiveModerationSource as G, HIVE_SEXUAL_CATEGORIES as H, type ModerationProvider as I, type ModerationResult as J, type MomentInsight as K, type QuestionAnswer as L, type ModerationOptions as M, type QuestionAnswerType as N, type OverallInsight as O, type ProfanityDetectionPayload as P, type Question as Q, type ReplacementRecord as R, type SummarizationOptions as S, type SummarizationPromptOverrides as T, type SummarizationPromptSections as U, type SummaryAndTagsResult as V, type SummaryType as W, type ThumbnailModerationScore as X, type TranslationChunkingOptions as Y, type TranslationOptions as Z, type TranslationPayload as _, type AskQuestionsResult as a, aggregateTokenUsage as a0, applyOverrideLists as a1, applyReplacements as a2, askQuestions as a3, buildReplacementRegex as a4, burnedInCaptionsSchema as a5, censorVttContent as a6, chapterSchema as a7, chaptersSchema as a8, createReplacer as a9, editCaptions as aa, extractTranscriptSegmentsForHotspots as ab, generateChapters as ac, generateEmbeddings as ad, generateEngagementInsights as ae, generateVideoEmbeddings as af, getModerationScores as ag, getSummaryAndTags as ah, hasBurnedInCaptions as ai, mapShotsToHotspots as aj, normalizeTranslatedVtt as ak, profanityDetectionSchema as al, questionAnswerSchema as am, shouldSplitChunkTranslationError as an, summarySchema as ao, transformCueText as ap, translateAudio as aq, translateCaptions as ar, translationSchema as as, type AskQuestionsType as b, type AudioTranslationOptions as c, type AudioTranslationResult as d, type AutoCensorProfanityOptions as e, type BurnedInCaptionsOptions as f, type BurnedInCaptionsPromptOverrides as g, type BurnedInCaptionsPromptSections as h, index as i, type BurnedInCaptionsResult as j, type CensorMode as k, type Chapter as l, type ChapterSystemPromptSections as m, type ChaptersOptions as n, type ChaptersPromptOverrides as o, type ChaptersPromptSections as p, type ChaptersResult as q, type ChaptersType as r, DEFAULT_SUMMARY_KEYWORD_LIMIT as s, DEFAULT_TITLE_LENGTH as t, type EditCaptionsResult as u, type EmbeddingsOptions as v, type EmbeddingsResult as w, type EngagementInsightsOptions as x, type EngagementInsightsResult as y, HIVE_VIOLENCE_CATEGORIES as z };

package/dist/{index-3G00N5QH.d.ts → index-Drj9Cy_k.d.ts}

@@ -106,6 +106,76 @@ declare const LOW_CONFIDENCE_THRESHOLD = 0.5;
  * @param confidenceThreshold - Minimum confidence to trust auto-detected language (default: {@link LOW_CONFIDENCE_THRESHOLD})
  */
 declare function getReliableLanguageCode(track: AssetTextTrack | undefined, confidenceThreshold?: number): string | undefined;
+/**
+ * Sanitise untrusted text (typically a VTT cue or joined transcript)
+ * before it is interpolated into a prompt. Thin wrapper around the
+ * shared {@link normalizeUntrustedUnicode} helper, with a null/empty
+ * guard for convenience.
+ */
+declare function sanitizeUntrustedText(value: string): string;
+/**
+ * Upper bound on individual cue text length before we consider the cue
+ * adversarial and truncate it.
+ *
+ * Legitimate captions are short — a long monologue cue rarely exceeds
+ * 500 characters, and most captioning standards recommend well under
+ * that for readability. We set the cap at 2000 to give comfortable
+ * headroom for edge cases (stage directions, speaker identification,
+ * multi-line blocks) while making "hide a multi-kilobyte injection
+ * payload inside a single cue" mechanically infeasible.
+ */
+declare const MAX_CUE_TEXT_CHARS = 2000;
+/**
+ * Strip VTT metadata blocks that are never rendered by players but can
+ * still carry text through to an LLM when the raw VTT is used in a prompt:
+ *
+ * - NOTE blocks (VTT comments)
+ * - STYLE blocks (CSS for cue styling)
+ * - REGION blocks (positioning definitions)
+ *
+ * Viewers never see the contents of these blocks. That makes them an
+ * ideal hiding spot for prompt-injection payloads — an attacker-controlled
+ * caption file can carry hundreds of bytes of "NOTE ignore previous
+ * instructions…" that will be stripped from any player but will reach the
+ * model if the raw VTT is passed through. Removing them before sending
+ * the VTT to the model closes that channel without changing what the
+ * model sees for legitimate cue content.
+ *
+ * Cue identifiers, timing lines, and cue payload text are preserved.
+ * In particular: a cue whose first payload line happens to start with
+ * `NOTE `/`STYLE `/`REGION ` (plausible in legitimate captions — e.g.
+ * `"NOTE THAT..."`, `"STYLE GUIDE"`, `"NOTE how the villain plots..."`)
+ * is NOT treated as a metadata block. The scanner tracks cue-payload
+ * state: metadata headers are only recognised between cues (i.e. when
+ * the previous non-blank line was not a timing line).
+ *
+ * Example input:
+ *
+ *     WEBVTT
+ *
+ *     NOTE This is a comment with hidden instructions
+ *     that span multiple lines until a blank line appears.
+ *
+ *     STYLE
+ *     ::cue(b) { font-weight: bold; }
+ *
+ *     00:00:01.000 --> 00:00:04.000
+ *     Legitimate caption text
+ *
+ *     00:00:05.000 --> 00:00:08.000
+ *     NOTE THAT the hero wins
+ *
+ * Returns:
+ *
+ *     WEBVTT
+ *
+ *     00:00:01.000 --> 00:00:04.000
+ *     Legitimate caption text
+ *
+ *     00:00:05.000 --> 00:00:08.000
+ *     NOTE THAT the hero wins
+ */
+declare function stripVttMetadataBlocks(vttContent: string): string;
 declare function extractTextFromVTT(vttContent: string): string;
 declare function vttTimestampToSeconds(timestamp: string): number;
 /**
@@ -247,6 +317,7 @@ declare const index_Hotspot: typeof Hotspot;
 declare const index_HotspotOptions: typeof HotspotOptions;
 declare const index_HotspotResponse: typeof HotspotResponse;
 declare const index_LOW_CONFIDENCE_THRESHOLD: typeof LOW_CONFIDENCE_THRESHOLD;
+declare const index_MAX_CUE_TEXT_CHARS: typeof MAX_CUE_TEXT_CHARS;
 declare const index_PendingShotsResult: typeof PendingShotsResult;
 declare const index_Shot: typeof Shot;
 declare const index_ShotRequestOptions: typeof ShotRequestOptions;
@@ -287,12 +358,14 @@ declare const index_getThumbnailUrls: typeof getThumbnailUrls;
 declare const index_parseVTTCues: typeof parseVTTCues;
 declare const index_replaceCueText: typeof replaceCueText;
 declare const index_requestShotsForAsset: typeof requestShotsForAsset;
+declare const index_sanitizeUntrustedText: typeof sanitizeUntrustedText;
 declare const index_secondsToTimestamp: typeof secondsToTimestamp;
 declare const index_splitVttPreambleAndCueBlocks: typeof splitVttPreambleAndCueBlocks;
+declare const index_stripVttMetadataBlocks: typeof stripVttMetadataBlocks;
 declare const index_vttTimestampToSeconds: typeof vttTimestampToSeconds;
 declare const index_waitForShotsForAsset: typeof waitForShotsForAsset;
 declare namespace index {
-  export { index_CompletedShotsResult as CompletedShotsResult, index_DEFAULT_STORYBOARD_WIDTH as DEFAULT_STORYBOARD_WIDTH, index_ErroredShotsResult as ErroredShotsResult, type index_HeatmapOptions as HeatmapOptions, type index_HeatmapResponse as HeatmapResponse, index_Hotspot as Hotspot, index_HotspotOptions as HotspotOptions, index_HotspotResponse as HotspotResponse, index_LOW_CONFIDENCE_THRESHOLD as LOW_CONFIDENCE_THRESHOLD, index_PendingShotsResult as PendingShotsResult, index_Shot as Shot, index_ShotRequestOptions as ShotRequestOptions, index_ShotsResult as ShotsResult, type index_ThumbnailOptions as ThumbnailOptions, type index_TranscriptFetchOptions as TranscriptFetchOptions, type index_TranscriptResult as TranscriptResult, type index_VTTCue as VTTCue, type index_VTTCueBudgetChunkingOptions as VTTCueBudgetChunkingOptions, type index_VTTDurationChunk as VTTDurationChunk, type index_VTTDurationChunkingOptions as VTTDurationChunkingOptions, index_WaitForShotsOptions as WaitForShotsOptions, index_buildTranscriptUrl as buildTranscriptUrl, index_buildVttFromCueBlocks as buildVttFromCueBlocks, index_buildVttFromTranslatedCueBlocks as buildVttFromTranslatedCueBlocks, index_chunkByTokens as chunkByTokens, index_chunkText as chunkText, index_chunkVTTCues as chunkVTTCues, index_chunkVTTCuesByBudget as chunkVTTCuesByBudget, index_chunkVTTCuesByDuration as chunkVTTCuesByDuration, index_concatenateVttSegments as concatenateVttSegments, index_estimateTokenCount as estimateTokenCount, index_extractTextFromVTT as extractTextFromVTT, index_extractTimestampedTranscript as extractTimestampedTranscript, index_fetchTranscriptForAsset as fetchTranscriptForAsset, index_findCaptionTrack as findCaptionTrack, index_getHeatmapForAsset as getHeatmapForAsset, index_getHeatmapForPlaybackId as getHeatmapForPlaybackId, index_getHeatmapForVideo as getHeatmapForVideo, index_getHotspotsForAsset as getHotspotsForAsset, index_getHotspotsForPlaybackId as getHotspotsForPlaybackId, index_getHotspotsForVideo as getHotspotsForVideo, index_getReadyTextTracks as getReadyTextTracks, index_getReliableLanguageCode as getReliableLanguageCode, index_getShotsForAsset as getShotsForAsset, index_getStoryboardUrl as getStoryboardUrl, index_getThumbnailUrls as getThumbnailUrls, index_parseVTTCues as parseVTTCues, index_replaceCueText as replaceCueText, index_requestShotsForAsset as requestShotsForAsset, index_secondsToTimestamp as secondsToTimestamp, index_splitVttPreambleAndCueBlocks as splitVttPreambleAndCueBlocks, index_vttTimestampToSeconds as vttTimestampToSeconds, index_waitForShotsForAsset as waitForShotsForAsset };
+  export { index_CompletedShotsResult as CompletedShotsResult, index_DEFAULT_STORYBOARD_WIDTH as DEFAULT_STORYBOARD_WIDTH, index_ErroredShotsResult as ErroredShotsResult, type index_HeatmapOptions as HeatmapOptions, type index_HeatmapResponse as HeatmapResponse, index_Hotspot as Hotspot, index_HotspotOptions as HotspotOptions, index_HotspotResponse as HotspotResponse, index_LOW_CONFIDENCE_THRESHOLD as LOW_CONFIDENCE_THRESHOLD, index_MAX_CUE_TEXT_CHARS as MAX_CUE_TEXT_CHARS, index_PendingShotsResult as PendingShotsResult, index_Shot as Shot, index_ShotRequestOptions as ShotRequestOptions, index_ShotsResult as ShotsResult, type index_ThumbnailOptions as ThumbnailOptions, type index_TranscriptFetchOptions as TranscriptFetchOptions, type index_TranscriptResult as TranscriptResult, type index_VTTCue as VTTCue, type index_VTTCueBudgetChunkingOptions as VTTCueBudgetChunkingOptions, type index_VTTDurationChunk as VTTDurationChunk, type index_VTTDurationChunkingOptions as VTTDurationChunkingOptions, index_WaitForShotsOptions as WaitForShotsOptions, index_buildTranscriptUrl as buildTranscriptUrl, index_buildVttFromCueBlocks as buildVttFromCueBlocks, index_buildVttFromTranslatedCueBlocks as buildVttFromTranslatedCueBlocks, index_chunkByTokens as chunkByTokens, index_chunkText as chunkText, index_chunkVTTCues as chunkVTTCues, index_chunkVTTCuesByBudget as chunkVTTCuesByBudget, index_chunkVTTCuesByDuration as chunkVTTCuesByDuration, index_concatenateVttSegments as concatenateVttSegments, index_estimateTokenCount as estimateTokenCount, index_extractTextFromVTT as extractTextFromVTT, index_extractTimestampedTranscript as extractTimestampedTranscript, index_fetchTranscriptForAsset as fetchTranscriptForAsset, index_findCaptionTrack as findCaptionTrack, index_getHeatmapForAsset as getHeatmapForAsset, index_getHeatmapForPlaybackId as getHeatmapForPlaybackId, index_getHeatmapForVideo as getHeatmapForVideo, index_getHotspotsForAsset as getHotspotsForAsset, index_getHotspotsForPlaybackId as getHotspotsForPlaybackId, index_getHotspotsForVideo as getHotspotsForVideo, index_getReadyTextTracks as getReadyTextTracks, index_getReliableLanguageCode as getReliableLanguageCode, index_getShotsForAsset as getShotsForAsset, index_getStoryboardUrl as getStoryboardUrl, index_getThumbnailUrls as getThumbnailUrls, index_parseVTTCues as parseVTTCues, index_replaceCueText as replaceCueText, index_requestShotsForAsset as requestShotsForAsset, index_sanitizeUntrustedText as sanitizeUntrustedText, index_secondsToTimestamp as secondsToTimestamp, index_splitVttPreambleAndCueBlocks as splitVttPreambleAndCueBlocks, index_stripVttMetadataBlocks as stripVttMetadataBlocks, index_vttTimestampToSeconds as vttTimestampToSeconds, index_waitForShotsForAsset as waitForShotsForAsset };
 }
 
-export { getStoryboardUrl as A, getThumbnailUrls as B, parseVTTCues as C, DEFAULT_STORYBOARD_WIDTH as D, replaceCueText as E, secondsToTimestamp as F, splitVttPreambleAndCueBlocks as G, type HeatmapOptions as H, vttTimestampToSeconds as I, LOW_CONFIDENCE_THRESHOLD as L, type ThumbnailOptions as T, type VTTCue as V, type HeatmapResponse as a, type TranscriptFetchOptions as b, type TranscriptResult as c, type VTTCueBudgetChunkingOptions as d, type VTTDurationChunk as e, type VTTDurationChunkingOptions as f, buildTranscriptUrl as g, buildVttFromCueBlocks as h, index as i, buildVttFromTranslatedCueBlocks as j, chunkByTokens as k, chunkText as l, chunkVTTCues as m, chunkVTTCuesByBudget as n, chunkVTTCuesByDuration as o, concatenateVttSegments as p, estimateTokenCount as q, extractTextFromVTT as r, extractTimestampedTranscript as s, fetchTranscriptForAsset as t, findCaptionTrack as u, getHeatmapForAsset as v, getHeatmapForPlaybackId as w, getHeatmapForVideo as x, getReadyTextTracks as y, getReliableLanguageCode as z };
+export { getStoryboardUrl as A, getThumbnailUrls as B, parseVTTCues as C, DEFAULT_STORYBOARD_WIDTH as D, replaceCueText as E, sanitizeUntrustedText as F, secondsToTimestamp as G, type HeatmapOptions as H, splitVttPreambleAndCueBlocks as I, stripVttMetadataBlocks as J, vttTimestampToSeconds as K, LOW_CONFIDENCE_THRESHOLD as L, MAX_CUE_TEXT_CHARS as M, type ThumbnailOptions as T, type VTTCue as V, type HeatmapResponse as a, type TranscriptFetchOptions as b, type TranscriptResult as c, type VTTCueBudgetChunkingOptions as d, type VTTDurationChunk as e, type VTTDurationChunkingOptions as f, buildTranscriptUrl as g, buildVttFromCueBlocks as h, index as i, buildVttFromTranslatedCueBlocks as j, chunkByTokens as k, chunkText as l, chunkVTTCues as m, chunkVTTCuesByBudget as n, chunkVTTCuesByDuration as o, concatenateVttSegments as p, estimateTokenCount as q, extractTextFromVTT as r, extractTimestampedTranscript as s, fetchTranscriptForAsset as t, findCaptionTrack as u, getHeatmapForAsset as v, getHeatmapForPlaybackId as w, getHeatmapForVideo as x, getReadyTextTracks as y, getReliableLanguageCode as z };

package/dist/index.d.ts

@@ -1,15 +1,15 @@
 import { W as WorkflowCredentials, S as StoragePutObjectInput, a as StoragePresignGetObjectInput } from './shots-BFYOfBgN.js';
 export { A as AssetTextTrack, C as ChunkEmbedding, b as ChunkingStrategy, E as Encrypted, c as EncryptedPayload, I as ImageSubmissionMode, M as MuxAIOptions, d as MuxAsset, P as PlaybackAsset, e as PlaybackPolicy, f as StorageAdapter, T as TextChunk, g as TokenChunkingConfig, h as TokenUsage, i as ToneType, U as UsageMetadata, V as VTTChunkingConfig, j as VideoEmbeddingsResult, k as WorkflowCredentialsInput, l as WorkflowMuxClient, m as decryptFromWorkflow, n as encryptForWorkflow } from './shots-BFYOfBgN.js';
 import { WORKFLOW_SERIALIZE, WORKFLOW_DESERIALIZE } from '@workflow/serde';
-export { i as primitives } from './index-3G00N5QH.js';
-export { i as workflows } from './index-BfsJvx3r.js';
+export { i as primitives } from './index-Drj9Cy_k.js';
+export { i as workflows } from './index-BjwbvdoQ.js';
 import '@mux/mux-node';
 import 'zod';
 import '@ai-sdk/anthropic';
 import '@ai-sdk/google';
 import '@ai-sdk/openai';
 
-var version = "0.17.1";
+var version = "0.18.0";
 
 type MuxAiErrorType = "validation_error" | "processing_error" | "timeout_error";
 /**
@@ -45,6 +45,25 @@ declare class MuxAiError extends Error {
  *
  * Use this in catch blocks that re-throw so a customer-safe error from a
  * callee isn't accidentally converted into an internal error.
+ *
+ * The upstream `detail` is scrubbed for **high-confidence** signs of a
+ * system-prompt leak before being folded into the thrown message.
+ * Rationale: the AI SDK and some providers include the offending model
+ * output in their error messages (e.g. "Failed to parse structured
+ * output: { reasoning: '<role>…' }"). If an injection payload caused
+ * the parse failure, the raw output would otherwise bypass the
+ * free-text scrubber and reach the caller through the error channel.
+ *
+ * Only the `canary` and `prompt_tag` detectors trigger suppression
+ * here — they have very low false-positive rates. The `encoded_blob`
+ * heuristic is intentionally NOT applied to error messages: legitimate
+ * upstream errors from infrastructure (S3 errors containing ETags,
+ * git errors containing SHAs, AWS request IDs, content hashes) can
+ * match the encoded-blob shape without being a prompt leak. Suppressing
+ * those would erase useful debugging information with no security
+ * benefit, because an attacker exfiltrating through a shaped blob would
+ * trigger the much stronger field-level scrubber on the preceding
+ * model output.
  */
 declare function wrapError(error: unknown, message: string): never;