@skillsmith/core 0.11.3 → 0.11.4

package/dist/src/security/scanner/SecurityScanner.ssrf.js

@@ -4,24 +4,35 @@
  * Detects SSRF instructions in skill content.
  * Extracted from SecurityScanner to keep file sizes under 500 lines.
  */
-import { analyzeMarkdownContext, isDocumentationContext, isWithinInlineCode, isMultilinePattern, } from './SecurityScanner.helpers.js';
+import { analyzeMarkdownContext, isDocumentationContext, isWithinInlineCode, } from './SecurityScanner.helpers.js';
 import { SSRF_INSTRUCTION_PATTERNS } from './patterns.js';
+import { resolvePatternScope } from './patterns.scope.js';
 import { safeRegexTest } from './regex-utils.js';
 /**
  * Scan content for SSRF instruction patterns.
  * Uses documentation context to reduce severity for patterns in code blocks/tables.
  * SMI-3522: Supports multi-line patterns via scanPatternsWithMultilineSupport approach.
+ *
+ * SMI-5881: uses PATTERN_SCOPE (patterns.scope.ts) instead of the old
+ * per-source-text multiline-detection heuristic. This function's older
+ * skip-based two-pass (flaggedLines) can only correctly service
+ * 'line' | 'content' scope, never 'both' — assertScopeCoverage()
+ * (patterns.scope.ts) enforces at module-load time that no
+ * SSRF_INSTRUCTION_PATTERNS member is ever scoped 'both'.
  */
-export function scanSsrfPatterns(content, lineContexts) {
+export function scanSsrfPatterns(content, lineContexts, 
+/** SMI-5881: explicit cap (UTF-16 code units) for the pass-1 full-content
+ * regex scan — see scanPatternsWithMultilineSupport's identical parameter. */
+maxLength) {
     const findings = [];
     const lines = content.split('\n');
     const contexts = lineContexts ?? analyzeMarkdownContext(content);
     const flaggedLines = new Set();
-    // SMI-3522: First pass — multi-line SSRF patterns against full content
+    // SMI-3522: First pass — 'content'-scope SSRF patterns against full content
     for (const pattern of SSRF_INSTRUCTION_PATTERNS) {
-        if (!isMultilinePattern(pattern))
+        if (resolvePatternScope(pattern) === 'line')
             continue;
-        const match = safeRegexTest(pattern, content);
+        const match = safeRegexTest(pattern, content, maxLength);
         if (match) {
             const matchIndex = content.indexOf(match[0]);
             const lineNumber = content.slice(0, matchIndex).split('\n').length;
@@ -43,13 +54,13 @@ export function scanSsrfPatterns(content, lineContexts) {
             flaggedLines.add(lineNumber);
         }
     }
-    // Second pass — single-line SSRF patterns per-line
+    // Second pass — 'line'-scope SSRF patterns, per-line
     lines.forEach((line, index) => {
         if (flaggedLines.has(index + 1))
             return;
         const ctx = contexts[index];
         for (const pattern of SSRF_INSTRUCTION_PATTERNS) {
-            if (isMultilinePattern(pattern))
+            if (resolvePatternScope(pattern) === 'content')
                 continue;
             const match = safeRegexTest(pattern, line);
             if (match) {

package/dist/src/security/scanner/SecurityScanner.ssrf.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.ssrf.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.ssrf.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAA;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAEhD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,YAA4B;IAC5E,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAChE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAA;IAEtC,uEAAuE;IACvE,KAAK,MAAM,OAAO,IAAI,yBAAyB,EAAE,CAAC;QAChD,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;YAAE,SAAQ;QAC1C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC7C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;YAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAA;YAClE,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC,CAAA;YACpC,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;YAC9D,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;YACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;YACjD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAEvC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,MAAM;gBACZ,QAAQ;gBACR,OAAO,EAAE,uCAAuC,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG;gBAChG,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBACvC,UAAU;gBACV,QAAQ,EAAE,MAAM;gBAChB,sBAAsB,EAAE,YAAY;gBACpC,UAAU;aACX,CAAC,CAAA;YACF,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC;YAAE,OAAM;QACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,yBAAyB,EAAE,CAAC;YAChD,IAAI,kBAAkB,CAAC,OAAO,CAAC;gBAAE,SAAQ;YACzC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;gBAEjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,MAAM;oBACZ,QAAQ;oBACR,OAAO,EAAE,uCAAuC,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC3D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,MAAM;oBAChB,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC"}
+{"version":3,"file":"SecurityScanner.ssrf.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.ssrf.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAA;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAEhD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAe,EACf,YAA4B;AAC5B;8EAC8E;AAC9E,SAAkB;IAElB,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAChE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAA;IAEtC,4EAA4E;IAC5E,KAAK,MAAM,OAAO,IAAI,yBAAyB,EAAE,CAAC;QAChD,IAAI,mBAAmB,CAAC,OAAO,CAAC,KAAK,MAAM;YAAE,SAAQ;QACrD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;QACxD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;YAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAA;YAClE,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC,CAAA;YACpC,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;YAC9D,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;YACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;YACjD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAEvC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,MAAM;gBACZ,QAAQ;gBACR,OAAO,EAAE,uCAAuC,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG;gBAChG,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBACvC,UAAU;gBACV,QAAQ,EAAE,MAAM;gBAChB,sBAAsB,EAAE,YAAY;gBACpC,UAAU;aACX,CAAC,CAAA;YACF,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC;YAAE,OAAM;QACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,yBAAyB,EAAE,CAAC;YAChD,IAAI,mBAAmB,CAAC,OAAO,CAAC,KAAK,SAAS;gBAAE,SAAQ;YACxD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;gBAEjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,MAAM;oBACZ,QAAQ;oBACR,OAAO,EAAE,uCAAuC,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC3D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,MAAM;oBAChB,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/src/security/scanner/index.d.ts

@@ -3,10 +3,10 @@
  *
  * Re-exports for security scanning functionality.
  */
-export type { SecurityFindingType, SecuritySeverity, SecurityFinding, RiskScoreBreakdown, ScanReport, ScannerOptions, HostileUpdateVerdict, TyposquatEnforcementMode, } from './types.js';
-export { DEFAULT_ALLOWED_DOMAINS, SENSITIVE_PATH_PATTERNS, JAILBREAK_PATTERNS, SUSPICIOUS_PATTERNS, SOCIAL_ENGINEERING_PATTERNS, PROMPT_LEAKING_PATTERNS, DATA_EXFILTRATION_PATTERNS, PRIVILEGE_ESCALATION_PATTERNS, AI_DEFENCE_PATTERNS, SSRF_INSTRUCTION_PATTERNS, PII_PATTERNS, CODE_EXECUTION_PATTERNS, } from './patterns.js';
+export type { SecurityFindingType, SecuritySeverity, SecurityFinding, RiskScoreBreakdown, ScanReport, ScannerOptions, HostileUpdateVerdict, TyposquatEnforcementMode, EvidenceType, } from './types.js';
+export { DEFAULT_ALLOWED_DOMAINS, SENSITIVE_PATH_PATTERNS, JAILBREAK_PATTERNS, SUSPICIOUS_PATTERNS, SOCIAL_ENGINEERING_PATTERNS, PROMPT_LEAKING_PATTERNS, DATA_EXFILTRATION_PATTERNS, PRIVILEGE_ESCALATION_PATTERNS, AI_DEFENCE_PATTERNS, SSRF_INSTRUCTION_PATTERNS, PII_PATTERNS, CODE_EXECUTION_PATTERNS, SCANNER_RULESET_VERSION, } from './patterns.js';
 export { SEVERITY_WEIGHTS, CATEGORY_WEIGHTS } from './weights.js';
-export { MAX_LINE_LENGTH_FOR_REGEX, safeRegexTest, safeRegexCheck } from './regex-utils.js';
+export { MAX_LINE_LENGTH_FOR_REGEX, MAX_CONTENT_LENGTH_FOR_REGEX, safeRegexTest, safeRegexCheck, } from './regex-utils.js';
 export { stripInvisible } from './SecurityScanner.exec.js';
 export { CONFUSABLES, isFullwidthLatin, isMathAlphanumeric, confusableSkeleton, } from './confusables.js';
 export { BRAND_ALIASES, levenshteinDistance, scanTyposquat, detectTyposquat, applyTyposquatEnforcementMode, resolveTyposquatEnforcementMode, DEFAULT_TYPOSQUAT_ENFORCEMENT_MODE, } from './typosquat.js';

package/dist/src/security/scanner/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,YAAY,CAAA;AAGnB,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,mBAAmB,EACnB,yBAAyB,EACzB,YAAY,EACZ,uBAAuB,GACxB,MAAM,eAAe,CAAA;AAGtB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAGjE,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAK3F,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAI1D,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,6BAA6B,EAC7B,+BAA+B,EAC/B,kCAAkC,GACnC,MAAM,gBAAgB,CAAA;AAGvB,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,+BAA+B,CAAA;AACtC,YAAY,EACV,mBAAmB,EACnB,mBAAmB,EACnB,kCAAkC,GACnC,MAAM,+BAA+B,CAAA;AAGtC,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AAGjE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAG/D,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,wBAAwB,EAExB,YAAY,GACb,MAAM,YAAY,CAAA;AAGnB,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,mBAAmB,EACnB,yBAAyB,EACzB,YAAY,EACZ,uBAAuB,EAGvB,uBAAuB,GACxB,MAAM,eAAe,CAAA;AAGtB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAGjE,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,aAAa,EACb,cAAc,GACf,MAAM,kBAAkB,CAAA;AAKzB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAI1D,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,6BAA6B,EAC7B,+BAA+B,EAC/B,kCAAkC,GACnC,MAAM,gBAAgB,CAAA;AAGvB,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,+BAA+B,CAAA;AACtC,YAAY,EACV,mBAAmB,EACnB,mBAAmB,EACnB,kCAAkC,GACnC,MAAM,+BAA+B,CAAA;AAGtC,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AAGjE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAG/D,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAA"}

package/dist/src/security/scanner/index.js

@@ -4,11 +4,14 @@
  * Re-exports for security scanning functionality.
  */
 // Patterns (for testing/extending)
-export { DEFAULT_ALLOWED_DOMAINS, SENSITIVE_PATH_PATTERNS, JAILBREAK_PATTERNS, SUSPICIOUS_PATTERNS, SOCIAL_ENGINEERING_PATTERNS, PROMPT_LEAKING_PATTERNS, DATA_EXFILTRATION_PATTERNS, PRIVILEGE_ESCALATION_PATTERNS, AI_DEFENCE_PATTERNS, SSRF_INSTRUCTION_PATTERNS, PII_PATTERNS, CODE_EXECUTION_PATTERNS, } from './patterns.js';
+export { DEFAULT_ALLOWED_DOMAINS, SENSITIVE_PATH_PATTERNS, JAILBREAK_PATTERNS, SUSPICIOUS_PATTERNS, SOCIAL_ENGINEERING_PATTERNS, PROMPT_LEAKING_PATTERNS, DATA_EXFILTRATION_PATTERNS, PRIVILEGE_ESCALATION_PATTERNS, AI_DEFENCE_PATTERNS, SSRF_INSTRUCTION_PATTERNS, PII_PATTERNS, CODE_EXECUTION_PATTERNS, 
+// SMI-5876: ruleset version stamp, consumed by the security-audit baseline
+// to force a re-scan when the pattern/evidence-tier definitions change.
+SCANNER_RULESET_VERSION, } from './patterns.js';
 // Weights (for testing/extending)
 export { SEVERITY_WEIGHTS, CATEGORY_WEIGHTS } from './weights.js';
 // Regex utilities (for testing/extending)
-export { MAX_LINE_LENGTH_FOR_REGEX, safeRegexTest, safeRegexCheck } from './regex-utils.js';
+export { MAX_LINE_LENGTH_FOR_REGEX, MAX_CONTENT_LENGTH_FOR_REGEX, safeRegexTest, safeRegexCheck, } from './regex-utils.js';
 // Obfuscation-defeat primitive (SMI-4703: reused by
 // packages/doc-retrieval-mcp/src/security/memory-injection-scanner.ts's
 // normalization pipeline rather than reimplemented there)

package/dist/src/security/scanner/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/security/scanner/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAcH,mCAAmC;AACnC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,mBAAmB,EACnB,yBAAyB,EACzB,YAAY,EACZ,uBAAuB,GACxB,MAAM,eAAe,CAAA;AAEtB,kCAAkC;AAClC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAEjE,0CAA0C;AAC1C,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAE3F,oDAAoD;AACpD,wEAAwE;AACxE,0DAA0D;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAE1D,4FAA4F;AAC5F,8EAA8E;AAC9E,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AAEzB,+BAA+B;AAC/B,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,6BAA6B,EAC7B,+BAA+B,EAC/B,kCAAkC,GACnC,MAAM,gBAAgB,CAAA;AAEvB,kDAAkD;AAClD,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,+BAA+B,CAAA;AAOtC,mDAAmD;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AAEjE,aAAa;AACb,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAE/D,mDAAmD;AACnD,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/security/scanner/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAgBH,mCAAmC;AACnC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,mBAAmB,EACnB,yBAAyB,EACzB,YAAY,EACZ,uBAAuB;AACvB,2EAA2E;AAC3E,wEAAwE;AACxE,uBAAuB,GACxB,MAAM,eAAe,CAAA;AAEtB,kCAAkC;AAClC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAEjE,0CAA0C;AAC1C,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,aAAa,EACb,cAAc,GACf,MAAM,kBAAkB,CAAA;AAEzB,oDAAoD;AACpD,wEAAwE;AACxE,0DAA0D;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAE1D,4FAA4F;AAC5F,8EAA8E;AAC9E,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AAEzB,+BAA+B;AAC/B,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,6BAA6B,EAC7B,+BAA+B,EAC/B,kCAAkC,GACnC,MAAM,gBAAgB,CAAA;AAEvB,kDAAkD;AAClD,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,+BAA+B,CAAA;AAOtC,mDAAmD;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AAEjE,aAAa;AACb,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAE/D,mDAAmD;AACnD,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAA"}

package/dist/src/security/scanner/patterns.d.ts

@@ -7,7 +7,34 @@ export declare const DEFAULT_ALLOWED_DOMAINS: string[];
 export declare const ENV_PATH_PATTERN: RegExp;
 export declare const SENSITIVE_PATH_PATTERNS: RegExp[];
 export declare const VALUE_GATED_KEYWORD_PATTERNS: ReadonlySet<RegExp>;
-export declare const JAILBREAK_PATTERNS: RegExp[];
+export { JAILBREAK_PATTERNS, AI_DEFENCE_PATTERNS } from './patterns.jailbreak.js';
+export { EVIDENCE_TYPE_BY_PATTERN } from './patterns.jailbreak.evidence.js';
+/**
+ * SMI-5876 §0.1/§0.2: bump on ANY pattern-array or evidence-table change in
+ * this module or patterns.jailbreak.ts. The security-audit baseline
+ * (packages/mcp-server/src/audit/security-baseline.ts /
+ * security-audit.ts) stamps every stored entry with the version that
+ * produced it and treats a mismatch as "not comparable" — forcing a re-scan
+ * instead of silently reusing a stale verdict from a scanner that no longer
+ * exists. Without this, the pattern/evidence-tier fix could not clear an
+ * already-flagged skill's stale `malicious` baseline on any machine that had
+ * scanned it before (see the security-audit.ts `comparable` gate).
+ *
+ * Bumped to `.2`: SMI-5876 design-pass follow-up added the `state_assertion`
+ * evidence tier + 5 new JAILBREAK_PATTERNS entries (J-S1/S2/S3a/S3b/S4) and
+ * widened #6 (bypass) + J-N1 in place — this is precisely the
+ * previously-clean-content-now-fires scenario the ruleset-version gate
+ * exists for.
+ *
+ * Bumped to `2026-07-29.1`: SMI-5881 P0 — AD_CRLF_INJECTION's source changed
+ * (ReDoS fix, same match language, see patterns.jailbreak.ts) and 4
+ * AI_DEFENCE_PATTERNS entries were promoted from 'line' to 'both' scope
+ * (AD_HTML_COMMENT_VERB/NOUN, AD_NESTED_INSTRUCTION_BLOCK, AD_ZERO_WIDTH — new
+ * cross-line matches now possible where none fired before), plus SSRF_
+ * INSTRUCTION_PATTERNS word-boundary narrowing (some previously-firing
+ * substring FPs, e.g. "budget to localhost", no longer match).
+ */
+export declare const SCANNER_RULESET_VERSION: "2026-07-29.1";
 export declare const SUSPICIOUS_PATTERNS: RegExp[];
 /**
  * SMI-5359 Wave 4.2: Remote-fetch-to-interpreter ("code_execution") patterns.
@@ -33,30 +60,30 @@ export declare const CODE_EXECUTION_PATTERNS: RegExp[];
 export declare const SOCIAL_ENGINEERING_PATTERNS: RegExp[];
 export declare const PROMPT_LEAKING_PATTERNS: RegExp[];
 export declare const DATA_EXFILTRATION_PATTERNS: RegExp[];
+export declare const CREDENTIAL_SUBSTITUTION_PATTERNS: RegExp[];
 export declare const PRIVILEGE_ESCALATION_PATTERNS: RegExp[];
 /**
  * SMI-3509: SSRF instruction patterns
  * Detects content instructing fetches to internal/dangerous endpoints.
  * These are text-oriented patterns for skill content scanning (not URL validators).
- */
-export declare const SSRF_INSTRUCTION_PATTERNS: RegExp[];
-/**
- * SMI-1532: AIDefence CVE-hardened injection patterns
- * Optimized for sub-10ms scan time with compiled regex and no backtracking
  *
- * These patterns detect sophisticated prompt injection attacks based on
- * known CVEs and security research findings.
- *
- * References:
- * - OWASP LLM Top 10: LLM01 Prompt Injection
- * - Anthropic Responsible Disclosure Program findings
- * - Academic research on prompt injection attacks
+ * SMI-5881: leading `\b` added to every verb alternation below — the verbs
+ * (fetch/request/curl/wget/get/open/load/read/connect/send) previously had no
+ * boundary, so they matched as a SUBSTRING of an unrelated word ("get" inside
+ * "budget"/"target"/"forget"/"widget", "connect" inside "disconnect", "load"
+ * inside "download"/"reload", "open" inside "reopen", "read" inside
+ * "bread"/"spread"/"thread"). A trailing `\b` was also added after the bare
+ * `localhost` literal (both the single-line and multiline forms) so
+ * "localhosting" no longer matches via a "localhost" prefix. Every existing
+ * `\s` quantifier is unchanged — replacing them with newline-exclusive classes
+ * was tried and reverted (breaks a verb+target split across a real line
+ * break, a real evasion). See scanner-ssrf-word-boundary.test.ts.
  */
+export declare const SSRF_INSTRUCTION_PATTERNS: RegExp[];
 /**
  * SMI-3864: PII detection patterns
  * Detects personally identifiable information and credentials in skill content.
  * Complements AIDefence's aidefence_has_pii() for offline/local scanning.
  */
 export declare const PII_PATTERNS: RegExp[];
-export declare const AI_DEFENCE_PATTERNS: RegExp[];
 //# sourceMappingURL=patterns.d.ts.map

package/dist/src/security/scanner/patterns.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/patterns.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,eAAO,MAAM,uBAAuB,UAanC,CAAA;AA4BD,eAAO,MAAM,gBAAgB,QAAoE,CAAA;AAMjG,eAAO,MAAM,uBAAuB,UAsBnC,CAAA;AAID,eAAO,MAAM,4BAA4B,EAAE,WAAW,CAAC,MAAM,CAG3D,CAAA;AAGF,eAAO,MAAM,kBAAkB,UAkB9B,CAAA;AAGD,eAAO,MAAM,mBAAmB,UAY/B,CAAA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,uBAAuB,UAmBnC,CAAA;AAGD,eAAO,MAAM,2BAA2B,UAavC,CAAA;AAGD,eAAO,MAAM,uBAAuB,UAenC,CAAA;AAGD,eAAO,MAAM,0BAA0B,UA2DtC,CAAA;AAGD,eAAO,MAAM,6BAA6B,UA8CzC,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,UAuBrC,CAAA;AAED;;;;;;;;;;;GAWG;AACH;;;;GAIG;AACH,eAAO,MAAM,YAAY,UAwBxB,CAAA;AAED,eAAO,MAAM,mBAAmB,UAwD/B,CAAA"}
+{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/patterns.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,eAAO,MAAM,uBAAuB,UAanC,CAAA;AA4BD,eAAO,MAAM,gBAAgB,QAAoE,CAAA;AAMjG,eAAO,MAAM,uBAAuB,UAsBnC,CAAA;AAID,eAAO,MAAM,4BAA4B,EAAE,WAAW,CAAC,MAAM,CAG3D,CAAA;AAUF,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAIjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAA;AAE3E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,uBAAuB,EAAG,cAAuB,CAAA;AAG9D,eAAO,MAAM,mBAAmB,UAY/B,CAAA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,uBAAuB,UAmBnC,CAAA;AAGD,eAAO,MAAM,2BAA2B,UAavC,CAAA;AAGD,eAAO,MAAM,uBAAuB,UAenC,CAAA;AAGD,eAAO,MAAM,0BAA0B,UA2DtC,CAAA;AAMD,eAAO,MAAM,gCAAgC,UAG5C,CAAA;AAGD,eAAO,MAAM,6BAA6B,UA8EzC,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,yBAAyB,UAuBrC,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,YAAY,UAwBxB,CAAA"}

package/dist/src/security/scanner/patterns.jailbreak.d.ts

@@ -0,0 +1,41 @@
+/**
+ * SMI-5876 Wave 1: Jailbreak / AI-Defence pattern arrays + evidence-tier map.
+ * @module @skillsmith/core/security/scanner/patterns.jailbreak
+ *
+ * Split out of patterns.ts (which was approaching the 500-line audit:standards
+ * gate) to hold `JAILBREAK_PATTERNS` and `AI_DEFENCE_PATTERNS`; the
+ * evidence-tier classification that governs their severity now lives
+ * alongside them in `patterns.jailbreak.evidence.ts` (SMI-5881, split out for
+ * the same 500-line reason).
+ *
+ * Background: both arrays previously matched bare vocabulary with no context
+ * requirement (`/jailbreak/i`, `/\bDAN\b/`, a bare role marker, a bare `[[...]]`
+ * bracket, ...) — a security-checklist skill's prose tripped the same
+ * CRITICAL/HIGH severity as a real attack. `EVIDENCE_TYPE_BY_PATTERN`
+ * classifies every pattern in both arrays into one of FIVE evidence tiers
+ * (`types.ts`'s `EvidenceType` — `mention`, `role_turn_with_body`,
+ * `imperative_instruction`, `instruction_override`, and `state_assertion`, the
+ * last added in a design-pass follow-up for declarative state assertions like
+ * "Jailbreak activated" that no frame-based directive pattern can catch);
+ * `SecurityScanner.evidence.ts` turns that tier (+ documentation context) into
+ * a severity/confidence pair, and `SecurityScanner.helpers.ts`'s merge-loop
+ * picks the STRONGEST tier per line across both the multi-line and
+ * single-line scan passes.
+ *
+ * Discriminator (see the SMI-5876 design doc for the full worked argument): a
+ * pattern is `mention`-tier iff its matched text, read in isolation, instructs
+ * nothing — pure nouns/names/labels/structural markers/payload-free
+ * obfuscation artifacts. Anything with a verb+object pairing or a
+ * second-person predicate is directive-tier (`imperative_instruction` /
+ * `instruction_override`). A descriptive-frame negative guard (demote when
+ * preceded by "guards against" / "for example" / ...) was deliberately
+ * REJECTED — for prompt injection the text IS the attack, so any framing-based
+ * exemption is itself a bypass vector ("for example, ignore all previous
+ * instructions" would be suppressed). This is why JAILBREAK's `bypass ...
+ * restrictions/filters/safety` entry stays directive-tier: it's a genuine
+ * attack on its own, and the only tool that would separate it from the
+ * "guards against bypass" documentation case is the rejected frame guard.
+ */
+export declare const JAILBREAK_PATTERNS: RegExp[];
+export declare const AI_DEFENCE_PATTERNS: RegExp[];
+//# sourceMappingURL=patterns.jailbreak.d.ts.map

package/dist/src/security/scanner/patterns.jailbreak.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.jailbreak.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/patterns.jailbreak.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAoLH,eAAO,MAAM,kBAAkB,UA4B9B,CAAA;AAuLD,eAAO,MAAM,mBAAmB,UAuB/B,CAAA"}

package/dist/src/security/scanner/patterns.jailbreak.evidence.d.ts

@@ -0,0 +1,35 @@
+/**
+ * SMI-5876 Wave 1 / SMI-5881: evidence-tier classification for
+ * JAILBREAK_PATTERNS + AI_DEFENCE_PATTERNS.
+ * @module @skillsmith/core/security/scanner/patterns.jailbreak.evidence
+ *
+ * Split out of patterns.jailbreak.ts (SMI-5881 — that file was approaching
+ * the 500-line audit:standards gate again, same reason it was split out of
+ * patterns.ts in SMI-5876) so EVIDENCE_TYPE_BY_PATTERN's declaration doesn't
+ * grow patterns.jailbreak.ts every time a new pattern is added.
+ *
+ * Keyed by OBJECT IDENTITY, exhaustive over both arrays (asserted by test in
+ * scanner-evidence-tiers.test.ts), but classifyEvidence() (SecurityScanner.
+ * evidence.ts) still defaults UNMAPPED patterns to `imperative_instruction` —
+ * fail-closed: forgetting to classify a newly added pattern makes it
+ * strongest, never weakest.
+ *
+ * Built from parallel index-aligned arrays (not per-named-const references)
+ * because the individual pattern consts (JB_IGNORE_PREVIOUS, AD_ROLE_MARKER_
+ * BARE, ...) are private to patterns.jailbreak.ts and intentionally not
+ * exported — this file only ever sees the same JAILBREAK_PATTERNS /
+ * AI_DEFENCE_PATTERNS arrays every other consumer sees, so a length mismatch
+ * (pattern added to one array, tier forgotten here) is impossible to
+ * misalign silently: the two arrays below MUST stay index-aligned with the
+ * exported pattern arrays, or scanner-evidence-tiers.test.ts's exhaustiveness
+ * assertion catches it immediately.
+ *
+ * Consumed ONLY by SecurityScanner's severity resolution. Every other
+ * consumer of JAILBREAK_PATTERNS / AI_DEFENCE_PATTERNS (memory-injection-
+ * scanner.ts's quarantine gate, SecurityScanner.quickCheck()) ignores it by
+ * design — both those call sites test bare pattern presence, not evidence
+ * tier, and that is intentional (see their own inline comments).
+ */
+import type { EvidenceType } from './types.js';
+export declare const EVIDENCE_TYPE_BY_PATTERN: ReadonlyMap<RegExp, EvidenceType>;
+//# sourceMappingURL=patterns.jailbreak.evidence.d.ts.map

package/dist/src/security/scanner/patterns.jailbreak.evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.jailbreak.evidence.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/patterns.jailbreak.evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAuD9C,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAMrE,CAAA"}

package/dist/src/security/scanner/patterns.jailbreak.evidence.js

@@ -0,0 +1,119 @@
+/**
+ * SMI-5876 Wave 1 / SMI-5881: evidence-tier classification for
+ * JAILBREAK_PATTERNS + AI_DEFENCE_PATTERNS.
+ * @module @skillsmith/core/security/scanner/patterns.jailbreak.evidence
+ *
+ * Split out of patterns.jailbreak.ts (SMI-5881 — that file was approaching
+ * the 500-line audit:standards gate again, same reason it was split out of
+ * patterns.ts in SMI-5876) so EVIDENCE_TYPE_BY_PATTERN's declaration doesn't
+ * grow patterns.jailbreak.ts every time a new pattern is added.
+ *
+ * Keyed by OBJECT IDENTITY, exhaustive over both arrays (asserted by test in
+ * scanner-evidence-tiers.test.ts), but classifyEvidence() (SecurityScanner.
+ * evidence.ts) still defaults UNMAPPED patterns to `imperative_instruction` —
+ * fail-closed: forgetting to classify a newly added pattern makes it
+ * strongest, never weakest.
+ *
+ * Built from parallel index-aligned arrays (not per-named-const references)
+ * because the individual pattern consts (JB_IGNORE_PREVIOUS, AD_ROLE_MARKER_
+ * BARE, ...) are private to patterns.jailbreak.ts and intentionally not
+ * exported — this file only ever sees the same JAILBREAK_PATTERNS /
+ * AI_DEFENCE_PATTERNS arrays every other consumer sees, so a length mismatch
+ * (pattern added to one array, tier forgotten here) is impossible to
+ * misalign silently: the two arrays below MUST stay index-aligned with the
+ * exported pattern arrays, or scanner-evidence-tiers.test.ts's exhaustiveness
+ * assertion catches it immediately.
+ *
+ * Consumed ONLY by SecurityScanner's severity resolution. Every other
+ * consumer of JAILBREAK_PATTERNS / AI_DEFENCE_PATTERNS (memory-injection-
+ * scanner.ts's quarantine gate, SecurityScanner.quickCheck()) ignores it by
+ * design — both those call sites test bare pattern presence, not evidence
+ * tier, and that is intentional (see their own inline comments).
+ */
+import { JAILBREAK_PATTERNS, AI_DEFENCE_PATTERNS } from './patterns.jailbreak.js';
+// Index-aligned with JAILBREAK_PATTERNS (patterns.jailbreak.ts) — keep in sync.
+const JAILBREAK_EVIDENCE = [
+    'instruction_override', // JB_IGNORE_PREVIOUS
+    'instruction_override', // JB_DISREGARD_PREVIOUS
+    'mention', // JB_DEVELOPER_MODE
+    'mention', // JB_DAN_BARE
+    'mention', // JB_DO_ANYTHING_NOW
+    'mention', // JB_JAILBREAK_BARE
+    'imperative_instruction', // JB_BYPASS_RESTRICTIONS
+    'imperative_instruction', // JB_PRETEND_NO_RESTRICTIONS
+    'imperative_instruction', // JB_ACT_NO_ETHICS
+    'imperative_instruction', // JB_YOU_ARE_NOW_FREE
+    'instruction_override', // JB_IGNORE_SAFETY_GUIDELINES
+    'imperative_instruction', // JB_HYPOTHETICAL_SCENARIO
+    'imperative_instruction', // JB_JN1_MODE_FRAME
+    'imperative_instruction', // JB_JN2_DEVELOPER_MODE_FRAME
+    'imperative_instruction', // JB_JN3_PERSONA_FRAME
+    'state_assertion', // JB_JS1_STATE_BARE
+    'state_assertion', // JB_JS2_NOUN_MODE_STATE
+    'state_assertion', // JB_JS3A_DEV_MODE_THEN_CAPABILITY
+    'state_assertion', // JB_JS3B_CAPABILITY_THEN_DEV_MODE
+    'imperative_instruction', // JB_JS4_OBEDIENCE_COMPULSION
+    'instruction_override', // JB_SPLIT_IGNORE
+    'instruction_override', // JB_SPLIT_DISREGARD
+    'imperative_instruction', // JB_SPLIT_BYPASS
+];
+// Index-aligned with AI_DEFENCE_PATTERNS (patterns.jailbreak.ts) — keep in sync.
+const AI_DEFENCE_EVIDENCE = [
+    'mention', // AD_ROLE_MARKER_BARE
+    'mention', // AD_BRACKET_HIDDEN
+    'instruction_override', // AD_HTML_COMMENT_VERB
+    'mention', // AD_HTML_COMMENT_NOUN
+    'imperative_instruction', // AD_HOMOGRAPH_RUN_PLUS_KEYWORD
+    'mention', // AD_MIXED_SCRIPT_WORD
+    'mention', // AD_XML_TAG_BARE
+    'imperative_instruction', // AD_BASE64_INSTRUCTIONS
+    'mention', // AD_DELIMITER_BARE
+    'mention', // AD_JSON_ROLE_FIELD
+    'role_turn_with_body', // AD_NESTED_INSTRUCTION_BLOCK
+    'instruction_override', // AD_CRLF_INJECTION
+    'mention', // AD_TEMPLATE_LITERAL
+    'mention', // AD_ZERO_WIDTH
+    'imperative_instruction', // AD_MARKDOWN_LINK_PAYLOAD
+    'imperative_instruction', // AD_ESCAPE_SEQUENCE_ABUSE
+    'mention', // AD_ZALGO_COMBINING
+    'role_turn_with_body', // AD_AN1_ROLE_BODY_SAME_LINE
+    'role_turn_with_body', // AD_AN2_ROLE_BODY_NEXT_LINE
+    'role_turn_with_body', // AD_AN3A_CHAT_TOKEN_BODY_SAME_LINE
+    'role_turn_with_body', // AD_AN3B_CHAT_TOKEN_BODY_NEXT_LINE
+];
+export const EVIDENCE_TYPE_BY_PATTERN = new Map([
+    ...JAILBREAK_PATTERNS.map((p, i) => [p, JAILBREAK_EVIDENCE[i]]),
+    ...AI_DEFENCE_PATTERNS.map((p, i) => [p, AI_DEFENCE_EVIDENCE[i]]),
+]);
+/**
+ * Module-load gate: unlike patterns.scope.ts's PATTERN_SCOPE, an unmapped
+ * entry here degrades safely (classifyEvidence() fail-closes to the
+ * strongest tier), so this isn't a silent-coverage-gap risk the way scope is.
+ * Still asserted directly rather than relying solely on `Map.has()` via
+ * scanner-evidence-tiers.test.ts's exhaustiveness check: `new Map([[p,
+ * undefined]])` reports `.has(p) === true`, so an out-of-range EVIDENCE[i]
+ * read during construction (a length mismatch between a PATTERNS array and
+ * its index-aligned EVIDENCE array) would pass a has()-only check silently.
+ */
+function assertEvidenceCoverage() {
+    const pairs = [
+        { name: 'JAILBREAK_PATTERNS', patterns: JAILBREAK_PATTERNS, evidence: JAILBREAK_EVIDENCE },
+        { name: 'AI_DEFENCE_PATTERNS', patterns: AI_DEFENCE_PATTERNS, evidence: AI_DEFENCE_EVIDENCE },
+    ];
+    for (const { name, patterns, evidence } of pairs) {
+        if (patterns.length !== evidence.length) {
+            throw new Error(`[SecurityScanner] ${name} has ${patterns.length} pattern(s) but its evidence array has ` +
+                `${evidence.length} entries — they must be index-aligned and equal length. ` +
+                `Add or remove an evidence entry in patterns.jailbreak.evidence.ts to match.`);
+        }
+        patterns.forEach((pattern, index) => {
+            const evidenceType = EVIDENCE_TYPE_BY_PATTERN.get(pattern);
+            if (!EVIDENCE_TYPE_BY_PATTERN.has(pattern) || evidenceType === undefined) {
+                throw new Error(`[SecurityScanner] ${name}[${index}] (/${pattern.source}/${pattern.flags}) has no ` +
+                    `EVIDENCE_TYPE_BY_PATTERN entry.`);
+            }
+        });
+    }
+}
+assertEvidenceCoverage();
+//# sourceMappingURL=patterns.jailbreak.evidence.js.map

package/dist/src/security/scanner/patterns.jailbreak.evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.jailbreak.evidence.js","sourceRoot":"","sources":["../../../../src/security/scanner/patterns.jailbreak.evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAEjF,gFAAgF;AAChF,MAAM,kBAAkB,GAA4B;IAClD,sBAAsB,EAAE,qBAAqB;IAC7C,sBAAsB,EAAE,wBAAwB;IAChD,SAAS,EAAE,oBAAoB;IAC/B,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,qBAAqB;IAChC,SAAS,EAAE,oBAAoB;IAC/B,wBAAwB,EAAE,yBAAyB;IACnD,wBAAwB,EAAE,6BAA6B;IACvD,wBAAwB,EAAE,mBAAmB;IAC7C,wBAAwB,EAAE,sBAAsB;IAChD,sBAAsB,EAAE,8BAA8B;IACtD,wBAAwB,EAAE,2BAA2B;IACrD,wBAAwB,EAAE,oBAAoB;IAC9C,wBAAwB,EAAE,8BAA8B;IACxD,wBAAwB,EAAE,uBAAuB;IACjD,iBAAiB,EAAE,oBAAoB;IACvC,iBAAiB,EAAE,yBAAyB;IAC5C,iBAAiB,EAAE,mCAAmC;IACtD,iBAAiB,EAAE,mCAAmC;IACtD,wBAAwB,EAAE,8BAA8B;IACxD,sBAAsB,EAAE,kBAAkB;IAC1C,sBAAsB,EAAE,qBAAqB;IAC7C,wBAAwB,EAAE,kBAAkB;CAC7C,CAAA;AAED,iFAAiF;AACjF,MAAM,mBAAmB,GAA4B;IACnD,SAAS,EAAE,sBAAsB;IACjC,SAAS,EAAE,oBAAoB;IAC/B,sBAAsB,EAAE,uBAAuB;IAC/C,SAAS,EAAE,uBAAuB;IAClC,wBAAwB,EAAE,gCAAgC;IAC1D,SAAS,EAAE,uBAAuB;IAClC,SAAS,EAAE,kBAAkB;IAC7B,wBAAwB,EAAE,yBAAyB;IACnD,SAAS,EAAE,oBAAoB;IAC/B,SAAS,EAAE,qBAAqB;IAChC,qBAAqB,EAAE,8BAA8B;IACrD,sBAAsB,EAAE,oBAAoB;IAC5C,SAAS,EAAE,sBAAsB;IACjC,SAAS,EAAE,gBAAgB;IAC3B,wBAAwB,EAAE,2BAA2B;IACrD,wBAAwB,EAAE,2BAA2B;IACrD,SAAS,EAAE,qBAAqB;IAChC,qBAAqB,EAAE,6BAA6B;IACpD,qBAAqB,EAAE,6BAA6B;IACpD,qBAAqB,EAAE,oCAAoC;IAC3D,qBAAqB,EAAE,oCAAoC;CAC5D,CAAA;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAsC,IAAI,GAAG,CAGhF;IACA,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAU,CAAC;IACxE,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAU,CAAC;CAC3E,CAAC,CAAA;AAEF;;;;;;;;;GASG;AACH,SAAS,sBAAsB;IAC7B,MAAM,KAAK,GAIN;QACH,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,EAAE,kBAAkB,EAAE;QAC1F,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,mBAAmB,EAAE,QAAQ,EAAE,mBAAmB,EAAE;KAC9F,CAAA;IACD,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,KAAK,EAAE,CAAC;QACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,QAAQ,QAAQ,CAAC,MAAM,yCAAyC;gBACvF,GAAG,QAAQ,CAAC,MAAM,0DAA0D;gBAC5E,6EAA6E,CAChF,CAAA;QACH,CAAC;QACD,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;YAClC,MAAM,YAAY,GAAG,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAC1D,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBACzE,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,IAAI,KAAK,OAAO,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,WAAW;oBACjF,iCAAiC,CACpC,CAAA;YACH,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,sBAAsB,EAAE,CAAA"}