@theoremjs/agents 0.0.0-stage → 0.3.0

package/esm/src/guardrails/event-schemas.js

@@ -0,0 +1,41 @@
+// Imports nothing from `src/kernel/` but the dependency-free `Equals`: `src/kernel/turn-events.ts` imports these.
+import { z } from 'zod';
+import { LEXICON_KEYS } from './lexicon.js';
+import { ERROR_KINDS } from './theorem-error.js';
+import { GUARDRAIL_ACTIONS, GUARDRAIL_STAGES, SEVERITIES, TOOL_ORIGINS, TRUST_LEVELS, } from './types.js';
+const errorKind = z.enum(ERROR_KINDS);
+true;
+export const errorKindSchema = errorKind;
+const errorCopy = z.object({
+    key: z.enum(LEXICON_KEYS),
+    params: z.record(z.string(), z.union([z.string(), z.number()])).optional(),
+});
+true;
+const errorCopies = z.union([errorCopy, z.array(errorCopy).readonly()]);
+true;
+export const errorCopiesSchema = errorCopies;
+const provenance = z.object({
+    origin: z.enum(TOOL_ORIGINS),
+    tool: z.string(),
+    depth: z.number(),
+});
+true;
+const guardrailHit = z.object({
+    rule: z.string(),
+    severity: z.enum(SEVERITIES),
+    span: z.object({ start: z.number(), end: z.number() }).optional(),
+    match: z.string().optional(),
+    label: z.string().optional(),
+    doc: z.string().optional(),
+});
+true;
+const guardrailEvent = z.object({
+    stage: z.enum(GUARDRAIL_STAGES),
+    trust: z.enum(TRUST_LEVELS),
+    action: z.enum(GUARDRAIL_ACTIONS),
+    hits: z.array(guardrailHit),
+    provenance: provenance.optional(),
+    errorInternal: z.string().optional(),
+});
+true;
+export const guardrailEventSchema = guardrailEvent;

package/esm/src/guardrails/events.d.ts

@@ -0,0 +1,9 @@
+import type { TurnEvent, TurnEventOf } from '../kernel/turn-events.js';
+import type { GuardrailAction, GuardrailEvent, GuardrailHit, GuardrailStage, Provenance, TrustLevel, Verdict } from './types.js';
+declare function guardrailTurnEvent(guardrail: GuardrailEvent): TurnEventOf<'guardrail'>;
+/** `allow` yields nothing; `flag`, `redact` and `block` all emit so hosts and traces can count hits. */
+declare function guardrailFromVerdict(stage: GuardrailStage, trust: TrustLevel, verdict: Verdict, provenance?: Provenance): TurnEventOf<'guardrail'> | undefined;
+declare function guardrailFromHits(stage: GuardrailStage, trust: TrustLevel, hits: GuardrailHit[], action?: GuardrailAction, provenance?: Provenance): TurnEventOf<'guardrail'> | undefined;
+declare function projectGuardrailTurnEvent(event: TurnEventOf<'guardrail'>, includeMatch: boolean): TurnEventOf<'guardrail'>;
+declare function projectGuardrailTurnEvent(event: TurnEvent, includeMatch: boolean): TurnEvent;
+export { guardrailFromHits, guardrailFromVerdict, guardrailTurnEvent, projectGuardrailTurnEvent };

package/esm/src/guardrails/events.js

@@ -0,0 +1,42 @@
+import { projectGuardrailEvent } from './hits.js';
+function guardrailTurnEvent(guardrail) {
+    return { type: 'guardrail', guardrail };
+}
+/** `allow` yields nothing; `flag`, `redact` and `block` all emit so hosts and traces can count hits. */
+function guardrailFromVerdict(stage, trust, verdict, provenance) {
+    if (verdict.action === 'allow') {
+        return undefined;
+    }
+    return guardrailTurnEvent({
+        stage,
+        trust,
+        action: verdict.action,
+        hits: verdict.hits,
+        ...(provenance ? { provenance } : {}),
+        ...(verdict.action === 'block' && verdict.errorInternal
+            ? { errorInternal: verdict.errorInternal }
+            : {}),
+    });
+}
+function guardrailFromHits(stage, trust, hits, action = 'redact', provenance) {
+    if (hits.length === 0) {
+        return undefined;
+    }
+    return guardrailTurnEvent({
+        stage,
+        trust,
+        action,
+        hits,
+        ...(provenance ? { provenance } : {}),
+    });
+}
+function projectGuardrailTurnEvent(event, includeMatch) {
+    if (event.type !== 'guardrail') {
+        return event;
+    }
+    return {
+        ...event,
+        guardrail: projectGuardrailEvent(event.guardrail, includeMatch),
+    };
+}
+export { guardrailFromHits, guardrailFromVerdict, guardrailTurnEvent, projectGuardrailTurnEvent };

package/esm/src/guardrails/hits.d.ts

@@ -0,0 +1,8 @@
+import type { GuardrailEvent, GuardrailHit, Severity } from './types.js';
+declare function hitFromSpan(text: string, span: {
+    start: number;
+    end: number;
+}, rule: string, severity: Severity): GuardrailHit;
+/** `match` is the caught text itself, so hosts and traces get it only via `observability.include.guardrailMatchPreview`. */
+declare function projectGuardrailEvent(event: GuardrailEvent, includeMatch: boolean): GuardrailEvent;
+export { hitFromSpan, projectGuardrailEvent };

package/esm/src/guardrails/hits.js

@@ -0,0 +1,19 @@
+function hitFromSpan(text, span, rule, severity) {
+    return {
+        rule,
+        severity,
+        span: { start: span.start, end: span.end },
+        match: text.slice(span.start, span.end),
+    };
+}
+/** `match` is the caught text itself, so hosts and traces get it only via `observability.include.guardrailMatchPreview`. */
+function projectGuardrailEvent(event, includeMatch) {
+    if (includeMatch) {
+        return event;
+    }
+    return {
+        ...event,
+        hits: event.hits.map(({ match: _match, ...hit }) => hit),
+    };
+}
+export { hitFromSpan, projectGuardrailEvent };

package/esm/src/guardrails/injection-patterns.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The prompt-injection patterns, apart from the code that runs them, so the
+ * egress automata generator (`scripts/gen-egress-automata.ts`) can read them
+ * without the generated table it writes.
+ *
+ * @module
+ */
+declare const INJECTION_PATTERNS: RegExp[];
+/** Runs that might encode an injection; each is decoded and checked in `injection.ts`. */
+declare const BASE64_BLOB: RegExp;
+declare const HEX_BLOB: RegExp;
+declare const SPACED_LETTERS: RegExp;
+/** Three+ alphabetic tokens joined by `|` (no shell spaces around pipes). */
+declare const PIPE_SEPARATED: RegExp;
+export { BASE64_BLOB, HEX_BLOB, INJECTION_PATTERNS, PIPE_SEPARATED, SPACED_LETTERS };

package/esm/src/guardrails/injection-patterns.js

@@ -0,0 +1,94 @@
+/**
+ * The prompt-injection patterns, apart from the code that runs them, so the
+ * egress automata generator (`scripts/gen-egress-automata.ts`) can read them
+ * without the generated table it writes.
+ *
+ * @module
+ */
+const IGNORE_PREVIOUS = /ignore\s+(all\s+)?(previous|prior)\s+((?:safety|security|system|operational|internal|core|original|initial|existing|given|stated|provided|defined|specified|established)\s+)?(instructions?|rules?|guidelines?|constraints?|directives?)/gi;
+const DISREGARD_INSTRUCTIONS = /disregard\s+(all\s+)?(previous|prior|above)\s+(instructions?|rules?|guidelines?|constraints?|directives?)/gi;
+const FORGET_INSTRUCTIONS = /forget\s+(all\s+)?(previous|prior|above)\s+(instructions?|rules?|guidelines?|constraints?|directives?)/gi;
+const NEW_INSTRUCTIONS = /new\s+instructions?:/gi;
+const DO_NOT_FOLLOW = /do\s+not\s+follow\s+(the\s+)?(system|developer|previous|original)/gi;
+const SUPERSEDE_INSTRUCTIONS = /supersedes?\s+(all\s+)?(prior|previous)\s+(instructions?|rules?|guidelines?|constraints?|directives?)/gi;
+const VOID_INSTRUCTIONS = /(all\s+)?(previous|prior)\s+instructions?\s+(are|is)\s+(void|invalid|null|obsolete|cancelled|revoked)/gi;
+const DEVELOPER_MODE = /you\s+are\s+now\s+(in\s+)?developer\s+mode/gi;
+const ENTER_SPECIAL_MODE = /enter\s+(developer|admin|debug|maintenance)\s+mode(?!\s+(?:in|on|via|through|from|using|for)\b)/gi;
+const ACTIVATE_SPECIAL_MODE = /activate\s+(developer|admin|debug|jailbreak)\s+mode(?!\s+(?:in|on|via|through|from|using|for)\b)/gi;
+const SYSTEM_OVERRIDE = /\bsystem\s+override\b/gi;
+const OVERRIDE_INSTRUCTIONS = /override\s+(your\s+)?(instructions?|rules?|guidelines?|constraints?|directives?)/gi;
+const REVEAL_PROMPT = /reveal\s+((?:your?|yoru|yuor|the|my|its|his|her|our|their)\s+)?((?:(?:full|hidden|complete|internal|secret|original|entire|exact|actual|real)\s+){0,2})((?:system|systme|sysetm|systemp?)\s+)?prompt\b/gi;
+const SHOW_PROMPT = /show\s+(me\s+)?((?:your?|yoru|yuor|the|my|its|his|her|our|their)\s+)((?:system|systme|sysetm|systemp?)\s+)?prompt\b/gi;
+const WHAT_INSTRUCTIONS = /what\s+(are|were)\s+(your\s+)?(exact\s+)?instructions/gi;
+const REPEAT_INSTRUCTIONS = /repeat\s+(the\s+)?(text|instructions?)\s+(above|before)/gi;
+const OUTPUT_PROMPT = /output\s+(your\s+)?(initial|original|system)\s+(prompt|instructions?)/gi;
+const REMOVE_RESTRICTIONS = /you\s+are\s+no\s+longer\s+(bound|restricted|limited)/gi;
+const ACT_UNBOUND = /act\s+as\s+if\s+(you('re|\s+are)\s+)?not\s+bound/gi;
+const PRETEND_DIFFERENT = /pretend\s+(you('re|\s+are)\s+)?(a\s+)?different\s+(ai|assistant|model)/gi;
+const IDENTITY_HIJACK = /you\s+are\s+now\s+(?:(?:a|an)\s+)?\w+.{0,40}(without\s+(any\s+)?restrict|ignor\w*\s+(all|any|every|prev)|bypass|unrestrict|unlimit|obey\s+only|no\s+(rules|limits|restrict|boundari))/gi;
+const DAN_JAILBREAK = /\bDAN\b[\s\S]{0,120}\bdo\s+anything\s+now\b/g;
+const JAILBREAK_MODE = /jailbreak(ed)?\s+(mode|prompt)/gi;
+const DO_ANYTHING_NOW = /\bdo\s+anything\s+now\b/gi;
+const BYPASS_SAFETY = /bypass\s+(your\s+)?(safety|security|content|ethical)\s+(filters?|measures?|guidelines?|restrictions?)/gi;
+const DISABLE_SAFETY = /(disable|delete|remove|turn\s+off|eliminate)\s+(all\s+)?(your\s+)?(safety|security|content)\s+(filters?|measures?|rules?|guidelines?|restrictions?)/gi;
+const IGNORE_SAFETY = /(ignore|disregard)\s+(all\s+)?(your\s+)?(safety|security|ethical|content)\s+(guidelines?|rules?|restrictions?|measures?|filters?|polic(?:y|ies)|protocols?)/gi;
+/** Bound whitespace so tag scanners cannot polynomial-backtrack on long runs. */
+const TAG_WS = String.raw `[^\S\r\n]{0,32}`;
+const SYSTEM_TAG = new RegExp(`<${TAG_WS}\\/?${TAG_WS}system${TAG_WS}\\/?>`, 'gi');
+const ROLE_TAG = new RegExp(`<${TAG_WS}\\/?${TAG_WS}(assistant|developer|tool|function)${TAG_WS}\\/?>`, 'gi');
+const ROLE_DELIMITER = /\][^\S\r\n]{0,32}\n[^\S\r\n]{0,32}\[?(system|assistant|user)\]?:/gi;
+const BRACKETED_ROLE = /\[[^\S\r\n]{0,32}(System[^\S\r\n]{0,8}Message|System|Assistant|Internal)[^\S\r\n]{0,32}\]/gi;
+const SYSTEM_YOU_ARE = /^[^\S\r\n]{0,32}System:[^\S\r\n]{1,32}(you\s+are|ignore|override)/gim;
+const CONTROL_TOKEN = /<\|(?:im_start|im_end|eot_id|start_header_id|end_header_id|endoftext)\|>/g;
+const DEEPSEEK_CONTROL = /<｜(?:end▁of▁sentence|begin▁of▁sentence)｜>/g;
+const LLAMA_INST = /\[\/?INST\]/gi;
+const IGNORE_YOUR_INSTRUCTIONS = /ignore\s+(all\s+)?(your\s+)?(instructions?|rules?)\b/gi;
+const UNRESTRICTED_MODE = /\bunrestricted\s+(ai|mode|model)\b/gi;
+const IGNORE_MULTILANG = /\b(?:ignorieren|ignorez|ignora|ignorer|oubliez|vergessen|olvida|desestima|missachten)\b[\s\S]{0,50}\b(?:anweisungen|instructions?|instrucciones|directives?|r[eè]gles|reglas)\b/gi;
+const INJECTION_PATTERNS = [
+    IGNORE_PREVIOUS,
+    DISREGARD_INSTRUCTIONS,
+    FORGET_INSTRUCTIONS,
+    NEW_INSTRUCTIONS,
+    DO_NOT_FOLLOW,
+    SUPERSEDE_INSTRUCTIONS,
+    VOID_INSTRUCTIONS,
+    DEVELOPER_MODE,
+    ENTER_SPECIAL_MODE,
+    ACTIVATE_SPECIAL_MODE,
+    SYSTEM_OVERRIDE,
+    OVERRIDE_INSTRUCTIONS,
+    REVEAL_PROMPT,
+    SHOW_PROMPT,
+    WHAT_INSTRUCTIONS,
+    REPEAT_INSTRUCTIONS,
+    OUTPUT_PROMPT,
+    REMOVE_RESTRICTIONS,
+    ACT_UNBOUND,
+    PRETEND_DIFFERENT,
+    IDENTITY_HIJACK,
+    DAN_JAILBREAK,
+    JAILBREAK_MODE,
+    DO_ANYTHING_NOW,
+    BYPASS_SAFETY,
+    DISABLE_SAFETY,
+    IGNORE_SAFETY,
+    SYSTEM_TAG,
+    ROLE_TAG,
+    ROLE_DELIMITER,
+    BRACKETED_ROLE,
+    SYSTEM_YOU_ARE,
+    CONTROL_TOKEN,
+    DEEPSEEK_CONTROL,
+    LLAMA_INST,
+    IGNORE_YOUR_INSTRUCTIONS,
+    UNRESTRICTED_MODE,
+    IGNORE_MULTILANG,
+];
+/** Runs that might encode an injection; each is decoded and checked in `injection.ts`. */
+const BASE64_BLOB = /[A-Za-z0-9+/]{16,}={0,2}/g;
+const HEX_BLOB = /(?:[0-9a-f]{2}[\s]?){8,}/gi;
+const SPACED_LETTERS = /\b(?:[A-Za-z] ){3,}[A-Za-z]\b/g;
+/** Three+ alphabetic tokens joined by `|` (no shell spaces around pipes). */
+const PIPE_SEPARATED = /\b(?:[A-Za-z]+\|){2,}[A-Za-z]+\b/g;
+export { BASE64_BLOB, HEX_BLOB, INJECTION_PATTERNS, PIPE_SEPARATED, SPACED_LETTERS };

package/esm/src/guardrails/injection.d.ts

@@ -0,0 +1,14 @@
+import { type RedactSpan } from '../observability/spans.js';
+declare const TYPO_TARGETS: string[];
+declare function typoNormalize(text: string): string;
+/** Blob patterns whose match is a hit only when the blob decodes to an injection. */
+declare const INJECTION_BLOBS: readonly {
+    pattern: RegExp;
+    hit: (blob: string) => boolean;
+}[];
+declare function tryRot13(text: string): string;
+/** Each run of `%XX` escapes decoded on its own, so one stray `%` cannot switch decoding off. */
+declare function decodeUrlRuns(text: string): string;
+declare function tryLeet(text: string): string | undefined;
+declare function injectionSpans(text: string): RedactSpan[];
+export { decodeUrlRuns, INJECTION_BLOBS, injectionSpans, TYPO_TARGETS, tryLeet, tryRot13, typoNormalize, };

package/esm/src/guardrails/injection.js

@@ -0,0 +1,237 @@
+import { blobAt, spansFromPatterns } from '../observability/spans.js';
+import { REVERSED_INJECTION_PATTERNS } from './egress-automata.js';
+import { BASE64_BLOB, HEX_BLOB, INJECTION_PATTERNS, PIPE_SEPARATED, SPACED_LETTERS, } from './injection-patterns.js';
+import { normalizeForDetection } from './normalize.js';
+const TYPO_TARGETS = [
+    'ignore',
+    'bypass',
+    'override',
+    'reveal',
+    'delete',
+    'system',
+    'prompt',
+    'instructions',
+    'safety',
+    'security',
+    'filters',
+    'rules',
+    'previous',
+    'guidelines',
+    'restrictions',
+    'disregard',
+    'forget',
+    'jailbreak',
+    'developer',
+    'disable',
+    'measures',
+];
+/** Pipe evasion only when the first token is a known injection lead-in. */
+const PIPE_HEAD_VERBS = /^(ignore|disregard|forget|bypass|reveal|show|repeat|output|disable|override|new|jailbreak|pretend|act|enter|activate|void|supersede|do)$/i;
+const WORD = /\b[A-Za-z]{4,}\b/g;
+const PRINTABLE_MIN = 0.85;
+const CODE_TAB = 9;
+const CODE_LF = 10;
+const CODE_CR = 13;
+const CODE_SPACE = 32;
+const CODE_DEL = 127;
+const HEX_RADIX = 16;
+const HEX_STEP = 2;
+const ROT13_OFFSET = 13;
+const ALPHA_COUNT = 26;
+const UPPER_A_CODE = 65;
+const LOWER_A_CODE = 97;
+function injectionSpansOn(text) {
+    return spansFromPatterns(text, INJECTION_PATTERNS, 'injection');
+}
+function sortedLetters(value) {
+    return [...value].sort().join('');
+}
+function firstLast(word) {
+    return { first: word.at(0), last: word.at(-1) };
+}
+function isTypoglycemia(word, target) {
+    if (word.length !== target.length) {
+        return false;
+    }
+    const lower = word.toLowerCase();
+    if (lower === target) {
+        return false;
+    }
+    const wordEnds = firstLast(lower);
+    const targetEnds = firstLast(target);
+    if (wordEnds.first !== targetEnds.first || wordEnds.last !== targetEnds.last) {
+        return false;
+    }
+    return sortedLetters(lower.slice(1, -1)) === sortedLetters(target.slice(1, -1));
+}
+function typoNormalize(text) {
+    return text.replace(WORD, (word) => {
+        for (const target of TYPO_TARGETS) {
+            if (isTypoglycemia(word, target)) {
+                return target;
+            }
+        }
+        return word;
+    });
+}
+function isMostlyPrintable(value) {
+    if (!value) {
+        return false;
+    }
+    let ok = 0;
+    for (const ch of value) {
+        const code = ch.codePointAt(0) ?? 0;
+        const control = code === CODE_TAB || code === CODE_LF || code === CODE_CR;
+        const visible = code >= CODE_SPACE && code < CODE_DEL;
+        if (control || visible) {
+            ok += 1;
+        }
+    }
+    return ok / value.length >= PRINTABLE_MIN;
+}
+function tryBase64(blob) {
+    try {
+        return atob(blob);
+    }
+    catch {
+        return undefined;
+    }
+}
+function decodedHits(decoded) {
+    if (!isMostlyPrintable(decoded)) {
+        return false;
+    }
+    if (injectionSpansOn(decoded).length > 0)
+        return true;
+    const doubleDecoded = tryBase64(decoded);
+    if (doubleDecoded &&
+        isMostlyPrintable(doubleDecoded) &&
+        injectionSpansOn(doubleDecoded).length > 0) {
+        return true;
+    }
+    return false;
+}
+function tryHex(blob) {
+    const hex = blob.replaceAll(/\s/g, '');
+    if (hex.length % HEX_STEP !== 0) {
+        return undefined;
+    }
+    let out = '';
+    for (let i = 0; i < hex.length; i += HEX_STEP) {
+        out += String.fromCodePoint(Number.parseInt(hex.slice(i, i + HEX_STEP), HEX_RADIX));
+    }
+    return out;
+}
+function base64Hit(blob) {
+    const decoded = tryBase64(blob);
+    return decoded !== undefined && decodedHits(decoded);
+}
+function hexHit(blob) {
+    const decoded = tryHex(blob);
+    return decoded !== undefined && decodedHits(decoded);
+}
+function spacedHit(blob) {
+    const collapsed = blob.replaceAll(' ', '');
+    return injectionSpansOn(`${collapsed} previous instructions`).length > 0;
+}
+function pipeHit(blob) {
+    const head = blob.split('|')[0]?.toLowerCase();
+    if (!head || !PIPE_HEAD_VERBS.test(head))
+        return false;
+    return injectionSpansOn(blob.replaceAll('|', ' ')).length > 0;
+}
+/** Blob patterns whose match is a hit only when the blob decodes to an injection. */
+const INJECTION_BLOBS = [
+    { pattern: BASE64_BLOB, hit: base64Hit },
+    { pattern: HEX_BLOB, hit: hexHit },
+    { pattern: SPACED_LETTERS, hit: spacedHit },
+    { pattern: PIPE_SEPARATED, hit: pipeHit },
+];
+function blobSpans(text) {
+    const spans = [];
+    for (const { pattern, hit } of INJECTION_BLOBS) {
+        for (const match of text.matchAll(pattern)) {
+            const found = blobAt(match);
+            if (found && hit(found.blob)) {
+                spans.push({ start: found.index, end: found.index + found.blob.length, kind: 'injection' });
+            }
+        }
+    }
+    return spans;
+}
+function tryRot13(text) {
+    return text.replace(/[a-zA-Z]/g, (c) => {
+        const base = c.charCodeAt(0) < LOWER_A_CODE ? UPPER_A_CODE : LOWER_A_CODE;
+        return String.fromCharCode(((c.charCodeAt(0) - base + ROT13_OFFSET) % ALPHA_COUNT) + base);
+    });
+}
+const URL_ESCAPES = /(?:%[0-9A-Fa-f]{2})+/g;
+const UTF8 = new TextDecoder();
+/** Each run of `%XX` escapes decoded on its own, so one stray `%` cannot switch decoding off. */
+function decodeUrlRuns(text) {
+    return text.replace(URL_ESCAPES, (run) => {
+        const bytes = new Uint8Array(run.length / 3);
+        for (let i = 0; i < bytes.length; i++) {
+            bytes[i] = Number.parseInt(run.slice(i * 3 + 1, i * 3 + 3), HEX_RADIX);
+        }
+        return UTF8.decode(bytes);
+    });
+}
+function tryUrlDecode(text) {
+    if (!text.includes('%'))
+        return undefined;
+    const decoded = decodeUrlRuns(text);
+    return decoded !== text ? decoded : undefined;
+}
+const LEET_MAP = {
+    '0': 'o',
+    '1': 'i',
+    '3': 'e',
+    '4': 'a',
+    '5': 's',
+    '7': 't',
+    '8': 'b',
+    '@': 'a',
+    '!': 'i',
+};
+const LEET_CHARS = /[013457@!]/g;
+function tryLeet(text) {
+    if (!LEET_CHARS.test(text))
+        return undefined;
+    LEET_CHARS.lastIndex = 0;
+    const decoded = text.replace(LEET_CHARS, (c) => LEET_MAP[c] ?? c);
+    return decoded !== text ? decoded : undefined;
+}
+/**
+ * Text written backwards reads as an injection: each pattern reversed
+ * (`REVERSED_INJECTION_PATTERNS`), matched on the text as written.
+ */
+function reversedHits(text) {
+    return spansFromPatterns(text, REVERSED_INJECTION_PATTERNS, 'injection').length > 0;
+}
+function decodedTextSpans(text) {
+    const attempts = [tryRot13(text), tryUrlDecode(text), tryLeet(text)];
+    const decodedHit = attempts.some((decoded) => decoded && decoded !== text && injectionSpansOn(decoded).length > 0);
+    return decodedHit || reversedHits(text)
+        ? [{ start: 0, end: text.length, kind: 'injection' }]
+        : [];
+}
+function injectionSpans(text) {
+    const direct = injectionSpansOn(text);
+    const shadow = typoNormalize(text);
+    let typo = [];
+    if (shadow !== text) {
+        typo = injectionSpansOn(shadow);
+    }
+    const normalized = normalizeForDetection(text);
+    let unicodeHits = [];
+    if (normalized !== text) {
+        const normalizedTypo = typoNormalize(normalized);
+        if (injectionSpansOn(normalized).length > 0 ||
+            (normalizedTypo !== normalized && injectionSpansOn(normalizedTypo).length > 0)) {
+            unicodeHits = [{ start: 0, end: text.length, kind: 'injection' }];
+        }
+    }
+    return [...direct, ...typo, ...unicodeHits, ...blobSpans(text), ...decodedTextSpans(text)];
+}
+export { decodeUrlRuns, INJECTION_BLOBS, injectionSpans, TYPO_TARGETS, tryLeet, tryRot13, typoNormalize, };

package/esm/src/guardrails/lexicon.d.ts

@@ -0,0 +1,30 @@
+export type LexiconParams = Record<string, string | number>;
+/** Keys are stable API. */
+export declare const LEXICON_KEYS: readonly ["continue.instruction", "canary.bind_note", "user_data.note", "taint.blocked", "taint.reason_steered", "taint.reason_tainted", "advisory.notice_elevated", "advisory.notice_high", "advisory.guidance", "attachments.too_many_files", "attachments.file_too_large", "attachments.turn_too_large", "attachments.not_accepted", "attachments.mime_not_allowed", "attachments.limits_unconfigured", "quota.exhausted", "error.config", "error.request", "error.input", "error.action", "error.auth", "error.rate_limit", "error.unsupported", "error.unavailable", "error.bad_response", "error.network", "error.timeout", "error.safety", "error.blocked", "error.declined", "error.failed", "error.cancelled", "error.internal", "repair.default_guidance", "repair.prompt_header", "repair.prompt_intro", "repair.prompt_instructions", "repair.history_heading", "repair.section_previous_output", "repair.section_validator_rejection", "repair.section_repair_guidance", "repair.section_instructions", "compaction.request", "compaction.tool_call", "compaction.tool_result", "egress.default_repair_guidance", "egress.refusal", "egress.rejection", "egress.invalid_verdict", "egress.policy_failed", "thought.omitted_image", "thought.omitted_link", "thought.omitted_instructions", "session.abandon_gated", "session.tool_denied", "session.tool_aborted", "session.sign_in", "sign_in.link", "sign_in.pending", "sign_in.done", "sign_in.declined", "sign_in.expired", "sign_in.out_of_scope", "session.gate_expired", "session.turn_ended", "session.gate_pending", "session.part_skipped", "live.session_ended", "voice.unsupported", "voice.permission", "voice.unavailable", "voice.failed", "voice.empty", "tool.awaiting_user", "tool.completed_hidden", "tool.t2_loader_needs_snapshot", "tool.t2_loader_shape", "tool.t2_loader_output_invalid", "tool.input_invalid", "tool.input_invalid_after_mutate", "tool.output_invalid_after_mutate", "tool.handler_no_output", "tool.output_invalid", "tool.not_wired_t1", "tool.not_loaded_t2", "tool.not_visible", "tool.builtin_not_enabled", "tool.provider_native", "tool.not_registered", "tool.builtin_needs_snapshot", "tool.not_allowed", "tool.not_eligible", "tool.unsupported_type"];
+export type LexiconKey = (typeof LEXICON_KEYS)[number];
+/**
+ * The keys a browser client words or writes: what the user reads (errors,
+ * attachment and voice problems, session states) and the tool lines the client
+ * puts into history. Only these overrides travel to the browser; the rest
+ * (repair prompts, canary, taint, egress) stay on the host.
+ */
+export declare const CLIENT_LEXICON_KEYS: readonly ["attachments.too_many_files", "attachments.file_too_large", "attachments.turn_too_large", "attachments.not_accepted", "attachments.mime_not_allowed", "attachments.limits_unconfigured", "error.config", "error.request", "error.input", "error.action", "error.auth", "error.rate_limit", "error.unsupported", "error.unavailable", "error.bad_response", "error.network", "error.timeout", "error.safety", "error.blocked", "error.declined", "error.failed", "error.cancelled", "error.internal", "session.abandon_gated", "session.tool_denied", "session.sign_in", "session.gate_expired", "session.turn_ended", "session.gate_pending", "session.part_skipped", "live.session_ended", "tool.awaiting_user", "tool.completed_hidden", "voice.unsupported", "voice.permission", "voice.unavailable", "voice.failed", "voice.empty"];
+export type ClientLexiconKey = (typeof CLIENT_LEXICON_KEYS)[number];
+/** Host-supplied replacement templates, `{param}` placeholders included. */
+export type LexiconOverrides = Partial<Record<LexiconKey, string>>;
+/**
+ * What each key is: when the kernel uses it, who reads it, and the placeholders it takes. For the
+ * builders who replace the wording; the field catalog reads it for `lexicon.<key>`.
+ */
+export declare const LEXICON_NOTES: Record<LexiconKey, string>;
+export declare function lexiconPlaceholders(key: LexiconKey): readonly string[];
+/** `owner` names where the overrides came from in the error. */
+export declare function validateLexiconOverrides(entries: LexiconOverrides, owner: string): void;
+/** Process-wide; a profile's own `lexicon` wins over these. */
+export declare function overrideLexicon(entries: LexiconOverrides): void;
+export declare function resetLexicon(): void;
+export declare function lexiconText(key: LexiconKey, params?: LexiconParams, profileLexicon?: LexiconOverrides): string;
+/** Overrides only, resolved on the host; keys without one fall back to the defaults the client ships with. */
+export declare function clientLexicon(profileLexicon?: LexiconOverrides): LexiconOverrides;
+/** Ignores overrides. */
+export declare function lexiconDefault(key: LexiconKey, params?: LexiconParams): string;