@theoremjs/agents 0.0.0-stage → 0.3.1

package/esm/src/guardrails/egress-stream.js

@@ -0,0 +1,774 @@
+/**
+ * The detectors, Theorem's and the host's own, run on a reply as it streams.
+ *
+ * Each matches its patterns on the reply as written and, for
+ * injection phrasing, on
+ * rewrites of it (typo-folded, Unicode-folded, rot13, leet, URL-decoded, read
+ * backwards). The stream keeps each rewrite growing with the reply and, for
+ * every pattern, an automaton accepting every match of it and more
+ * (`egress-automata.ts`). Text is held from the earliest place any match could
+ * still be under way in any rewrite, and nowhere else: a match that completes
+ * later starts at or after that place, so none of it has been released.
+ *
+ * A match whose outcome no later text can change is settled; a settled match
+ * of the pattern itself (not the automaton) is a hit, and does what
+ * `guardrails.detect` sets (`detect-stream.ts`). Each character is read a bounded number of times, so a
+ * long reply costs time in proportion to its length.
+ *
+ * @module
+ */
+import { EGRESS_PATTERNS, notePattern, } from './egress-patterns.js';
+import { IMAGE_PATTERNS, imageReadings, LINK_PATTERNS, linkReadings, } from './egress-urls.js';
+import { decodeUrlRuns, INJECTION_BLOBS, TYPO_TARGETS, tryLeet, tryRot13, typoNormalize, } from './injection.js';
+import { REVERSED_INJECTION_PATTERNS } from './injection-reversed.js';
+import { isEmoji, normalizeCodePoint } from './normalize.js';
+import { detectRule } from './rules.js';
+import { cardHit, SENSITIVE_PATTERNS } from './sensitive.js';
+import { namePatterns } from './tool-leak.js';
+const UNITS = 0x10000;
+function compile(data) {
+    const classCount = data.classStarts.length;
+    const classOf = new Uint16Array(UNITS);
+    for (let k = 0; k < classCount; k++) {
+        classOf.fill(k, data.classStarts[k], data.classStarts[k + 1] ?? UNITS);
+    }
+    const has = data.charsets.map((classes) => {
+        const row = new Uint8Array(classCount);
+        for (const k of classes)
+            row[k] = 1;
+        return row;
+    });
+    const size = data.nodes.length;
+    const pattern = new Int32Array(size);
+    const final = new Uint8Array(size);
+    const edges = [];
+    data.nodes.forEach((node, id) => {
+        pattern[id] = node[0];
+        final[id] = node[1];
+        edges.push(Int32Array.from(node.slice(2)));
+    });
+    return { classOf, has, pattern, final, edges, initials: data.initials, leads: data.leads, size };
+}
+/** Theorem's automata, once `loadEgressAutomata` has read them. */
+let bundled;
+let forward;
+let backward;
+/**
+ * Reads Theorem's automata, the most of the kernel's size, the first time a stream needs them.
+ * Every gate's constructor waits for this, so an app that never streams a reply never loads them.
+ */
+async function loadEgressAutomata() {
+    if (bundled)
+        return;
+    const { FORWARD_AUTOMATON, REVERSED_AUTOMATON } = await import('./egress-automata.js');
+    bundled = { forward: FORWARD_AUTOMATON, reversed: REVERSED_AUTOMATON };
+}
+function loaded() {
+    if (!bundled) {
+        throw new Error('A stream was opened before loadEgressAutomata() finished.'); // labels-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+    }
+    return bundled;
+}
+/** The code units a case-insensitive regex reads as each one: ES `Canonicalize` without `u`. */
+let caseUnits;
+function canonicalUnit(unit) {
+    const upper = String.fromCharCode(unit).toUpperCase();
+    if (upper.length !== 1)
+        return unit;
+    const code = upper.charCodeAt(0);
+    return unit >= 0x80 && code < 0x80 ? unit : code;
+}
+function unitsLike(unit) {
+    if (!caseUnits) {
+        caseUnits = new Map();
+        for (let u = 0; u < UNITS; u++) {
+            const canon = canonicalUnit(u);
+            const units = caseUnits.get(canon);
+            if (units)
+                units.push(u);
+            else
+                caseUnits.set(canon, [u]);
+        }
+    }
+    return caseUnits.get(canonicalUnit(unit)) ?? [unit];
+}
+/** Class starts that give each of the sorted `units` a class of its own. */
+function classStartsOf(units) {
+    const classStarts = [0];
+    for (const unit of units) {
+        if (classStarts.at(-1) !== unit)
+            classStarts.push(unit);
+        if (unit + 1 < UNITS)
+            classStarts.push(unit + 1);
+    }
+    return classStarts;
+}
+/** Literal automata, kept per text so each is built once. */
+const literalAutomata = new Map();
+/** An automaton for `text` as written, case aside, as `notePattern` reads it. */
+function literalAutomaton(text) {
+    const cached = literalAutomata.get(text);
+    if (cached)
+        return cached;
+    const positions = Array.from({ length: text.length }, (_, i) => unitsLike(text.charCodeAt(i)));
+    const classStarts = classStartsOf([...new Set(positions.flat())].sort((a, b) => a - b));
+    const classOfUnit = (unit) => classStarts.indexOf(unit);
+    const charsets = positions.map((like) => like.map(classOfUnit));
+    const nodes = [...positions.map((_, i) => [0, 0, i + 1, i]), [0, 1]];
+    const automaton = compile({ classStarts, charsets, initials: [0], leads: [-1], nodes });
+    literalAutomata.set(text, automaton);
+    return automaton;
+}
+/**
+ * An automaton for each of `texts` as written, case and all: pattern `i` is `texts[i]`. Kept
+ * per list, so a profile's is built once. Each unit has a charset of its own: charset `k` is the
+ * class of `units[k]`.
+ */
+function literalsAutomaton(texts) {
+    const key = JSON.stringify(texts);
+    const cached = literalAutomata.get(key);
+    if (cached)
+        return cached;
+    const units = [...new Set(texts.flatMap((text) => Array.from(text, (c) => c.charCodeAt(0))))];
+    units.sort((a, b) => a - b);
+    const classStarts = classStartsOf(units);
+    const charsets = units.map((unit) => [classStarts.indexOf(unit)]);
+    const nodes = [];
+    const initials = texts.map((text, id) => {
+        const first = nodes.length;
+        for (let i = 0; i < text.length; i++) {
+            nodes.push([id, 0, nodes.length + 1, units.indexOf(text.charCodeAt(i))]);
+        }
+        nodes.push([id, 1]);
+        return first;
+    });
+    const leads = texts.map(() => -1);
+    const automaton = compile({ classStarts, charsets, initials, leads, nodes });
+    literalAutomata.set(key, automaton);
+    return automaton;
+}
+/** The first edges of the given patterns, per character class. */
+function startEdges(automaton, patterns) {
+    const classCount = automaton.has[0]?.length ?? 0;
+    const byClass = Array.from({ length: classCount }, () => []);
+    for (const p of patterns) {
+        const e = automaton.edges[automaton.initials[p]];
+        for (let i = 0; i < e.length; i += 2) {
+            const set = automaton.has[e[i + 1]];
+            for (let k = 0; k < classCount; k++)
+                if (set[k])
+                    byClass[k]?.push(e[i]);
+        }
+    }
+    return byClass.map((targets) => Int32Array.from(targets));
+}
+function grow(target, piece) {
+    target.text += piece;
+    target.fresh += piece;
+}
+/** Where `fresh` starts in `text`. */
+function freshFrom(source) {
+    return source.text.length - source.fresh.length;
+}
+function unitAt(source, at) {
+    const base = freshFrom(source);
+    return at >= base ? source.fresh.charCodeAt(at - base) : source.text.charCodeAt(at);
+}
+function sliceOf(source, from, to = source.text.length) {
+    const base = freshFrom(source);
+    return from >= base ? source.fresh.slice(from - base, to - base) : source.text.slice(from, to);
+}
+/** The reply itself. */
+function rawView(reply) {
+    const view = {
+        text: '',
+        fresh: '',
+        rawAt: (j) => j,
+        update() {
+            view.text = reply.text;
+            view.fresh = reply.fresh;
+        },
+    };
+    return view;
+}
+/** A rewrite of each UTF-16 unit on its own (rot13, leet): settled as soon as read. */
+function unitView(source, rewrite) {
+    const view = {
+        text: '',
+        fresh: '',
+        rawAt: source.rawAt,
+        update() {
+            view.fresh = '';
+            grow(view, rewrite(sliceOf(source, view.text.length)));
+        },
+    };
+    return view;
+}
+const WORD_UNIT = /\w/;
+const MAX_TARGET = Math.max(...TYPO_TARGETS.map((target) => target.length));
+/** Whether a word still being written could yet fold to a typo target: a misspelling may be a letter longer. */
+function mayFold(run) {
+    return run.length <= MAX_TARGET + 1 && /^[A-Za-z]*$/.test(run);
+}
+/**
+ * `typoNormalize` of the source. It rewrites whole words (`\w` runs), so a
+ * word settles when a non-word character ends it, or as soon as it can no
+ * longer fold to a target (then the rest of it passes as is). A corrected word
+ * may be a letter longer or shorter than the word as written, so each
+ * character keeps the source index it stands for.
+ */
+function typoView(source) {
+    let read = 0;
+    /** The word being read, while it may still fold. */
+    let word;
+    let inWord = false;
+    /** Per settled character, the source index it stands for. */
+    const from = [];
+    const put = (piece, start, length) => {
+        grow(view, piece);
+        for (let i = 0; i < piece.length; i++)
+            from.push(start + Math.min(i, length - 1));
+    };
+    const view = {
+        text: '',
+        fresh: '',
+        rawAt: (j) => source.rawAt(j < from.length ? from[j] : read - (word?.length ?? 0)),
+        update() {
+            view.fresh = '';
+            for (const end = source.text.length; read < end; read++) {
+                const unit = String.fromCharCode(unitAt(source, read));
+                const wordUnit = WORD_UNIT.test(unit);
+                if (wordUnit && !inWord)
+                    word = '';
+                inWord = wordUnit;
+                if (!wordUnit) {
+                    if (word !== undefined)
+                        put(typoNormalize(word), read - word.length, word.length);
+                    word = undefined;
+                    put(unit, read, 1);
+                }
+                else if (word === undefined)
+                    put(unit, read, 1);
+                else
+                    word += unit;
+            }
+            if (word !== undefined && !mayFold(word)) {
+                put(word, read - word.length, word.length);
+                word = undefined;
+            }
+        },
+    };
+    return view;
+}
+function mappedView(pendingAt) {
+    const view = {
+        text: '',
+        fresh: '',
+        from: [],
+        rawAt: (j) => (j < view.from.length ? view.from[j] : pendingAt()),
+        update() { },
+    };
+    return view;
+}
+function append(view, text, from) {
+    grow(view, text);
+    for (let i = 0; i < text.length; i++)
+        view.from.push(from);
+}
+const HIGH_LO = 0xd800;
+const HIGH_HI = 0xdbff;
+const ASCII_LETTER = /[A-Za-z]/;
+const LOW_LO = 0xdc00;
+const LOW_HI = 0xdfff;
+/**
+ * `normalizeForDetection` of the reply, in its three passes: each code point
+ * mapped, emoji runs between letters dropped, a backslash before a letter
+ * dropped. Unsettled: a high surrogate whose low half may follow (in the reply
+ * or in the mapped text), an emoji run after a letter until the character
+ * after it, a backslash until the character after it.
+ */
+function normalizedReplyView(reply) {
+    let read = 0;
+    /** Mapped text the emoji pass has not read: at most a trailing high surrogate. */
+    let mapped = '';
+    let mappedFrom = [];
+    /** The emoji run after a letter, waiting on the character after it. */
+    let run = '';
+    let runFrom = [];
+    let afterLetter = false;
+    /** A backslash waiting on the character after it: its reply index, or -1. */
+    let slashFrom = -1;
+    const pendingAt = () => Math.min(read, mappedFrom[0] ?? read, runFrom[0] ?? read, slashFrom < 0 ? read : slashFrom);
+    const view = mappedView(pendingAt);
+    function backslashPass(unit, from) {
+        if (slashFrom >= 0) {
+            if (!ASCII_LETTER.test(unit))
+                append(view, '\\', slashFrom);
+            slashFrom = -1;
+        }
+        if (unit === '\\')
+            slashFrom = from;
+        else
+            append(view, unit, from);
+    }
+    function emojiPass(point, from) {
+        if (isEmoji(point) && (afterLetter || run)) {
+            run += point;
+            for (let i = 0; i < point.length; i++)
+                runFrom.push(from);
+            return;
+        }
+        if (run) {
+            if (!ASCII_LETTER.test(point)) {
+                for (let i = 0; i < run.length; i++)
+                    backslashPass(run[i], runFrom[i]);
+            }
+            run = '';
+            runFrom = [];
+        }
+        for (let i = 0; i < point.length; i++)
+            backslashPass(point[i], from);
+        afterLetter = ASCII_LETTER.test(point) && point.length === 1;
+    }
+    /** Feed the mapped text to the emoji pass by code point, keeping a high surrogate at the end. */
+    function drainMapped() {
+        let i = 0;
+        while (i < mapped.length) {
+            const code = mapped.charCodeAt(i);
+            const high = code >= HIGH_LO && code <= HIGH_HI;
+            if (high && i + 1 >= mapped.length)
+                break;
+            const low = mapped.charCodeAt(i + 1);
+            const width = high && low >= LOW_LO && low <= LOW_HI ? 2 : 1;
+            emojiPass(mapped.slice(i, i + width), mappedFrom[i]);
+            i += width;
+        }
+        mapped = mapped.slice(i);
+        mappedFrom = mappedFrom.slice(i);
+    }
+    view.update = () => {
+        view.fresh = '';
+        const end = reply.text.length;
+        while (read < end) {
+            const code = unitAt(reply, read);
+            const high = code >= HIGH_LO && code <= HIGH_HI;
+            if (high && read + 1 >= end)
+                break;
+            const low = unitAt(reply, read + 1);
+            const width = high && low >= LOW_LO && low <= LOW_HI ? 2 : 1;
+            const out = normalizeCodePoint(sliceOf(reply, read, read + width));
+            mapped += out;
+            for (let i = 0; i < out.length; i++)
+                mappedFrom.push(read);
+            read += width;
+        }
+        drainMapped();
+    };
+    return view;
+}
+const URL_HEX = /[0-9A-Fa-f]/;
+/**
+ * `decodeUrlRuns` of the reply: a run of `%XX` escapes is unsettled until the
+ * character after it shows the run is over. Its decoded text holds from the
+ * run's first `%`.
+ */
+function urlView(reply) {
+    let read = 0;
+    /** Where the escape run being read starts, or -1. */
+    let runStart = -1;
+    const view = mappedView(() => (runStart < 0 ? read : runStart));
+    view.update = () => {
+        view.fresh = '';
+        const end = reply.text.length;
+        while (read < end) {
+            const unit = String.fromCharCode(unitAt(reply, read));
+            if (runStart < 0) {
+                if (unit === '%') {
+                    runStart = read;
+                }
+                else {
+                    append(view, unit, read);
+                    read++;
+                }
+                continue;
+            }
+            // why: Inside a run: complete escapes end at runStart + 3k.
+            const offset = (read - runStart) % 3;
+            const fits = offset === 0 ? unit === '%' : URL_HEX.test(unit);
+            if (fits) {
+                read++;
+                continue;
+            }
+            endRun(read - offset);
+            // why: The broken escape's text is literal; `read` rereads from its end.
+            for (let i = read - offset; i < read; i++)
+                append(view, String.fromCharCode(unitAt(reply, i)), i);
+        }
+    };
+    function endRun(end) {
+        if (end > runStart)
+            append(view, decodeUrlRuns(sliceOf(reply, runStart, end)), runStart);
+        runStart = -1;
+    }
+    return view;
+}
+const INJECTION_KINDS = new Set([
+    'injection',
+    'base64',
+    'hex',
+    'spaced',
+    'pipe',
+]);
+const BLOB_HITS = new Map(INJECTION_BLOBS.map(({ pattern, hit }) => [pattern, hit]));
+const SENSITIVE_HITS = new Map(SENSITIVE_PATTERNS.flatMap(({ pattern, hit }) => (hit ? [[pattern, hit]] : [])));
+/** What a match of `detector`, or of the host's own by its id, reports, with `detectAt`'s severity. */
+function detectorRule(detector) {
+    return { rule: detectRule(detector), severity: 'high', detector };
+}
+const INJECTION_RULE = detectorRule('injection');
+const MARKER_RULE = detectorRule('marker_leak');
+const TOOL_RULE = detectorRule('tool_leak');
+/** What a pattern's match reports: its detector's rule. */
+function patternRule({ kind, group }) {
+    if (INJECTION_KINDS.has(kind))
+        return INJECTION_RULE;
+    switch (kind) {
+        case 'sensitive':
+        case 'card':
+            return group === undefined ? undefined : detectorRule(group);
+        case 'boundary':
+            return MARKER_RULE;
+        case 'image':
+            return detectorRule('ungiven_images');
+        default:
+            return detectorRule('ungiven_links');
+    }
+}
+/** How a settled match of `pattern` is read: a test of the match, or a finder in place of the regex. */
+function patternReading(kind, pattern, urls) {
+    if (kind === 'card')
+        return { hit: cardHit };
+    if (kind === 'image' || kind === 'link') {
+        const index = (kind === 'image' ? IMAGE_PATTERNS : LINK_PATTERNS).indexOf(pattern);
+        const reading = urls[kind][index];
+        return 'find' in reading ? { find: reading.find } : { hit: reading.test };
+    }
+    const hit = BLOB_HITS.get(pattern) ?? SENSITIVE_HITS.get(pattern);
+    return hit ? { hit } : {};
+}
+/** The patterns of `detectors`, read on the reply as written. */
+function forwardPatterns(detectors, { given, allow, skipImages }) {
+    const scope = (check) => ({ ...check, ...(given ? { given } : {}) });
+    const urls = {
+        image: imageReadings(scope(allow?.ungiven_images)),
+        link: linkReadings(scope(allow?.ungiven_links), skipImages ?? detectors.includes('ungiven_images')),
+    };
+    const out = [];
+    EGRESS_PATTERNS.forEach((entry, id) => {
+        const rule = patternRule(entry);
+        if (!(rule?.detector && detectors.includes(rule.detector)))
+            return;
+        out.push({
+            ...rule,
+            id,
+            regex: new RegExp(entry.pattern.source, entry.pattern.flags),
+            ...patternReading(entry.kind, entry.pattern, urls),
+        });
+    });
+    return out;
+}
+/** The injection patterns, for the rewritten views. */
+function injectionPatterns() {
+    const out = [];
+    EGRESS_PATTERNS.forEach(({ kind, pattern }, id) => {
+        if (kind !== 'injection')
+            return;
+        const hit = BLOB_HITS.get(pattern);
+        out.push({
+            ...INJECTION_RULE,
+            id,
+            regex: new RegExp(pattern.source, pattern.flags),
+            ...(hit ? { hit } : {}),
+        });
+    });
+    return out;
+}
+function reversedPatterns() {
+    return REVERSED_INJECTION_PATTERNS.map((pattern, id) => ({
+        ...INJECTION_RULE,
+        id,
+        regex: new RegExp(pattern.source, pattern.flags),
+    }));
+}
+/**
+ * One view scanned for some patterns: the automata, run one character at a
+ * time, give where each pattern could still be matching; the pattern's own
+ * regex, run only where the automaton reached a match, finds the match and
+ * whether it has settled. A pattern opened by an optional repeat of one class
+ * has no thread for the repeat: a thread of it starts where the run of that
+ * class it is in started, and the run the text ends in is still under way.
+ * A pattern whose matches nest (tags inside tags) is
+ * read instead by its finder, once over each stretch that settles.
+ */
+function createScan(view, automaton, patterns) {
+    const starts = startEdges(automaton, patterns.map((p) => p.id));
+    const local = new Int32Array(automaton.initials.length).fill(-1);
+    patterns.forEach((p, i) => {
+        local[p.id] = i;
+    });
+    let nodes = new Int32Array(automaton.size);
+    let from = new Int32Array(automaton.size);
+    let next = new Int32Array(automaton.size);
+    let nextFrom = new Int32Array(automaton.size);
+    let count = 0;
+    const slot = new Int32Array(automaton.size);
+    const mark = new Int32Array(automaton.size);
+    let step = 0;
+    let fed = 0;
+    const reached = new Uint8Array(patterns.length);
+    /** Whether the regex must look again: a match of it was unsettled, or its automaton sat on a final state. */
+    const recheck = new Uint8Array(patterns.length);
+    const resume = new Int32Array(patterns.length);
+    const liveFrom = new Int32Array(patterns.length);
+    const atFinal = new Uint8Array(patterns.length);
+    const finds = Uint8Array.from(patterns, (p) => (p.find ? 1 : 0));
+    /**
+     * Per finder: where its automaton first started a thread since the finder
+     * last read, or -1. A construct starts where a thread does, so a stretch
+     * with none needs no read; skipping it keeps a reply with no constructs from
+     * being reread whole at every step.
+     */
+    const openedFrom = new Int32Array(patterns.length).fill(-1);
+    const lastOpened = new Int32Array(patterns.length).fill(-1);
+    const leadOf = Int32Array.from(patterns, (p) => automaton.leads[p.id] ?? -1);
+    const leads = [...new Set(leadOf)].filter((lead) => lead >= 0);
+    const led = patterns.flatMap((_, p) => (leadOf[p] < 0 ? [] : [p]));
+    /** Per lead charset: where the run of it the text ends in started, or -1. */
+    const runFrom = new Int32Array(automaton.has.length).fill(-1);
+    function feed() {
+        const { text, fresh } = view;
+        const base = freshFrom(view);
+        const { classOf, has, edges, final, pattern } = automaton;
+        for (; fed < text.length; fed++) {
+            const code = fed >= base ? fresh.charCodeAt(fed - base) : text.charCodeAt(fed);
+            const cls = classOf[code];
+            step++;
+            let size = 0;
+            const add = (target, start) => {
+                if (mark[target] === step) {
+                    const at = slot[target];
+                    if (start < nextFrom[at])
+                        nextFrom[at] = start;
+                    return;
+                }
+                mark[target] = step;
+                slot[target] = size;
+                next[size] = target;
+                nextFrom[size] = start;
+                size++;
+                if (final[target])
+                    reached[local[pattern[target]]] = 1;
+            };
+            for (let i = 0; i < count; i++) {
+                const e = edges[nodes[i]];
+                const start = from[i];
+                for (let k = 0; k < e.length; k += 2) {
+                    if (has[e[k + 1]][cls])
+                        add(e[k], start);
+                }
+            }
+            const first = starts[cls];
+            for (let k = 0; k < first.length; k++) {
+                const target = first[k];
+                const p = local[pattern[target]];
+                const lead = leadOf[p];
+                const run = lead < 0 ? -1 : runFrom[lead];
+                const start = run < 0 ? fed : run;
+                add(target, start);
+                if (finds[p]) {
+                    lastOpened[p] = fed;
+                    if (openedFrom[p] < 0)
+                        openedFrom[p] = start;
+                }
+            }
+            for (const lead of leads) {
+                if (!has[lead][cls])
+                    runFrom[lead] = -1;
+                else if (runFrom[lead] < 0)
+                    runFrom[lead] = fed;
+            }
+            [nodes, next] = [next, nodes];
+            [from, nextFrom] = [nextFrom, from];
+            count = size;
+        }
+    }
+    /** Per pattern: the earliest start still under way, and whether it sits on a final state. */
+    function live() {
+        const end = view.text.length;
+        liveFrom.fill(end);
+        atFinal.fill(0);
+        let earliest = end;
+        for (let i = 0; i < count; i++) {
+            const node = nodes[i];
+            const p = local[automaton.pattern[node]];
+            const start = from[i];
+            if (start < liveFrom[p])
+                liveFrom[p] = start;
+            if (automaton.final[node])
+                atFinal[p] = 1;
+            if (start < earliest)
+                earliest = start;
+        }
+        for (const p of led) {
+            const run = runFrom[leadOf[p]];
+            if (run < 0)
+                continue;
+            if (run < liveFrom[p])
+                liveFrom[p] = run;
+            if (run < earliest)
+                earliest = run;
+        }
+        return earliest;
+    }
+    /** A finder's hit up to `settledTo`, run only on a stretch its automaton opened a thread in. */
+    function found(p, settledTo) {
+        const opened = openedFrom[p];
+        const from = resume[p];
+        if (opened < 0 || opened >= settledTo) {
+            resume[p] = settledTo;
+            return undefined;
+        }
+        const { find, rule, severity, detector } = patterns[p];
+        const at = find?.(view.text, from, settledTo);
+        if (at === undefined) {
+            resume[p] = settledTo;
+            openedFrom[p] = lastOpened[p] >= settledTo ? settledTo : -1;
+            return undefined;
+        }
+        // why: A detector's match need not end the reply, so the next call finds the one after it.
+        resume[p] = Math.max(from, at) + 1;
+        return { rule, severity, start: view.rawAt(at), detector };
+    }
+    /** A regex pattern's hit up to `settledTo`. */
+    function matched(p, settledTo) {
+        if (!reached[p] && !recheck[p]) {
+            resume[p] = settledTo;
+            return undefined;
+        }
+        reached[p] = 0;
+        const text = view.text;
+        const { regex, hit, rule, severity, detector } = patterns[p];
+        regex.lastIndex = resume[p];
+        for (;;) {
+            const match = regex.exec(text);
+            if (!match || match.index >= settledTo) {
+                resume[p] = settledTo;
+                recheck[p] = match || atFinal[p] ? 1 : 0;
+                return undefined;
+            }
+            const [blob] = match;
+            if (blob && (!hit || hit(blob, text, match.index))) {
+                // why: The scan reads on from the end of the match, so the next call finds the one after it.
+                resume[p] = regex.lastIndex;
+                recheck[p] = 1;
+                return { rule, severity, start: view.rawAt(match.index), detector };
+            }
+            if (!blob)
+                regex.lastIndex++;
+            resume[p] = regex.lastIndex;
+        }
+    }
+    function detect() {
+        for (let p = 0; p < patterns.length; p++) {
+            const settledTo = liveFrom[p];
+            if (settledTo <= resume[p])
+                continue;
+            const hit = patterns[p].find ? found(p, settledTo) : matched(p, settledTo);
+            if (hit)
+                return hit;
+        }
+        return undefined;
+    }
+    return {
+        /** Read what the view settled into `hits`; the reply index to hold from. */
+        run(hits) {
+            feed();
+            const earliest = live();
+            for (let hit = detect(); hit; hit = detect())
+                hits.push(hit);
+            return view.rawAt(earliest);
+        },
+    };
+}
+/** Compiled host automata, kept per table so each is built once. */
+const hostAutomata = new WeakMap();
+function hostAutomaton(data) {
+    let automaton = hostAutomata.get(data);
+    if (!automaton) {
+        automaton = compile(data);
+        hostAutomata.set(data, automaton);
+    }
+    return automaton;
+}
+/** Scans the detectors' patterns, Theorem's and the host's own, as a reply streams. */
+function createEgressStream(options = {}) {
+    const reply = { text: '', fresh: '' };
+    const raw = rawView(reply);
+    const views = [raw];
+    const scan = (view, automaton, patterns) => {
+        if (!views.includes(view))
+            views.push(view);
+        return createScan(view, automaton, patterns);
+    };
+    const scans = [];
+    const detectors = options.detect ?? [];
+    const forwardScan = forwardPatterns(detectors, options);
+    if (forwardScan.length > 0) {
+        forward ??= compile(loaded().forward);
+        scans.push(scan(raw, forward, forwardScan));
+    }
+    if (detectors.includes('injection')) {
+        forward ??= compile(loaded().forward);
+        backward ??= compile(loaded().reversed);
+        const normalized = normalizedReplyView(reply);
+        const injection = injectionPatterns();
+        scans.push(scan(raw, backward, reversedPatterns()), scan(typoView(raw), forward, injection), scan(normalized, forward, injection), scan(typoView(normalized), forward, injection), scan(unitView(raw, tryRot13), forward, injection), scan(unitView(raw, (text) => tryLeet(text) ?? text), forward, injection), scan(urlView(reply), forward, injection));
+    }
+    if (detectors.includes('marker_leak') && options.note) {
+        const regex = notePattern(options.note);
+        scans.push(scan(raw, literalAutomaton(options.note), [{ ...MARKER_RULE, id: 0, regex }]));
+    }
+    if (detectors.includes('tool_leak') && options.tools) {
+        const names = namePatterns(options.tools);
+        const patterns = names.map(({ regex }, id) => ({ ...TOOL_RULE, id, regex }));
+        if (names.length > 0) {
+            scans.push(scan(raw, literalsAutomaton(names.map(({ literal }) => literal)), patterns));
+        }
+    }
+    for (const { detector, compiled, matchers } of options.own ?? []) {
+        const patterns = matchers.map(({ regex }, id) => ({
+            ...detectorRule(detector),
+            id,
+            regex: new RegExp(regex.source, regex.flags),
+        }));
+        scans.push(scan(raw, hostAutomaton(compiled.automaton), patterns));
+    }
+    let hold = 0;
+    return {
+        push(chunk) {
+            reply.text += chunk;
+            reply.fresh = chunk;
+            for (const view of views)
+                view.update();
+            const hits = [];
+            let from = reply.text.length;
+            for (const s of scans) {
+                from = Math.min(from, s.run(hits));
+            }
+            hold = from;
+            return hits;
+        },
+        holdFrom: () => hold,
+    };
+}
+export { createEgressStream, loadEgressAutomata, normalizedReplyView, typoView, urlView };