@theoremjs/agents 0.0.0-stage → 0.3.1

package/esm/src/guardrails/host-patterns.d.ts

@@ -0,0 +1,85 @@
+/** labels-exempt-file: profile-registration diagnostics for a host's patterns — not runtime user or model copy (P2) */
+/**
+ * A pattern of the host's own, as data: a regular expression, or words. Words match whole and
+ * without regard to case, and a space in one matches any run of whitespace.
+ */
+type HostPattern = {
+    /** What a match is called in the trace. */
+    name: string;
+    /** The source of a regular expression. */
+    pattern: string;
+    /** Any of `i`, `m`, `s`, and `u`. Every match is found, so `g` is implied; `y` is refused. */
+    flags?: string;
+} | {
+    /** What a match is called in the trace. */
+    name: string;
+    words: readonly string[];
+};
+/**
+ * An automaton over UTF-16 code units, as tables.
+ *
+ * - `classStarts`: first code unit of each character class; class k covers
+ *   `[classStarts[k], classStarts[k+1])`.
+ * - `charsets`: each charset as the sorted class ids it contains.
+ * - `initials`: the initial node of each pattern.
+ * - `leads`: per pattern, the charset an optional repeat opening it reads, or
+ *   -1. The pattern's nodes are of what follows the repeat.
+ * - `nodes`: each node as `[pattern, final (0/1), target, charset, target, charset, ...]`.
+ */
+interface AutomatonData {
+    classStarts: readonly number[];
+    charsets: readonly (readonly number[])[];
+    initials: readonly number[];
+    leads: readonly number[];
+    nodes: readonly (readonly number[])[];
+}
+/**
+ * What compiling a list of patterns writes (`compilePatterns`, `agents detect-compile`): the
+ * patterns it read and checked, and their automaton. A stream holds exactly the text a match
+ * could still be under way in by it.
+ */
+interface CompiledPatterns {
+    /** `PATTERN_COMPILER_VERSION` of the compiler that wrote it. */
+    compiler: number;
+    /** Each pattern as compiled, in order: a table that no longer matches its patterns is refused. */
+    patterns: readonly PatternSource[];
+    automaton: AutomatonData;
+}
+/** A pattern as the kernel runs it: the source and flags of its regular expression. */
+interface PatternSource {
+    name: string;
+    source: string;
+    flags: string;
+}
+/** A host pattern ready to run. */
+interface HostMatcher {
+    name: string;
+    /** Global, so every match is found. */
+    regex: RegExp;
+}
+/** Bumped whenever the compiled table's layout or meaning changes. */
+declare const PATTERN_COMPILER_VERSION = 3;
+/** The most patterns one detector takes, and the longest each may be once written as a regular expression. */
+declare const MAX_PATTERNS = 64;
+declare const MAX_PATTERN_LENGTH = 1024;
+/** The patterns as a compiled table records them. */
+declare function patternSources(patterns: readonly HostPattern[]): PatternSource[];
+/** What is wrong with one pattern, or `undefined` when it runs. */
+declare function patternProblem(path: string, pattern: unknown): string | undefined;
+/**
+ * What is wrong with a detector's `patterns` and the table `compiled` for them, or `undefined`
+ * when both are sound. Patterns need their table: compiling is where a pattern that could take
+ * more than linear time on hostile text is refused.
+ */
+declare function patternsProblem(path: string, patterns: unknown, compiled: unknown): string | undefined;
+/**
+ * What is wrong with a list of patterns before it is compiled, or `undefined`: an editor checks
+ * with it as the patterns are written.
+ */
+declare function patternListProblem(path: string, patterns: unknown): string | undefined;
+/** Whether any detector of `detect` lists patterns of the host's own, which need compiling. */
+declare function listsPatterns(detect: unknown): boolean;
+/** `patterns`, valid, ready to run. */
+declare function matchersOf(patterns: readonly HostPattern[]): readonly HostMatcher[];
+export type { AutomatonData, CompiledPatterns, HostMatcher, HostPattern, PatternSource };
+export { listsPatterns, MAX_PATTERN_LENGTH, MAX_PATTERNS, matchersOf, PATTERN_COMPILER_VERSION, patternListProblem, patternProblem, patternSources, patternsProblem, };

package/esm/src/guardrails/host-patterns.js

@@ -0,0 +1,173 @@
+// invariant: Leaf module. Imports nothing from `src/guardrails/types.ts` or `src/kernel/`, so
+// `detectors.ts` can read a host's patterns without a cycle.
+/** Bumped whenever the compiled table's layout or meaning changes. */
+const PATTERN_COMPILER_VERSION = 3;
+/** The most patterns one detector takes, and the longest each may be once written as a regular expression. */
+const MAX_PATTERNS = 64;
+const MAX_PATTERN_LENGTH = 1024;
+const PATTERN_FLAGS = 'imsu';
+/** A letter, digit, or underscore in any script: what a word may not touch on either side. */
+const WORD_UNIT = '[\\p{L}\\p{N}_]';
+function escaped(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/** `words` as one alternation, longest first so a word is not cut short by one it starts with. */
+function wordsSource(words) {
+    const alternatives = [...new Set(words.map((word) => word.trim()).filter(Boolean))]
+        .sort((left, right) => right.length - left.length)
+        .map((word) => word.split(/\s+/).map(escaped).join('\\s+'));
+    return `(?<!${WORD_UNIT})(?:${alternatives.join('|')})(?!${WORD_UNIT})`;
+}
+/** The regular expression `pattern` runs as. */
+function patternSource(pattern) {
+    if ('words' in pattern) {
+        return { name: pattern.name, source: wordsSource(pattern.words), flags: 'iu' };
+    }
+    return { name: pattern.name, source: pattern.pattern, flags: pattern.flags ?? '' };
+}
+/** The patterns as a compiled table records them. */
+function patternSources(patterns) {
+    return patterns.map(patternSource);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function isStrings(value) {
+    return Array.isArray(value) && value.every((item) => typeof item === 'string');
+}
+/** What is wrong with the shape of one pattern, before it is compiled. */
+function shapeProblem(path, pattern) {
+    if (!isRecord(pattern))
+        return `${path} must be an object`;
+    const { name, words, flags } = pattern;
+    if (typeof name !== 'string' || !name.trim())
+        return `${path}.name must be a non-empty string`;
+    const kinds = ['pattern', 'words'].filter((key) => pattern[key] !== undefined);
+    if (kinds.length !== 1)
+        return `${path} takes one of pattern and words`;
+    const unknown = Object.keys(pattern).find((key) => !['name', 'pattern', 'flags', 'words'].includes(key));
+    if (unknown !== undefined) {
+        return `${path}.${unknown} is not a setting of a pattern (name, pattern, flags, words)`;
+    }
+    if (words !== undefined) {
+        if (flags !== undefined)
+            return `${path}.flags is a setting of pattern, not of words`;
+        if (!isStrings(words) || !words.some((word) => word.trim())) {
+            return `${path}.words must be a list with at least one word`;
+        }
+        return undefined;
+    }
+    if (typeof pattern.pattern !== 'string' || !pattern.pattern) {
+        return `${path}.pattern must be a non-empty string`;
+    }
+    if (flags === undefined)
+        return undefined;
+    if (typeof flags !== 'string')
+        return `${path}.flags must be a string`;
+    const bad = [...flags].find((flag, at) => !PATTERN_FLAGS.includes(flag) || flags.indexOf(flag) < at);
+    if (bad === 'y')
+        return `${path}.flags: a sticky (y) pattern only matches where the last one ended`;
+    if (bad === 'g')
+        return `${path}.flags: g is implied, every match is found`;
+    return bad === undefined
+        ? undefined
+        : `${path}.flags takes each of ${[...PATTERN_FLAGS].join(', ')} once, not ${JSON.stringify(bad)}`;
+}
+/** What is wrong with one pattern, or `undefined` when it runs. */
+function patternProblem(path, pattern) {
+    const shape = shapeProblem(path, pattern);
+    if (shape !== undefined)
+        return shape;
+    const { source, flags } = patternSource(pattern);
+    if (source.length > MAX_PATTERN_LENGTH) {
+        return `${path} is ${source.length} characters as a regular expression; the most is ${MAX_PATTERN_LENGTH}`;
+    }
+    let regex;
+    try {
+        // why: this only checks that the pattern parses and tests it on the empty text; a pattern that
+        // could run away on hostile text is refused when it is compiled (compilePatterns).
+        regex = new RegExp(source, `${flags}g`);
+    }
+    catch (err) {
+        return `${path} does not compile (${err instanceof Error ? err.message : String(err)})`;
+    }
+    // why: A pattern the empty text matches matches between every two characters: it names nothing.
+    return regex.test('') ? `${path} matches the empty text` : undefined;
+}
+/** Whether `compiled` was written for `sources` by this compiler. */
+function compiledProblem(path, compiled, sources) {
+    const again = 'run `agents detect-compile` or compilePatterns again';
+    if (!isRecord(compiled) || !isRecord(compiled.automaton) || !Array.isArray(compiled.patterns)) {
+        return `${path} must be the table compilePatterns or \`agents detect-compile\` writes`;
+    }
+    if (compiled.compiler !== PATTERN_COMPILER_VERSION) {
+        return `${path} comes from compiler ${String(compiled.compiler)}, this one is ${PATTERN_COMPILER_VERSION}; ${again}`;
+    }
+    return JSON.stringify(compiled.patterns) === JSON.stringify(sources)
+        ? undefined
+        : `${path} was compiled from other patterns; ${again}`;
+}
+/**
+ * What is wrong with a detector's `patterns` and the table `compiled` for them, or `undefined`
+ * when both are sound. Patterns need their table: compiling is where a pattern that could take
+ * more than linear time on hostile text is refused.
+ */
+function patternsProblem(path, patterns, compiled) {
+    if (patterns === undefined) {
+        return compiled === undefined ? undefined : `${path}.compiled is set without patterns`;
+    }
+    const problem = patternListProblem(path, patterns);
+    if (problem !== undefined)
+        return problem;
+    if (patterns.length === 0) {
+        return compiled === undefined ? undefined : `${path}.compiled is set without patterns`;
+    }
+    if (compiled === undefined) {
+        return `${path}.patterns need their compiled table: set ${path}.compiled from \`agents detect-compile\`, or wrap the detect setting in compileDetect from @theoremjs/agents/guardrails/compile`;
+    }
+    return compiledProblem(`${path}.compiled`, compiled, patternSources(patterns));
+}
+/**
+ * What is wrong with a list of patterns before it is compiled, or `undefined`: an editor checks
+ * with it as the patterns are written.
+ */
+function patternListProblem(path, patterns) {
+    if (!Array.isArray(patterns))
+        return `${path}.patterns must be a list`;
+    if (patterns.length > MAX_PATTERNS) {
+        return `${path}.patterns lists ${patterns.length} patterns; the most is ${MAX_PATTERNS}`;
+    }
+    const names = new Set();
+    for (const [index, pattern] of patterns.entries()) {
+        const at = `${path}.patterns[${index}]`;
+        const problem = patternProblem(at, pattern);
+        if (problem !== undefined)
+            return problem;
+        const { name } = pattern;
+        if (names.has(name))
+            return `${at}.name ${JSON.stringify(name)} is listed twice`;
+        names.add(name);
+    }
+    return undefined;
+}
+/** Whether any detector of `detect` lists patterns of the host's own, which need compiling. */
+function listsPatterns(detect) {
+    if (!isRecord(detect))
+        return false;
+    return Object.values(detect).some((rule) => isRecord(rule) && Array.isArray(rule.patterns) && rule.patterns.length > 0);
+}
+/** The matchers of each list of patterns, built once: a profile's patterns are resolved every turn. */
+const MATCHERS = new WeakMap();
+/** `patterns`, valid, ready to run. */
+function matchersOf(patterns) {
+    let matchers = MATCHERS.get(patterns);
+    if (!matchers) {
+        matchers = patternSources(patterns).map(({ name, source, flags }) => ({
+            name,
+            regex: new RegExp(source, `${flags}g`),
+        }));
+        MATCHERS.set(patterns, matchers);
+    }
+    return matchers;
+}
+export { listsPatterns, MAX_PATTERN_LENGTH, MAX_PATTERNS, matchersOf, PATTERN_COMPILER_VERSION, patternListProblem, patternProblem, patternSources, patternsProblem, };

package/esm/src/guardrails/injection-patterns.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The prompt-injection patterns, apart from the code that runs them, so the
+ * egress automata generator (`scripts/gen-egress-automata.ts`) can read them
+ * without the generated table it writes.
+ *
+ * @module
+ */
+/**
+ * An order to set instructions aside, with up to `gap` words between the verb
+ * and its object. `word` is what a word in the gap may be.
+ */
+declare function overrideFrame(gap: number, word?: string): string;
+declare const INJECTION_PATTERNS: RegExp[];
+/** Runs that might encode an injection; each is decoded and checked in `injection.ts`. */
+declare const BASE64_BLOB: RegExp;
+declare const HEX_BLOB: RegExp;
+declare const SPACED_LETTERS: RegExp;
+/** Three+ alphabetic tokens joined by `|` (no shell spaces around pipes). */
+declare const PIPE_SEPARATED: RegExp;
+export { BASE64_BLOB, HEX_BLOB, INJECTION_PATTERNS, overrideFrame, PIPE_SEPARATED, SPACED_LETTERS };

package/esm/src/guardrails/injection-patterns.js

@@ -0,0 +1,126 @@
+/**
+ * The prompt-injection patterns, apart from the code that runs them, so the
+ * egress automata generator (`scripts/gen-egress-automata.ts`) can read them
+ * without the generated table it writes.
+ *
+ * @module
+ */
+const IGNORE_PREVIOUS = /ignore\s+(all\s+)?(previous|prior)\s+((?:safety|security|system|operational|internal|core|original|initial|existing|given|stated|provided|defined|specified|established)\s+)?(instructions?|rules?|guidelines?|constraints?|directives?)/gi;
+const DISREGARD_INSTRUCTIONS = /disregard\s+(all\s+)?(previous|prior|above)\s+(instructions?|rules?|guidelines?|constraints?|directives?)/gi;
+const FORGET_INSTRUCTIONS = /forget\s+(all\s+)?(previous|prior|above)\s+(instructions?|rules?|guidelines?|constraints?|directives?)/gi;
+const NEW_INSTRUCTIONS = /new\s+instructions?:/gi;
+const DO_NOT_FOLLOW = /do\s+not\s+follow\s+(the\s+)?(system|developer|previous|original)/gi;
+const SUPERSEDE_INSTRUCTIONS = /supersedes?\s+(all\s+)?(prior|previous)\s+(instructions?|rules?|guidelines?|constraints?|directives?)/gi;
+const VOID_INSTRUCTIONS = /(all\s+)?(previous|prior)\s+instructions?\s+(are|is)\s+(void|invalid|null|obsolete|cancelled|revoked)/gi;
+const DEVELOPER_MODE = /you\s+are\s+now\s+(in\s+)?developer\s+mode/gi;
+const ENTER_SPECIAL_MODE = /enter\s+(developer|admin|debug|maintenance)\s+mode(?!\s+(?:in|on|via|through|from|using|for)\b)/gi;
+const ACTIVATE_SPECIAL_MODE = /activate\s+(developer|admin|debug|jailbreak)\s+mode(?!\s+(?:in|on|via|through|from|using|for)\b)/gi;
+const SYSTEM_OVERRIDE = /\bsystem\s+override\b/gi;
+const OVERRIDE_INSTRUCTIONS = /override\s+(your\s+)?(instructions?|rules?|guidelines?|constraints?|directives?)/gi;
+const REVEAL_PROMPT = /reveal\s+((?:your?|yoru|yuor|the|my|its|his|her|our|their)\s+)?((?:(?:full|hidden|complete|internal|secret|original|entire|exact|actual|real)\s+){0,2})((?:system|systme|sysetm|systemp?)\s+)?prompt\b/gi;
+const SHOW_PROMPT = /show\s+(me\s+)?((?:your?|yoru|yuor|the|my|its|his|her|our|their)\s+)((?:system|systme|sysetm|systemp?)\s+)?prompt\b/gi;
+const WHAT_INSTRUCTIONS = /what\s+(are|were)\s+(your\s+)?(exact\s+)?instructions/gi;
+const REPEAT_INSTRUCTIONS = /repeat\s+(the\s+)?(text|instructions?)\s+(above|before)/gi;
+const OUTPUT_PROMPT = /output\s+(your\s+)?(initial|original|system)\s+(prompt|instructions?)/gi;
+const REMOVE_RESTRICTIONS = /you\s+are\s+no\s+longer\s+(bound|restricted|limited)/gi;
+const ACT_UNBOUND = /act\s+as\s+if\s+(you('re|\s+are)\s+)?not\s+bound/gi;
+const PRETEND_DIFFERENT = /pretend\s+(you('re|\s+are)\s+)?(a\s+)?different\s+(ai|assistant|model)/gi;
+const IDENTITY_HIJACK = /you\s+are\s+now\s+(?:(?:a|an)\s+)?\w+.{0,40}(without\s+(any\s+)?restrict|ignor\w*\s+(all|any|every|prev)|bypass|unrestrict|unlimit|obey\s+only|no\s+(rules|limits|restrict|boundari))/gi;
+const DAN_JAILBREAK = /\bDAN\b[\s\S]{0,120}\bdo\s+anything\s+now\b/g;
+const JAILBREAK_MODE = /jailbreak(ed)?\s+(mode|prompt)/gi;
+const DO_ANYTHING_NOW = /\bdo\s+anything\s+now\b/gi;
+const BYPASS_SAFETY = /bypass\s+(your\s+)?(safety|security|content|ethical)\s+(filters?|measures?|guidelines?|restrictions?)/gi;
+const DISABLE_SAFETY = /(disable|delete|remove|turn\s+off|eliminate)\s+(all\s+)?(your\s+)?(safety|security|content)\s+(filters?|measures?|rules?|guidelines?|restrictions?)/gi;
+const IGNORE_SAFETY = /(ignore|disregard)\s+(all\s+)?(your\s+)?(safety|security|ethical|content)\s+(guidelines?|rules?|restrictions?|measures?|filters?|polic(?:y|ies)|protocols?)/gi;
+/** Bound whitespace so tag scanners cannot polynomial-backtrack on long runs. */
+const TAG_WS = String.raw `[^\S\r\n]{0,32}`;
+const SYSTEM_TAG = new RegExp(`<${TAG_WS}\\/?${TAG_WS}system${TAG_WS}\\/?>`, 'gi');
+const ROLE_TAG = new RegExp(`<${TAG_WS}\\/?${TAG_WS}(assistant|developer|tool|function)${TAG_WS}\\/?>`, 'gi');
+const ROLE_DELIMITER = /\][^\S\r\n]{0,32}\n[^\S\r\n]{0,32}\[?(system|assistant|user)\]?:/gi;
+const BRACKETED_ROLE = /\[[^\S\r\n]{0,32}(System[^\S\r\n]{0,8}Message|System|Assistant|Internal)[^\S\r\n]{0,32}\]/gi;
+const SYSTEM_YOU_ARE = /^[^\S\r\n]{0,32}System:[^\S\r\n]{1,32}(you\s+are|ignore|override)/gim;
+const CONTROL_TOKEN = /<\|(?:im_start|im_end|eot_id|start_header_id|end_header_id|endoftext)\|>/g;
+const DEEPSEEK_CONTROL = /<｜(?:end▁of▁sentence|begin▁of▁sentence)｜>/g;
+const LLAMA_INST = /\[\/?INST\]/gi;
+const IGNORE_YOUR_INSTRUCTIONS = /ignore\s+(all\s+)?(your\s+)?(instructions?|rules?)\b/gi;
+const UNRESTRICTED_MODE = /\bunrestricted\s+(ai|mode|model)\b/gi;
+const IGNORE_MULTILANG = /\b(?:ignorieren|ignorez|ignora|ignorer|oubliez|vergessen|olvida|desestima|missachten)\b[\s\S]{0,50}\b(?:anweisungen|instructions?|instrucciones|directives?|r[eè]gles|reglas)\b/gi;
+/** The verbs that tell a reader to set a thing aside, as written to give an order. */
+const OVERRIDE_VERB = 'ignore|disregard|forget|override|bypass';
+/** What an agent is told to set aside. */
+const OVERRIDE_OBJECT = 'instructions?|rules|guidelines?|constraints?|directives?|prompts?';
+const FRAME_WORD = String.raw `[\w'’-]{1,40}`;
+/**
+ * An order to set instructions aside, with up to `gap` words between the verb
+ * and its object. `word` is what a word in the gap may be.
+ */
+function overrideFrame(gap, word = FRAME_WORD) {
+    return String.raw `\b(?:${OVERRIDE_VERB})\s+(?:${word}\s+){0,${gap}}(?:${OVERRIDE_OBJECT})\b`;
+}
+/** The verb is negated: "never ignore the rules". */
+const NEGATED = String.raw `(?<!(?:\b(?:not|never|cannot|without)|n['’]t)\s+(?:${FRAME_WORD}\s+)?)`;
+/** The verb is a noun: "his disregard for the rules". */
+const NOUN_USE = String.raw `(?<!\b(?:the|a|an|his|her|its|their|your|my|our)\s+)`;
+/**
+ * The verb reports or describes, and "you" is not its subject: "an attempt to
+ * bypass the rules", "I must ignore the instructions", "they override
+ * constraints". "you must ignore the rules" and "I want you to ignore the
+ * rules" stay orders.
+ */
+const DESCRIBED = String.raw `(?:(?<=\byou\s+(?:${FRAME_WORD}\s+){0,2})|(?<!\b(?:to|must|should|would|will|can|could|may|might|shall|I|we|they|he|she|it|who|that|which)\s+(?:\w+ly\s+)?))`;
+/** A word in the gap that is not the writer's own: "ignore my rules" speaks of the writer's rules. */
+const NOT_OWN = String.raw `(?!(?:my|our)\b)${FRAME_WORD}`;
+/**
+ * {@linkcode overrideFrame} where the verb gives the reader an order about
+ * the reader's instructions. The patterns above still match their own wording
+ * in every guarded case.
+ */
+const OVERRIDE_FRAME = new RegExp(`${NEGATED}${NOUN_USE}${DESCRIBED}${overrideFrame(3, NOT_OWN)}`, 'gi');
+const INJECTION_PATTERNS = [
+    IGNORE_PREVIOUS,
+    DISREGARD_INSTRUCTIONS,
+    FORGET_INSTRUCTIONS,
+    NEW_INSTRUCTIONS,
+    DO_NOT_FOLLOW,
+    SUPERSEDE_INSTRUCTIONS,
+    VOID_INSTRUCTIONS,
+    DEVELOPER_MODE,
+    ENTER_SPECIAL_MODE,
+    ACTIVATE_SPECIAL_MODE,
+    SYSTEM_OVERRIDE,
+    OVERRIDE_INSTRUCTIONS,
+    REVEAL_PROMPT,
+    SHOW_PROMPT,
+    WHAT_INSTRUCTIONS,
+    REPEAT_INSTRUCTIONS,
+    OUTPUT_PROMPT,
+    REMOVE_RESTRICTIONS,
+    ACT_UNBOUND,
+    PRETEND_DIFFERENT,
+    IDENTITY_HIJACK,
+    DAN_JAILBREAK,
+    JAILBREAK_MODE,
+    DO_ANYTHING_NOW,
+    BYPASS_SAFETY,
+    DISABLE_SAFETY,
+    IGNORE_SAFETY,
+    SYSTEM_TAG,
+    ROLE_TAG,
+    ROLE_DELIMITER,
+    BRACKETED_ROLE,
+    SYSTEM_YOU_ARE,
+    CONTROL_TOKEN,
+    DEEPSEEK_CONTROL,
+    LLAMA_INST,
+    IGNORE_YOUR_INSTRUCTIONS,
+    UNRESTRICTED_MODE,
+    IGNORE_MULTILANG,
+    OVERRIDE_FRAME,
+];
+/** Runs that might encode an injection; each is decoded and checked in `injection.ts`. */
+const BASE64_BLOB = /[A-Za-z0-9+/]{16,}={0,2}/g;
+const HEX_BLOB = /(?:[0-9a-f]{2}[\s]?){8,}/gi;
+const SPACED_LETTERS = /\b(?:[A-Za-z] ){3,}[A-Za-z]\b/g;
+/** Three+ alphabetic tokens joined by `|` (no shell spaces around pipes). */
+const PIPE_SEPARATED = /\b(?:[A-Za-z]+\|){2,}[A-Za-z]+\b/g;
+export { BASE64_BLOB, HEX_BLOB, INJECTION_PATTERNS, overrideFrame, PIPE_SEPARATED, SPACED_LETTERS };

package/esm/src/guardrails/injection-reversed.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by `scripts/gen-egress-automata.ts` from `egress-patterns.ts`.
+ * Do not edit: change the patterns and run the script.
+ *
+ * @module
+ */
+/** Each injection pattern reversed: it matches where the pattern matches the text written backwards. */
+declare const REVERSED_INJECTION_PATTERNS: RegExp[];
+export { REVERSED_INJECTION_PATTERNS };

package/esm/src/guardrails/injection-reversed.js

@@ -0,0 +1,49 @@
+/**
+ * Generated by `scripts/gen-egress-automata.ts` from `egress-patterns.ts`.
+ * Do not edit: change the patterns and run the script.
+ *
+ * @module
+ */
+/** Each injection pattern reversed: it matches where the pattern matches the text written backwards. */
+const REVERSED_INJECTION_PATTERNS = [
+    /(?:S?NOITCURTSNI|S?ELUR|S?ENILEDIUG|S?TNIARTSNOC|S?EVITCERID)(?:\s+(?:YTEFAS|YTIRUCES|METSYS|LANOITAREPO|LANRETNI|EROC|LANIGIRO|LAITINI|GNITSIXE|NEVIG|DETATS|DEDIVORP|DENIFED|DEIFICEPS|DEHSILBATSE))?\s+(?:SUOIVERP|ROIRP)(?:\s+LLA)?\s+ERONGI/gi,
+    /(?:S?NOITCURTSNI|S?ELUR|S?ENILEDIUG|S?TNIARTSNOC|S?EVITCERID)\s+(?:SUOIVERP|ROIRP|EVOBA)(?:\s+LLA)?\s+DRAGERSID/gi,
+    /(?:S?NOITCURTSNI|S?ELUR|S?ENILEDIUG|S?TNIARTSNOC|S?EVITCERID)\s+(?:SUOIVERP|ROIRP|EVOBA)(?:\s+LLA)?\s+TEGROF/gi,
+    /:S?NOITCURTSNI\s+WEN/gi,
+    /(?:METSYS|REPOLEVED|SUOIVERP|LANIGIRO)(?:\s+EHT)?\s+WOLLOF\s+TON\s+OD/gi,
+    /(?:S?NOITCURTSNI|S?ELUR|S?ENILEDIUG|S?TNIARTSNOC|S?EVITCERID)\s+(?:ROIRP|SUOIVERP)(?:\s+LLA)?\s+S?EDESREPUS/gi,
+    /(?:DIOV|DILAVNI|LLUN|ETELOSBO|DELLECNAC|DEKOVER)\s+(?:ERA|SI)\s+S?NOITCURTSNI\s+(?:SUOIVERP|ROIRP)(?:\s+LLA)?/gi,
+    /EDOM\s+REPOLEVED(?:\s+NI)?\s+WON\s+ERA\s+UOY/gi,
+    /(?<!\b(?:NI|NO|AIV|HGUORHT|MORF|GNISU|ROF)\s+)EDOM\s+(?:REPOLEVED|NIMDA|GUBED|ECNANETNIAM)\s+RETNE/gi,
+    /(?<!\b(?:NI|NO|AIV|HGUORHT|MORF|GNISU|ROF)\s+)EDOM\s+(?:REPOLEVED|NIMDA|GUBED|KAERBLIAJ)\s+ETAVITCA/gi,
+    /\bEDIRREVO\s+METSYS\b/gi,
+    /(?:S?NOITCURTSNI|S?ELUR|S?ENILEDIUG|S?TNIARTSNOC|S?EVITCERID)(?:\s+RUOY)?\s+EDIRREVO/gi,
+    /\bTPMORP(?:\s+(?:METSYS|EMTSYS|MTESYS|P?METSYS))?(?:\s+(?:LLUF|NEDDIH|ETELPMOC|LANRETNI|TERCES|LANIGIRO|ERITNE|TCAXE|LAUTCA|LAER)){0,2}(?:\s+(?:R?UOY|UROY|ROUY|EHT|YM|STI|SIH|REH|RUO|RIEHT))?\s+LAEVER/gi,
+    /\bTPMORP(?:\s+(?:METSYS|EMTSYS|MTESYS|P?METSYS))?\s+(?:R?UOY|UROY|ROUY|EHT|YM|STI|SIH|REH|RUO|RIEHT)(?:\s+EM)?\s+WOHS/gi,
+    /SNOITCURTSNI(?:\s+TCAXE)?(?:\s+RUOY)?\s+(?:ERA|EREW)\s+TAHW/gi,
+    /(?:EVOBA|EROFEB)\s+(?:TXET|S?NOITCURTSNI)(?:\s+EHT)?\s+TAEPER/gi,
+    /(?:TPMORP|S?NOITCURTSNI)\s+(?:LAITINI|LANIGIRO|METSYS)(?:\s+RUOY)?\s+TUPTUO/gi,
+    /(?:DNUOB|DETCIRTSER|DETIMIL)\s+REGNOL\s+ON\s+ERA\s+UOY/gi,
+    /DNUOB\s+TON(?:\s+(?:ER'|ERA\s+)UOY)?\s+FI\s+SA\s+TCA/gi,
+    /(?:IA|TNATSISSA|LEDOM)\s+TNEREFFID(?:\s+A)?(?:\s+(?:ER'|ERA\s+)UOY)?\s+DNETERP/gi,
+    /(?:TCIRTSER(?:\s+YNA)?\s+TUOHTIW|(?:LLA|YNA|YREVE|VERP)\s+\w*RONGI|SSAPYB|TCIRTSERNU|TIMILNU|YLNO\s+YEBO|(?:SELUR|STIMIL|TCIRTSER|IRADNUOB)\s+ON).{0,40}\w+(?:\s+(?:A|NA))?\s+WON\s+ERA\s+UOY/gi,
+    /\bwon\s+gnihtyna\s+od\b[\s\S]{0,120}\bNAD\b/g,
+    /(?:EDOM|TPMORP)\s+(?:DE)?KAERBLIAJ/gi,
+    /\bWON\s+GNIHTYNA\s+OD\b/gi,
+    /(?:S?RETLIF|S?ERUSAEM|S?ENILEDIUG|S?NOITCIRTSER)\s+(?:YTEFAS|YTIRUCES|TNETNOC|LACIHTE)(?:\s+RUOY)?\s+SSAPYB/gi,
+    /(?:S?RETLIF|S?ERUSAEM|S?ELUR|S?ENILEDIUG|S?NOITCIRTSER)\s+(?:YTEFAS|YTIRUCES|TNETNOC)(?:\s+RUOY)?(?:\s+LLA)?\s+(?:ELBASID|ETELED|EVOMER|FFO\s+NRUT|ETANIMILE)/gi,
+    /(?:S?ENILEDIUG|S?ELUR|S?NOITCIRTSER|S?ERUSAEM|S?RETLIF|(?:Y|SEI)CILOP|S?LOCOTORP)\s+(?:YTEFAS|YTIRUCES|LACIHTE|TNETNOC)(?:\s+RUOY)?(?:\s+LLA)?\s+(?:ERONGI|DRAGERSID)/gi,
+    />\/?[\t\v\f \xa0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]{0,32}METSYS[\t\v\f \xa0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]{0,32}\/?[\t\v\f \xa0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]{0,32}</gi,
+    />\/?[\t\v\f \xa0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]{0,32}(?:TNATSISSA|REPOLEVED|LOOT|NOITCNUF)[\t\v\f \xa0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]{0,32}\/?[\t\v\f \xa0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]{0,32}</gi,
+    /:\]?(?:METSYS|TNATSISSA|RESU)\[?[\t\v\f \xa0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]{0,32}\n[\t\v\f \xa0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]{0,32}\]/gi,
+    /\][\t\v\f \xa0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]{0,32}(?:EGASSEM[\t\v\f \xa0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]{0,8}METSYS|METSYS|TNATSISSA|LANRETNI)[\t\v\f \xa0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]{0,32}\[/gi,
+    /(?:ERA\s+UOY|ERONGI|EDIRREVO)[\t\v\f \xa0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]{1,32}:METSYS[\t\v\f \xa0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]{0,32}$/gim,
+    />\|(?:trats_mi|dne_mi|di_toe|di_redaeh_trats|di_redaeh_dne|txetfodne)\|</g,
+    />\uff5c(?:ecnetnes\u2581fo\u2581dne|ecnetnes\u2581fo\u2581nigeb)\uff5c</g,
+    /\]TSNI\/?\[/gi,
+    /\b(?:S?NOITCURTSNI|S?ELUR)(?:\s+RUOY)?(?:\s+LLA)?\s+ERONGI/gi,
+    /\b(?:IA|EDOM|LEDOM)\s+DETCIRTSERNU\b/gi,
+    /\b(?:NEGNUSIEWNA|S?NOITCURTSNI|SENOICCURTSNI|S?EVITCERID|SELG[E\xc8]R|SALGER)\b[\s\S]{0,50}\b(?:NEREIRONGI|ZERONGI|ARONGI|RERONGI|ZEILBUO|NESSEGREV|ADIVLO|AMITSESED|NETHCASSIM)\b/gi,
+    /\b(?:S?NOITCURTSNI|SELUR|S?ENILEDIUG|S?TNIARTSNOC|S?EVITCERID|S?TPMORP)(?:\s+[-\w'\u2019]{1,40}(?<!\b(?:YM|RUO))){0,3}\s+(?:ERONGI|DRAGERSID|TEGROF|EDIRREVO|SSAPYB)\b(?:(?=(?:\s+[-\w'\u2019]{1,40}){0,2}\s+UOY\b)|(?!(?:\s+YL\w+)?\s+(?:OT|TSUM|DLUOHS|DLUOW|LLIW|NAC|DLUOC|YAM|THGIM|LLAHS|I|EW|YEHT|EH|EHS|TI|OHW|TAHT|HCIHW)\b))(?!\s+(?:EHT|A|NA|SIH|REH|STI|RIEHT|RUOY|YM|RUO)\b)(?!(?:\s+[-\w'\u2019]{1,40})?\s+(?:(?:TON|REVEN|TONNAC|TUOHTIW)\b|T['\u2019]N))/gi,
+];
+export { REVERSED_INJECTION_PATTERNS };

package/esm/src/guardrails/injection.d.ts

@@ -0,0 +1,30 @@
+import { type RedactSpan } from '../observability/spans.js';
+declare const TYPO_TARGETS: string[];
+declare function typoNormalize(text: string): string;
+/**
+ * `typoNormalize(text)`, and for an index in it the index of `text` it stands
+ * for. A corrected word may be a letter longer or shorter than the word as
+ * written, so an index past the written word stands for its last letter.
+ */
+declare function typoFolded(text: string): {
+    text: string;
+    at: (index: number) => number;
+};
+/** Blob patterns whose match is a hit only when the blob decodes to an injection. */
+declare const INJECTION_BLOBS: readonly {
+    pattern: RegExp;
+    hit: (blob: string) => boolean;
+}[];
+declare function tryRot13(text: string): string;
+/** Each run of `%XX` escapes decoded on its own, so one stray `%` cannot switch decoding off. */
+declare function decodeUrlRuns(text: string): string;
+declare const LEET_MAP: Record<string, string>;
+declare function tryLeet(text: string): string | undefined;
+/**
+ * The spans of injection in the text, each stretch once. The text is read as
+ * written and in each rewrite of it: typo-folded, normalized, decoded, and its
+ * encoded blobs. A match in a rewrite is the stretch of the text as written it
+ * was read from, so text around a match stays.
+ */
+declare function injectionSpans(text: string): RedactSpan[];
+export { decodeUrlRuns, INJECTION_BLOBS, injectionSpans, LEET_MAP, TYPO_TARGETS, tryLeet, tryRot13, typoFolded, typoNormalize, };