@theoremjs/agents 0.3.0 → 0.3.1

package/esm/src/guardrails/egress-stream.js

@@ -1,7 +1,7 @@
 /**
- * The bundled egress policy, run on a reply as it streams.
+ * The detectors, Theorem's and the host's own, run on a reply as it streams.
  *
- * The bundled checks match their patterns on the reply as written and, for
+ * Each matches its patterns on the reply as written and, for
  * injection phrasing, on
  * rewrites of it (typo-folded, Unicode-folded, rot13, leet, URL-decoded, read
  * backwards). The stream keeps each rewrite growing with the reply and, for
@@ -11,21 +11,20 @@
  * later starts at or after that place, so none of it has been released.
  *
  * A match whose outcome no later text can change is settled; a settled match
- * of the pattern itself (not the automaton) is a hit, and the reply is
- * blocked there. Each character is read a bounded number of times, so a long
- * reply costs time in proportion to its length.
+ * of the pattern itself (not the automaton) is a hit, and does what
+ * `guardrails.detect` sets (`detect-stream.ts`). Each character is read a bounded number of times, so a
+ * long reply costs time in proportion to its length.
  *
  * @module
  */
-import { DEFAULT_CHECKS, standardEgressEnforce } from './egress.js';
-import { FORWARD_AUTOMATON, REVERSED_AUTOMATON, REVERSED_INJECTION_PATTERNS, } from './egress-automata.js';
-import { EGRESS_PATTERNS } from './egress-patterns.js';
-import { globalPattern } from './egress-rules.js';
+import { EGRESS_PATTERNS, notePattern, } from './egress-patterns.js';
 import { IMAGE_PATTERNS, imageReadings, LINK_PATTERNS, linkReadings, } from './egress-urls.js';
 import { decodeUrlRuns, INJECTION_BLOBS, TYPO_TARGETS, tryLeet, tryRot13, typoNormalize, } from './injection.js';
+import { REVERSED_INJECTION_PATTERNS } from './injection-reversed.js';
 import { isEmoji, normalizeCodePoint } from './normalize.js';
-import { EGRESS_RULES } from './rules.js';
-import { cardHit } from './sensitive.js';
+import { detectRule } from './rules.js';
+import { cardHit, SENSITIVE_PATTERNS } from './sensitive.js';
+import { namePatterns } from './tool-leak.js';
 const UNITS = 0x10000;
 function compile(data) {
     const classCount = data.classStarts.length;
@@ -48,10 +47,106 @@ function compile(data) {
         final[id] = node[1];
         edges.push(Int32Array.from(node.slice(2)));
     });
-    return { classOf, has, pattern, final, edges, initials: data.initials, size };
+    return { classOf, has, pattern, final, edges, initials: data.initials, leads: data.leads, size };
 }
+/** Theorem's automata, once `loadEgressAutomata` has read them. */
+let bundled;
 let forward;
 let backward;
+/**
+ * Reads Theorem's automata, the most of the kernel's size, the first time a stream needs them.
+ * Every gate's constructor waits for this, so an app that never streams a reply never loads them.
+ */
+async function loadEgressAutomata() {
+    if (bundled)
+        return;
+    const { FORWARD_AUTOMATON, REVERSED_AUTOMATON } = await import('./egress-automata.js');
+    bundled = { forward: FORWARD_AUTOMATON, reversed: REVERSED_AUTOMATON };
+}
+function loaded() {
+    if (!bundled) {
+        throw new Error('A stream was opened before loadEgressAutomata() finished.'); // labels-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+    }
+    return bundled;
+}
+/** The code units a case-insensitive regex reads as each one: ES `Canonicalize` without `u`. */
+let caseUnits;
+function canonicalUnit(unit) {
+    const upper = String.fromCharCode(unit).toUpperCase();
+    if (upper.length !== 1)
+        return unit;
+    const code = upper.charCodeAt(0);
+    return unit >= 0x80 && code < 0x80 ? unit : code;
+}
+function unitsLike(unit) {
+    if (!caseUnits) {
+        caseUnits = new Map();
+        for (let u = 0; u < UNITS; u++) {
+            const canon = canonicalUnit(u);
+            const units = caseUnits.get(canon);
+            if (units)
+                units.push(u);
+            else
+                caseUnits.set(canon, [u]);
+        }
+    }
+    return caseUnits.get(canonicalUnit(unit)) ?? [unit];
+}
+/** Class starts that give each of the sorted `units` a class of its own. */
+function classStartsOf(units) {
+    const classStarts = [0];
+    for (const unit of units) {
+        if (classStarts.at(-1) !== unit)
+            classStarts.push(unit);
+        if (unit + 1 < UNITS)
+            classStarts.push(unit + 1);
+    }
+    return classStarts;
+}
+/** Literal automata, kept per text so each is built once. */
+const literalAutomata = new Map();
+/** An automaton for `text` as written, case aside, as `notePattern` reads it. */
+function literalAutomaton(text) {
+    const cached = literalAutomata.get(text);
+    if (cached)
+        return cached;
+    const positions = Array.from({ length: text.length }, (_, i) => unitsLike(text.charCodeAt(i)));
+    const classStarts = classStartsOf([...new Set(positions.flat())].sort((a, b) => a - b));
+    const classOfUnit = (unit) => classStarts.indexOf(unit);
+    const charsets = positions.map((like) => like.map(classOfUnit));
+    const nodes = [...positions.map((_, i) => [0, 0, i + 1, i]), [0, 1]];
+    const automaton = compile({ classStarts, charsets, initials: [0], leads: [-1], nodes });
+    literalAutomata.set(text, automaton);
+    return automaton;
+}
+/**
+ * An automaton for each of `texts` as written, case and all: pattern `i` is `texts[i]`. Kept
+ * per list, so a profile's is built once. Each unit has a charset of its own: charset `k` is the
+ * class of `units[k]`.
+ */
+function literalsAutomaton(texts) {
+    const key = JSON.stringify(texts);
+    const cached = literalAutomata.get(key);
+    if (cached)
+        return cached;
+    const units = [...new Set(texts.flatMap((text) => Array.from(text, (c) => c.charCodeAt(0))))];
+    units.sort((a, b) => a - b);
+    const classStarts = classStartsOf(units);
+    const charsets = units.map((unit) => [classStarts.indexOf(unit)]);
+    const nodes = [];
+    const initials = texts.map((text, id) => {
+        const first = nodes.length;
+        for (let i = 0; i < text.length; i++) {
+            nodes.push([id, 0, nodes.length + 1, units.indexOf(text.charCodeAt(i))]);
+        }
+        nodes.push([id, 1]);
+        return first;
+    });
+    const leads = texts.map(() => -1);
+    const automaton = compile({ classStarts, charsets, initials, leads, nodes });
+    literalAutomata.set(key, automaton);
+    return automaton;
+}
 /** The first edges of the given patterns, per character class. */
 function startEdges(automaton, patterns) {
     const classCount = automaton.has[0]?.length ?? 0;
@@ -111,27 +206,33 @@ function unitView(source, rewrite) {
 }
 const WORD_UNIT = /\w/;
 const MAX_TARGET = Math.max(...TYPO_TARGETS.map((target) => target.length));
-const TARGET_FIRSTS = new Set(TYPO_TARGETS.map((target) => target[0]));
-/** Whether a word still being written could yet fold to a typo target. */
+/** Whether a word still being written could yet fold to a typo target: a misspelling may be a letter longer. */
 function mayFold(run) {
-    return (run.length <= MAX_TARGET &&
-        /^[A-Za-z]*$/.test(run) &&
-        (run.length === 0 || TARGET_FIRSTS.has(run[0]?.toLowerCase())));
+    return run.length <= MAX_TARGET + 1 && /^[A-Za-z]*$/.test(run);
 }
 /**
- * `typoNormalize` of the source. It rewrites whole words (`\w` runs) of the
- * same length, so a word settles when a non-word character ends it, or as soon
- * as it can no longer fold to a target (then the rest of it passes as is).
+ * `typoNormalize` of the source. It rewrites whole words (`\w` runs), so a
+ * word settles when a non-word character ends it, or as soon as it can no
+ * longer fold to a target (then the rest of it passes as is). A corrected word
+ * may be a letter longer or shorter than the word as written, so each
+ * character keeps the source index it stands for.
  */
 function typoView(source) {
     let read = 0;
     /** The word being read, while it may still fold. */
     let word;
     let inWord = false;
+    /** Per settled character, the source index it stands for. */
+    const from = [];
+    const put = (piece, start, length) => {
+        grow(view, piece);
+        for (let i = 0; i < piece.length; i++)
+            from.push(start + Math.min(i, length - 1));
+    };
     const view = {
         text: '',
         fresh: '',
-        rawAt: (j) => source.rawAt(Math.min(j, view.text.length)),
+        rawAt: (j) => source.rawAt(j < from.length ? from[j] : read - (word?.length ?? 0)),
         update() {
             view.fresh = '';
             for (const end = source.text.length; read < end; read++) {
@@ -142,17 +243,17 @@ function typoView(source) {
                 inWord = wordUnit;
                 if (!wordUnit) {
                     if (word !== undefined)
-                        grow(view, typoNormalize(word));
+                        put(typoNormalize(word), read - word.length, word.length);
                     word = undefined;
-                    grow(view, unit);
+                    put(unit, read, 1);
                 }
                 else if (word === undefined)
-                    grow(view, unit);
+                    put(unit, read, 1);
                 else
                     word += unit;
             }
             if (word !== undefined && !mayFold(word)) {
-                grow(view, word);
+                put(word, read - word.length, word.length);
                 word = undefined;
             }
         },
@@ -186,7 +287,7 @@ const LOW_HI = 0xdfff;
  * or in the mapped text), an emoji run after a letter until the character
  * after it, a backslash until the character after it.
  */
-function normalizedView(reply) {
+function normalizedReplyView(reply) {
     let read = 0;
     /** Mapped text the emoji pass has not read: at most a trailing high surrogate. */
     let mapped = '';
@@ -291,7 +392,7 @@ function urlView(reply) {
                 }
                 continue;
             }
-            // Inside a run: complete escapes end at runStart + 3k.
+            // why: Inside a run: complete escapes end at runStart + 3k.
             const offset = (read - runStart) % 3;
             const fits = offset === 0 ? unit === '%' : URL_HEX.test(unit);
             if (fits) {
@@ -299,7 +400,7 @@ function urlView(reply) {
                 continue;
             }
             endRun(read - offset);
-            // The broken escape's text is literal; `read` rereads from its end.
+            // why: The broken escape's text is literal; `read` rereads from its end.
             for (let i = read - offset; i < read; i++)
                 append(view, String.fromCharCode(unitAt(reply, i)), i);
         }
@@ -311,32 +412,6 @@ function urlView(reply) {
     }
     return view;
 }
-const BLOB_HITS = new Map(INJECTION_BLOBS.map(({ pattern, hit }) => [pattern, hit]));
-/** The bundled rule a pattern kind trips, with `collectEgressHits`' severity. */
-const KIND_RULES = {
-    injection: { rule: EGRESS_RULES.injection, severity: 'medium' },
-    base64: { rule: EGRESS_RULES.injection, severity: 'medium' },
-    hex: { rule: EGRESS_RULES.injection, severity: 'medium' },
-    spaced: { rule: EGRESS_RULES.injection, severity: 'medium' },
-    pipe: { rule: EGRESS_RULES.injection, severity: 'medium' },
-    sensitive: { rule: EGRESS_RULES.sensitive, severity: 'high' },
-    card: { rule: EGRESS_RULES.sensitive, severity: 'high' },
-    boundary: { rule: EGRESS_RULES.boundary, severity: 'medium' },
-    image: { rule: EGRESS_RULES.image, severity: 'high' },
-    link: { rule: EGRESS_RULES.link, severity: 'high' },
-};
-/** How a settled match of `pattern` is read: a test of the match, or a finder in place of the regex. */
-function patternReading(kind, pattern, urls) {
-    if (kind === 'card')
-        return { hit: cardHit };
-    if (kind === 'image' || kind === 'link') {
-        const index = (kind === 'image' ? IMAGE_PATTERNS : LINK_PATTERNS).indexOf(pattern);
-        const reading = urls[kind][index];
-        return 'find' in reading ? { find: reading.find } : { hit: reading.test };
-    }
-    const hit = BLOB_HITS.get(pattern);
-    return hit ? { hit } : {};
-}
 const INJECTION_KINDS = new Set([
     'injection',
     'base64',
@@ -344,35 +419,57 @@ const INJECTION_KINDS = new Set([
     'spaced',
     'pipe',
 ]);
-/** Whether `checks` runs the check a pattern belongs to. */
-function runs({ kind, group }, checks) {
+const BLOB_HITS = new Map(INJECTION_BLOBS.map(({ pattern, hit }) => [pattern, hit]));
+const SENSITIVE_HITS = new Map(SENSITIVE_PATTERNS.flatMap(({ pattern, hit }) => (hit ? [[pattern, hit]] : [])));
+/** What a match of `detector`, or of the host's own by its id, reports, with `detectAt`'s severity. */
+function detectorRule(detector) {
+    return { rule: detectRule(detector), severity: 'high', detector };
+}
+const INJECTION_RULE = detectorRule('injection');
+const MARKER_RULE = detectorRule('marker_leak');
+const TOOL_RULE = detectorRule('tool_leak');
+/** What a pattern's match reports: its detector's rule. */
+function patternRule({ kind, group }) {
     if (INJECTION_KINDS.has(kind))
-        return checks.injection;
+        return INJECTION_RULE;
     switch (kind) {
         case 'sensitive':
         case 'card':
-            return group !== undefined && checks.sensitive[group];
+            return group === undefined ? undefined : detectorRule(group);
         case 'boundary':
-            return checks.boundary;
+            return MARKER_RULE;
         case 'image':
-            return checks.images !== undefined;
+            return detectorRule('ungiven_images');
         default:
-            return checks.links !== undefined;
+            return detectorRule('ungiven_links');
     }
 }
-/** The patterns `checks` runs on the reply as written. */
-function forwardPatterns(checks, given) {
+/** How a settled match of `pattern` is read: a test of the match, or a finder in place of the regex. */
+function patternReading(kind, pattern, urls) {
+    if (kind === 'card')
+        return { hit: cardHit };
+    if (kind === 'image' || kind === 'link') {
+        const index = (kind === 'image' ? IMAGE_PATTERNS : LINK_PATTERNS).indexOf(pattern);
+        const reading = urls[kind][index];
+        return 'find' in reading ? { find: reading.find } : { hit: reading.test };
+    }
+    const hit = BLOB_HITS.get(pattern) ?? SENSITIVE_HITS.get(pattern);
+    return hit ? { hit } : {};
+}
+/** The patterns of `detectors`, read on the reply as written. */
+function forwardPatterns(detectors, { given, allow, skipImages }) {
     const scope = (check) => ({ ...check, ...(given ? { given } : {}) });
     const urls = {
-        image: imageReadings(scope(checks.images)),
-        link: linkReadings(scope(checks.links), checks.images !== undefined),
+        image: imageReadings(scope(allow?.ungiven_images)),
+        link: linkReadings(scope(allow?.ungiven_links), skipImages ?? detectors.includes('ungiven_images')),
     };
     const out = [];
     EGRESS_PATTERNS.forEach((entry, id) => {
-        if (!runs(entry, checks))
+        const rule = patternRule(entry);
+        if (!(rule?.detector && detectors.includes(rule.detector)))
             return;
         out.push({
-            ...KIND_RULES[entry.kind],
+            ...rule,
             id,
             regex: new RegExp(entry.pattern.source, entry.pattern.flags),
             ...patternReading(entry.kind, entry.pattern, urls),
@@ -388,7 +485,7 @@ function injectionPatterns() {
             return;
         const hit = BLOB_HITS.get(pattern);
         out.push({
-            ...KIND_RULES.injection,
+            ...INJECTION_RULE,
             id,
             regex: new RegExp(pattern.source, pattern.flags),
             ...(hit ? { hit } : {}),
@@ -398,7 +495,7 @@ function injectionPatterns() {
 }
 function reversedPatterns() {
     return REVERSED_INJECTION_PATTERNS.map((pattern, id) => ({
-        ...KIND_RULES.injection,
+        ...INJECTION_RULE,
         id,
         regex: new RegExp(pattern.source, pattern.flags),
     }));
@@ -407,7 +504,10 @@ function reversedPatterns() {
  * One view scanned for some patterns: the automata, run one character at a
  * time, give where each pattern could still be matching; the pattern's own
  * regex, run only where the automaton reached a match, finds the match and
- * whether it has settled. A pattern whose matches nest (tags inside tags) is
+ * whether it has settled. A pattern opened by an optional repeat of one class
+ * has no thread for the repeat: a thread of it starts where the run of that
+ * class it is in started, and the run the text ends in is still under way.
+ * A pattern whose matches nest (tags inside tags) is
  * read instead by its finder, once over each stretch that settles.
  */
 function createScan(view, automaton, patterns) {
@@ -440,6 +540,11 @@ function createScan(view, automaton, patterns) {
      */
     const openedFrom = new Int32Array(patterns.length).fill(-1);
     const lastOpened = new Int32Array(patterns.length).fill(-1);
+    const leadOf = Int32Array.from(patterns, (p) => automaton.leads[p.id] ?? -1);
+    const leads = [...new Set(leadOf)].filter((lead) => lead >= 0);
+    const led = patterns.flatMap((_, p) => (leadOf[p] < 0 ? [] : [p]));
+    /** Per lead charset: where the run of it the text ends in started, or -1. */
+    const runFrom = new Int32Array(automaton.has.length).fill(-1);
     function feed() {
         const { text, fresh } = view;
         const base = freshFrom(view);
@@ -475,14 +580,23 @@ function createScan(view, automaton, patterns) {
             const first = starts[cls];
             for (let k = 0; k < first.length; k++) {
                 const target = first[k];
-                add(target, fed);
                 const p = local[pattern[target]];
+                const lead = leadOf[p];
+                const run = lead < 0 ? -1 : runFrom[lead];
+                const start = run < 0 ? fed : run;
+                add(target, start);
                 if (finds[p]) {
                     lastOpened[p] = fed;
                     if (openedFrom[p] < 0)
-                        openedFrom[p] = fed;
+                        openedFrom[p] = start;
                 }
             }
+            for (const lead of leads) {
+                if (!has[lead][cls])
+                    runFrom[lead] = -1;
+                else if (runFrom[lead] < 0)
+                    runFrom[lead] = fed;
+            }
             [nodes, next] = [next, nodes];
             [from, nextFrom] = [nextFrom, from];
             count = size;
@@ -505,19 +619,35 @@ function createScan(view, automaton, patterns) {
             if (start < earliest)
                 earliest = start;
         }
+        for (const p of led) {
+            const run = runFrom[leadOf[p]];
+            if (run < 0)
+                continue;
+            if (run < liveFrom[p])
+                liveFrom[p] = run;
+            if (run < earliest)
+                earliest = run;
+        }
         return earliest;
     }
     /** A finder's hit up to `settledTo`, run only on a stretch its automaton opened a thread in. */
     function found(p, settledTo) {
         const opened = openedFrom[p];
         const from = resume[p];
-        resume[p] = settledTo;
-        if (opened < 0 || opened >= settledTo)
+        if (opened < 0 || opened >= settledTo) {
+            resume[p] = settledTo;
             return undefined;
-        openedFrom[p] = lastOpened[p] >= settledTo ? settledTo : -1;
-        const { find, rule, severity } = patterns[p];
+        }
+        const { find, rule, severity, detector } = patterns[p];
         const at = find?.(view.text, from, settledTo);
-        return at === undefined ? undefined : { rule, severity, start: view.rawAt(at) };
+        if (at === undefined) {
+            resume[p] = settledTo;
+            openedFrom[p] = lastOpened[p] >= settledTo ? settledTo : -1;
+            return undefined;
+        }
+        // why: A detector's match need not end the reply, so the next call finds the one after it.
+        resume[p] = Math.max(from, at) + 1;
+        return { rule, severity, start: view.rawAt(at), detector };
     }
     /** A regex pattern's hit up to `settledTo`. */
     function matched(p, settledTo) {
@@ -527,7 +657,7 @@ function createScan(view, automaton, patterns) {
         }
         reached[p] = 0;
         const text = view.text;
-        const { regex, hit, rule, severity } = patterns[p];
+        const { regex, hit, rule, severity, detector } = patterns[p];
         regex.lastIndex = resume[p];
         for (;;) {
             const match = regex.exec(text);
@@ -538,7 +668,10 @@ function createScan(view, automaton, patterns) {
             }
             const [blob] = match;
             if (blob && (!hit || hit(blob, text, match.index))) {
-                return { rule, severity, start: view.rawAt(match.index) };
+                // why: The scan reads on from the end of the match, so the next call finds the one after it.
+                resume[p] = regex.lastIndex;
+                recheck[p] = 1;
+                return { rule, severity, start: view.rawAt(match.index), detector };
             }
             if (!blob)
                 regex.lastIndex++;
@@ -557,25 +690,27 @@ function createScan(view, automaton, patterns) {
         return undefined;
     }
     return {
-        /** Read what the view settled; a hit, or the reply index to hold from. */
-        run() {
+        /** Read what the view settled into `hits`; the reply index to hold from. */
+        run(hits) {
             feed();
             const earliest = live();
-            return detect() ?? view.rawAt(earliest);
+            for (let hit = detect(); hit; hit = detect())
+                hits.push(hit);
+            return view.rawAt(earliest);
         },
     };
 }
 /** Compiled host automata, kept per table so each is built once. */
 const hostAutomata = new WeakMap();
-function hostPatterns({ rules }) {
-    return rules.map(({ rule, severity, pattern }, id) => ({
-        rule,
-        severity,
-        id,
-        regex: globalPattern(pattern),
-    }));
+function hostAutomaton(data) {
+    let automaton = hostAutomata.get(data);
+    if (!automaton) {
+        automaton = compile(data);
+        hostAutomata.set(data, automaton);
+    }
+    return automaton;
 }
-/** Scans the bundled egress policy's patterns, and any host rules, as a reply streams. */
+/** Scans the detectors' patterns, Theorem's and the host's own, as a reply streams. */
 function createEgressStream(options = {}) {
     const reply = { text: '', fresh: '' };
     const raw = rawView(reply);
@@ -586,26 +721,37 @@ function createEgressStream(options = {}) {
         return createScan(view, automaton, patterns);
     };
     const scans = [];
-    const checks = options.checks ?? DEFAULT_CHECKS;
-    const forwardScan = forwardPatterns(checks, options.given);
+    const detectors = options.detect ?? [];
+    const forwardScan = forwardPatterns(detectors, options);
     if (forwardScan.length > 0) {
-        forward ??= compile(FORWARD_AUTOMATON);
+        forward ??= compile(loaded().forward);
         scans.push(scan(raw, forward, forwardScan));
     }
-    if (checks.injection) {
-        forward ??= compile(FORWARD_AUTOMATON);
-        backward ??= compile(REVERSED_AUTOMATON);
-        const normalized = normalizedView(reply);
+    if (detectors.includes('injection')) {
+        forward ??= compile(loaded().forward);
+        backward ??= compile(loaded().reversed);
+        const normalized = normalizedReplyView(reply);
         const injection = injectionPatterns();
         scans.push(scan(raw, backward, reversedPatterns()), scan(typoView(raw), forward, injection), scan(normalized, forward, injection), scan(typoView(normalized), forward, injection), scan(unitView(raw, tryRot13), forward, injection), scan(unitView(raw, (text) => tryLeet(text) ?? text), forward, injection), scan(urlView(reply), forward, injection));
     }
-    if (options.host) {
-        let automaton = hostAutomata.get(options.host.automaton);
-        if (!automaton) {
-            automaton = compile(options.host.automaton);
-            hostAutomata.set(options.host.automaton, automaton);
+    if (detectors.includes('marker_leak') && options.note) {
+        const regex = notePattern(options.note);
+        scans.push(scan(raw, literalAutomaton(options.note), [{ ...MARKER_RULE, id: 0, regex }]));
+    }
+    if (detectors.includes('tool_leak') && options.tools) {
+        const names = namePatterns(options.tools);
+        const patterns = names.map(({ regex }, id) => ({ ...TOOL_RULE, id, regex }));
+        if (names.length > 0) {
+            scans.push(scan(raw, literalsAutomaton(names.map(({ literal }) => literal)), patterns));
         }
-        scans.push(scan(raw, automaton, hostPatterns(options.host)));
+    }
+    for (const { detector, compiled, matchers } of options.own ?? []) {
+        const patterns = matchers.map(({ regex }, id) => ({
+            ...detectorRule(detector),
+            id,
+            regex: new RegExp(regex.source, regex.flags),
+        }));
+        scans.push(scan(raw, hostAutomaton(compiled.automaton), patterns));
     }
     let hold = 0;
     return {
@@ -614,32 +760,15 @@ function createEgressStream(options = {}) {
             reply.fresh = chunk;
             for (const view of views)
                 view.update();
+            const hits = [];
             let from = reply.text.length;
             for (const s of scans) {
-                const result = s.run();
-                if (typeof result !== 'number')
-                    return result;
-                from = Math.min(from, result);
+                from = Math.min(from, s.run(hits));
             }
             hold = from;
-            return undefined;
+            return hits;
         },
         holdFrom: () => hold,
     };
 }
-/** Streaming plans for the policies whose checks the stream runs itself. */
-const STREAM_PLANS = new WeakMap([
-    [
-        standardEgressEnforce,
-        (context) => createEgressStream(context.givenUrls ? { given: context.givenUrls } : {}),
-    ],
-]);
-/** The streaming plan for `enforce`, when the stream knows its checks. */
-function streamPlanOf(enforce) {
-    return STREAM_PLANS.get(enforce);
-}
-/** Tell the gate `enforce` runs exactly the checks `plan` streams. */
-function registerStreamPlan(enforce, plan) {
-    STREAM_PLANS.set(enforce, plan);
-}
-export { createEgressStream, normalizedView, registerStreamPlan, streamPlanOf, typoView, urlView };
+export { createEgressStream, loadEgressAutomata, normalizedReplyView, typoView, urlView };

package/esm/src/guardrails/egress-urls.d.ts

@@ -15,9 +15,10 @@
  * @module
  */
 import type { TurnHistoryMessage } from '../kernel/turn-events.js';
-import type { ProviderCompleteRequest } from '../kernel/types.js';
+import type { ModelRequest } from '../kernel/types.js';
+/** The URLs a request already contains, split by who controls them: those from the system prompt, user, and host history, and those from tool results. */
 interface GivenUrls {
-    /** From the system prompt, the user and host history. */
+    /** From the system prompt, the user, and host history. */
     request: ReadonlySet<string>;
     /** From tool results, which whoever wrote them controls. */
     tools: ReadonlySet<string>;
@@ -25,6 +26,8 @@ interface GivenUrls {
 interface GivenUrlSets extends GivenUrls {
     request: Set<string>;
     tools: Set<string>;
+    /** A request's input, or a message, that quotes the model's own words: a URL in it was not given. */
+    own: WeakSet<object>;
 }
 declare function givenUrlSets(): GivenUrlSets;
 interface UrlScope {
@@ -41,7 +44,7 @@ interface UrlScope {
 /** Adds every absolute URL in `text`, as a reader of it could have copied it. */
 declare function addSeenUrls(seen: Set<string>, text: string): void;
 declare function addHistoryUrls(given: GivenUrlSets, messages: readonly TurnHistoryMessage[]): void;
-declare function addRequestUrls(given: GivenUrlSets, request: Pick<ProviderCompleteRequest, 'system' | 'input' | 'history' | 'continuation'>): void;
+declare function addRequestUrls(given: GivenUrlSets, request: Pick<ModelRequest, 'system' | 'input' | 'history'>): void;
 type Span = {
     start: number;
     end: number;