@theoremjs/agents 0.3.4-next.484.g20d8b9d → 0.3.4-next.522.g9e684cd

package/esm/src/guardrails/injection-patterns.js

@@ -117,10 +117,93 @@ const INJECTION_PATTERNS = [
     IGNORE_MULTILANG,
     OVERRIDE_FRAME,
 ];
+/**
+ * A pattern whose `exec` is a scan written by hand, which finds exactly the matches of its `source`.
+ * V8 grows its regex stack once per step of a repeated group whose steps differ in length, so on a run
+ * of millions of characters that regex throws. The egress automata are still built from `source`.
+ */
+class ScannedPattern extends RegExp {
+    exec(text) {
+        for (let start = this.lastIndex; start < text.length; start++) {
+            const end = this.endOf(text, start);
+            if (end < 0)
+                continue;
+            this.lastIndex = end;
+            return Object.assign([text.slice(start, end)], {
+                index: start,
+                input: text,
+            });
+        }
+        this.lastIndex = 0;
+        return null;
+    }
+}
+const WHITESPACE = /\s/;
+function isHex(code) {
+    return (code >= 48 && code <= 57) || (code >= 65 && code <= 70) || (code >= 97 && code <= 102);
+}
+function isLetter(code) {
+    return (code >= 65 && code <= 90) || (code >= 97 && code <= 122);
+}
+/** A character `\b` counts as part of a word: a letter, a digit, or `_`. */
+function isWordChar(code) {
+    return isLetter(code) || (code >= 48 && code <= 57) || code === 95;
+}
+class HexBlob extends ScannedPattern {
+    constructor() {
+        super('(?:[0-9a-f]{2}[\\s]?){8,}', 'gi');
+    }
+    endOf(text, start) {
+        let at = start;
+        let pairs = 0;
+        while (isHex(text.charCodeAt(at)) && isHex(text.charCodeAt(at + 1))) {
+            at += 2;
+            pairs++;
+            if (at < text.length && WHITESPACE.test(text[at]))
+                at++;
+        }
+        return pairs >= 8 ? at : -1;
+    }
+}
+class PipeSeparated extends ScannedPattern {
+    constructor() {
+        super('\\b(?:[A-Za-z]+\\|){2,}[A-Za-z]+\\b', 'g');
+    }
+    endOf(text, start) {
+        if (!isLetter(text.charCodeAt(start)) || isWordChar(text.charCodeAt(start - 1)))
+            return -1;
+        let at = start;
+        let piped = 0;
+        let lastWordEnd = -1;
+        for (;;) {
+            let end = at;
+            while (isLetter(text.charCodeAt(end)))
+                end++;
+            if (end > at && text[end] === '|') {
+                piped++;
+                lastWordEnd = end;
+                at = end + 1;
+                continue;
+            }
+            if (end > at && piped >= 2 && !isWordChar(text.charCodeAt(end)))
+                return end;
+            // why: The regex backtracks one step, so the last piped word is the final one.
+            return piped >= 3 ? lastWordEnd : -1;
+        }
+    }
+}
 /** Runs that might encode an injection; each is decoded and checked in `injection.ts`. */
-const BASE64_BLOB = /[A-Za-z0-9+/]{16,}={0,2}/g;
-const HEX_BLOB = /(?:[0-9a-f]{2}[\s]?){8,}/gi;
+const BASE64_BLOB = /[A-Za-z0-9+/]{16}[A-Za-z0-9+/]*={0,2}/g;
+const HEX_BLOB = new HexBlob();
 const SPACED_LETTERS = /\b(?:[A-Za-z] ){3,}[A-Za-z]\b/g;
 /** Three+ alphabetic tokens joined by `|` (no shell spaces around pipes). */
-const PIPE_SEPARATED = /\b(?:[A-Za-z]+\|){2,}[A-Za-z]+\b/g;
-export { BASE64_BLOB, HEX_BLOB, INJECTION_PATTERNS, overrideFrame, PIPE_SEPARATED, SPACED_LETTERS };
+const PIPE_SEPARATED = new PipeSeparated();
+/** A pattern of its own for one scan to move `lastIndex` on, of the same class as `pattern`. */
+function freshPattern(pattern) {
+    if (pattern instanceof HexBlob)
+        return new HexBlob();
+    if (pattern instanceof PipeSeparated)
+        return new PipeSeparated();
+    return new RegExp(pattern.source, pattern.flags);
+}
+export { BASE64_BLOB, freshPattern, HEX_BLOB, INJECTION_PATTERNS, overrideFrame, PIPE_SEPARATED, SPACED_LETTERS, };

package/esm/src/guardrails/labels.d.ts

@@ -1,7 +1,7 @@
 /** Values that fill a label template's `{param}` placeholders. */
 export type LabelParams = Record<string, string | number>;
 /** Keys are stable API. */
-export declare const LABEL_KEYS: readonly ["provider.decision_failed", "provider.decision_unavailable", "provider.decision_model_missing", "provider.decision_ended", "provider.decision_images_off", "provider.decision_box_model", "provider.budget_exhausted", "provider.adapter_version", "provider.adapter_methods", "provider.adapter_schemas", "provider.fallback_slot", "provider.model_fallback_slot", "provider.host_model", "provider.turn_profile", "provider.model_binding_missing", "provider.session_closed", "provider.settled_call", "provider.session_unavailable", "provider.live_input", "provider.tool_cancel_missing", "provider.kernel_gate", "provider.event_invalid", "provider.response_identity", "provider.credential_resolution", "provider.credential_shape", "provider.stored_continuation", "provider.continuation_mismatch", "provider.continuation_contract", "provider.stateless_history", "provider.events_after_completion", "provider.duplicate_call", "provider.tool_cancel_live", "provider.complete_unavailable", "provider.parallel_tools", "provider.binding_identity", "provider.profile_type", "provider.event_type", "provider.feature", "provider.input_kind", "provider.output_kind", "provider.builtin", "provider.credential_missing", "provider.profile_configuration", "continue.instruction", "canary.bind_note", "user_data.note", "context.note", "taint.blocked", "taint.reason_steered", "taint.reason_tainted", "taint.destination_blocked", "taint.destination_confirm", "advisory.notice_elevated", "advisory.notice_high", "advisory.guidance", "attachments.too_many_files", "attachments.too_many_of_kind", "attachments.file_too_large", "attachments.turn_too_large", "attachments.not_accepted", "attachments.mime_not_allowed", "input.too_long", "attachments.limits_unconfigured", "quota.exhausted", "quota.busy", "error.config", "error.request", "error.input", "error.action", "error.auth", "error.rate_limit", "error.busy", "error.unsupported", "error.unavailable", "error.bad_response", "error.network", "error.timeout", "error.safety", "error.blocked", "error.declined", "error.failed", "error.cancelled", "error.internal", "repair.default_guidance", "repair.items_guidance", "repair.prompt_header", "repair.prompt_intro", "repair.prompt_instructions", "repair.history_heading", "repair.section_previous_output", "repair.section_validator_rejection", "repair.section_repair_guidance", "repair.section_instructions", "compaction.request", "compaction.tool_call", "compaction.tool_result", "decision.box_image", "detect.blocked", "detect.call_blocked", "detect.output_blocked", "detect.shown_blocked", "detect.hint.ids", "detect.hint.financial", "detect.hint.network", "detect.hint.credentials", "detect.hint.injection", "detect.hint.tool_instructions", "detect.hint.canary_leak", "detect.hint.prompt_leak", "detect.hint.marker_leak", "detect.hint.ungiven_images", "detect.hint.ungiven_links", "detect.hint.tool_leak", "detect.hint.own", "egress.default_repair_guidance", "egress.refusal", "egress.refusal_cut", "egress.rejection", "egress.rejection_found", "egress.hint_unscannable", "egress.hint_provider_tool_leak", "thought.omitted_image", "thought.omitted_link", "thought.omitted_instructions", "session.abandon_gated", "session.tool_denied", "session.tool_aborted", "session.sign_in", "sign_in.link", "sign_in.pending", "sign_in.done", "sign_in.declined", "sign_in.expired", "sign_in.out_of_scope", "session.gate_expired", "session.provider_state_unowned", "session.conversation_unknown", "session.turn_ended", "session.gate_pending", "session.part_skipped", "live.session_ended", "voice.unsupported", "voice.permission", "voice.unavailable", "voice.failed", "voice.empty", "stop.cancelled", "stop.interrupted", "stop.length", "stop.filtered", "stop.provider_error", "stop.stream_incomplete", "stop.step_limit", "composer.model", "composer.effort", "tool.awaiting_user", "tool.completed_hidden", "tool.t2_loader_needs_snapshot", "tool.t2_loader_shape", "tool.t2_loader_output_invalid", "tool.execution_uncertain", "tool.input_invalid", "tool.input_invalid_after_mutate", "tool.output_invalid_after_mutate", "tool.handler_no_output", "tool.did_not_run", "tool.page_no_answer", "tool.page_timed_out", "tool.output_invalid", "tool.not_loaded_t2", "tool.wait_unknown", "tool.wait_cycle", "tool.not_visible", "tool.builtin_not_enabled", "tool.provider_native", "tool.not_registered", "tool.builtin_needs_snapshot", "tool.not_allowed", "tool.not_eligible", "tool.unsupported_type", "tool.agent_call_limit", "tool.agent_failed", "tool.activity_failed", "protocol.not_served", "protocol.profile_type", "protocol.options", "protocol.option_clash", "protocol.base_options", "protocol.id_clash", "protocol.ws_headers", "protocol.builtin_unwritten", "protocol.provider_missing", "protocol.connection", "protocol.part_schema", "protocol.part_invalid", "protocol.key_invalid", "protocol.no_key", "protocol.reply_shape", "protocol.endpoint_url", "protocol.endpoint_host", "protocol.http", "protocol.no_operation", "protocol.definition", "protocol.provider_id_clash", "protocol.history_needed"];
+export declare const LABEL_KEYS: readonly ["provider.decision_failed", "provider.decision_unavailable", "provider.decision_model_missing", "provider.decision_ended", "provider.decision_images_off", "provider.decision_box_model", "provider.budget_exhausted", "provider.adapter_version", "provider.adapter_methods", "provider.adapter_schemas", "provider.fallback_slot", "provider.model_fallback_slot", "provider.host_model", "provider.turn_profile", "provider.model_binding_missing", "provider.session_closed", "provider.settled_call", "provider.session_unavailable", "provider.live_input", "provider.tool_cancel_missing", "provider.kernel_gate", "provider.event_invalid", "provider.response_identity", "provider.credential_resolution", "provider.credential_shape", "provider.stored_continuation", "provider.continuation_mismatch", "provider.continuation_contract", "provider.stateless_history", "provider.events_after_completion", "provider.duplicate_call", "provider.tool_cancel_live", "provider.complete_unavailable", "provider.parallel_tools", "provider.binding_identity", "provider.profile_type", "provider.event_type", "provider.feature", "provider.input_kind", "provider.output_kind", "provider.builtin", "provider.credential_missing", "provider.profile_configuration", "continue.instruction", "canary.bind_note", "user_data.note", "context.note", "taint.blocked", "taint.reason_steered", "taint.reason_tainted", "taint.destination_blocked", "taint.destination_confirm", "advisory.notice_elevated", "advisory.notice_high", "advisory.guidance", "attachments.too_many_files", "attachments.too_many_of_kind", "attachments.file_too_large", "attachments.turn_too_large", "attachments.not_accepted", "attachments.mime_not_allowed", "attachments.limits_unconfigured", "quota.exhausted", "quota.busy", "error.config", "error.request", "error.input", "error.action", "error.auth", "error.rate_limit", "error.busy", "error.unsupported", "error.unavailable", "error.bad_response", "error.network", "error.timeout", "error.safety", "error.blocked", "error.declined", "error.failed", "error.cancelled", "error.internal", "repair.default_guidance", "repair.items_guidance", "repair.prompt_header", "repair.prompt_intro", "repair.prompt_instructions", "repair.history_heading", "repair.section_previous_output", "repair.section_validator_rejection", "repair.section_repair_guidance", "repair.section_instructions", "structured.answer_tool", "structured.answer_missing", "compaction.request", "compaction.tool_call", "compaction.tool_result", "decision.box_image", "detect.blocked", "detect.call_blocked", "detect.output_blocked", "detect.shown_blocked", "detect.hint.ids", "detect.hint.financial", "detect.hint.network", "detect.hint.credentials", "detect.hint.injection", "detect.hint.tool_instructions", "detect.hint.canary_leak", "detect.hint.prompt_leak", "detect.hint.marker_leak", "detect.hint.ungiven_images", "detect.hint.ungiven_links", "detect.hint.tool_leak", "detect.hint.own", "egress.default_repair_guidance", "egress.refusal", "egress.refusal_cut", "egress.rejection", "egress.rejection_found", "egress.hint_unscannable", "egress.hint_provider_tool_leak", "thought.omitted_image", "thought.omitted_link", "thought.omitted_instructions", "session.abandon_gated", "session.tool_denied", "session.tool_aborted", "session.sign_in", "sign_in.link", "sign_in.pending", "sign_in.done", "sign_in.declined", "sign_in.expired", "sign_in.out_of_scope", "session.gate_expired", "session.provider_state_unowned", "session.conversation_unknown", "session.turn_ended", "session.gate_pending", "session.part_skipped", "live.session_ended", "voice.unsupported", "voice.permission", "voice.unavailable", "voice.failed", "voice.empty", "stop.cancelled", "stop.interrupted", "stop.length", "stop.filtered", "stop.provider_error", "stop.stream_incomplete", "stop.step_limit", "composer.model", "composer.effort", "tool.awaiting_user", "tool.completed_hidden", "tool.t2_loader_needs_snapshot", "tool.t2_loader_shape", "tool.t2_loader_output_invalid", "tool.execution_uncertain", "tool.input_invalid", "tool.input_invalid_after_mutate", "tool.output_invalid_after_mutate", "tool.handler_no_output", "tool.did_not_run", "tool.page_no_answer", "tool.page_timed_out", "tool.output_invalid", "tool.not_loaded_t2", "tool.wait_unknown", "tool.wait_cycle", "tool.not_visible", "tool.builtin_not_enabled", "tool.provider_native", "tool.not_registered", "tool.builtin_needs_snapshot", "tool.not_allowed", "tool.not_eligible", "tool.unsupported_type", "tool.agent_call_limit", "tool.agent_failed", "tool.activity_failed", "protocol.not_served", "protocol.profile_type", "protocol.options", "protocol.option_clash", "protocol.base_options", "protocol.id_clash", "protocol.ws_headers", "protocol.builtin_unwritten", "protocol.provider_missing", "protocol.connection", "protocol.part_schema", "protocol.part_invalid", "protocol.key_invalid", "protocol.no_key", "protocol.reply_shape", "protocol.endpoint_url", "protocol.endpoint_host", "protocol.http", "protocol.no_operation", "protocol.definition", "protocol.provider_id_clash", "protocol.history_needed"];
 /** One of {@linkcode LABEL_KEYS}. */
 export type LabelKey = (typeof LABEL_KEYS)[number];
 /**
@@ -10,7 +10,7 @@ export type LabelKey = (typeof LABEL_KEYS)[number];
  * puts into history. Only these overrides travel to the browser; the rest
  * (repair prompts, canary, taint, egress) stay on the host.
  */
-export declare const CLIENT_LABEL_KEYS: readonly ["attachments.too_many_files", "attachments.too_many_of_kind", "attachments.file_too_large", "attachments.turn_too_large", "attachments.not_accepted", "attachments.mime_not_allowed", "input.too_long", "attachments.limits_unconfigured", "detect.blocked", "error.config", "error.request", "error.input", "error.action", "error.auth", "error.rate_limit", "error.busy", "error.unsupported", "error.unavailable", "error.bad_response", "error.network", "error.timeout", "error.safety", "error.blocked", "error.declined", "error.failed", "error.cancelled", "error.internal", "session.abandon_gated", "session.tool_denied", "session.sign_in", "session.gate_expired", "session.turn_ended", "session.gate_pending", "session.part_skipped", "live.session_ended", "tool.awaiting_user", "tool.completed_hidden", "tool.execution_uncertain", "voice.unsupported", "voice.permission", "voice.unavailable", "voice.failed", "voice.empty", "stop.cancelled", "stop.interrupted", "stop.length", "stop.filtered", "stop.provider_error", "stop.stream_incomplete", "stop.step_limit", "composer.model", "composer.effort"];
+export declare const CLIENT_LABEL_KEYS: readonly ["attachments.too_many_files", "attachments.too_many_of_kind", "attachments.file_too_large", "attachments.turn_too_large", "attachments.not_accepted", "attachments.mime_not_allowed", "attachments.limits_unconfigured", "detect.blocked", "error.config", "error.request", "error.input", "error.action", "error.auth", "error.rate_limit", "error.busy", "error.unsupported", "error.unavailable", "error.bad_response", "error.network", "error.timeout", "error.safety", "error.blocked", "error.declined", "error.failed", "error.cancelled", "error.internal", "session.abandon_gated", "session.tool_denied", "session.sign_in", "session.gate_expired", "session.turn_ended", "session.gate_pending", "session.part_skipped", "live.session_ended", "tool.awaiting_user", "tool.completed_hidden", "tool.execution_uncertain", "voice.unsupported", "voice.permission", "voice.unavailable", "voice.failed", "voice.empty", "stop.cancelled", "stop.interrupted", "stop.length", "stop.filtered", "stop.provider_error", "stop.stream_incomplete", "stop.step_limit", "composer.model", "composer.effort"];
 /** One of {@linkcode CLIENT_LABEL_KEYS}. */
 export type ClientLabelKey = (typeof CLIENT_LABEL_KEYS)[number];
 /** Host-supplied replacement templates, `{param}` placeholders included. */

package/esm/src/guardrails/labels.js

@@ -64,7 +64,6 @@ export const LABEL_KEYS = [
     'attachments.turn_too_large',
     'attachments.not_accepted',
     'attachments.mime_not_allowed',
-    'input.too_long',
     'attachments.limits_unconfigured',
     'quota.exhausted',
     'quota.busy',
@@ -96,6 +95,8 @@ export const LABEL_KEYS = [
     'repair.section_validator_rejection',
     'repair.section_repair_guidance',
     'repair.section_instructions',
+    'structured.answer_tool',
+    'structured.answer_missing',
     'compaction.request',
     'compaction.tool_call',
     'compaction.tool_result',
@@ -222,7 +223,6 @@ export const CLIENT_LABEL_KEYS = [
     'attachments.turn_too_large',
     'attachments.not_accepted',
     'attachments.mime_not_allowed',
-    'input.too_long',
     'attachments.limits_unconfigured',
     'detect.blocked',
     'error.config',
@@ -380,7 +380,6 @@ const DEFAULTS = {
             ? `Sorry, ${name} is a file type that can't be used here.`
             : "Sorry, that file type can't be used here.";
     },
-    'input.too_long': (params) => `Sorry, that message is too long. Please keep it under ${Number(params.maxChars).toLocaleString('en-US')} characters.`,
     'attachments.limits_unconfigured': "Sorry, files can't be used here at the moment.",
     'quota.exhausted': (params) => params.perDay === 1
         ? "You've reached today's limit of 1 message."
@@ -414,6 +413,8 @@ const DEFAULTS = {
     'repair.section_validator_rejection': '### VALIDATOR REJECTION',
     'repair.section_repair_guidance': '### REPAIR GUIDANCE',
     'repair.section_instructions': '### INSTRUCTIONS',
+    'structured.answer_tool': 'Call this once your work is done, with your final answer as its input. Text you write outside this call is shown as progress, not taken as the answer.',
+    'structured.answer_missing': 'The reply did not call {tool}. Call {tool} with your final answer.',
     'compaction.request': 'Summarize the conversation above, including any earlier summary in it. Call the participants the user and the assistant, and keep every name, number, fact, and decision either may need later. Reply with the summary only.',
     'compaction.tool_call': 'Called {tool} with {arguments}',
     'compaction.tool_result': '{tool} returned: {result}',
@@ -594,7 +595,6 @@ export const LABEL_NOTES = {
     'attachments.turn_too_large': "Shown to the user when a message's files together are larger than Turn bytes. Takes {maxTurnBytes}.",
     'attachments.not_accepted': "Shown to the user who sends files or a voice note to an agent that takes none. Takes {channel}: 'voice' or 'attachment'.",
     'attachments.mime_not_allowed': "Shown to the user when a file's type is not in the agent's accepted types. Takes {mimeType}, {channel} ('voice' or 'attachment'), and {fileName} when the file has one.",
-    'input.too_long': 'Shown to the user when one text a turn sends, such as the message or a text file, is longer than Theorem reads. Takes {maxChars}.',
     'attachments.limits_unconfigured': 'Shown to the user who sends a file to an agent whose file limits are not set.',
     'quota.exhausted': 'Shown to the user who has used up the daily message cap. Takes {perDay}.',
     'quota.busy': 'Shown to the user who sends a message while their last one is still being answered (`quotaBusy`).',
@@ -626,6 +626,8 @@ export const LABEL_NOTES = {
     'repair.section_validator_rejection': "The heading over the validator's or egress check's reason in the repair request.",
     'repair.section_repair_guidance': 'The heading over the repair guidance in the repair request.',
     'repair.section_instructions': 'The heading over the numbered steps in the repair request.',
+    'structured.answer_tool': "The description of the answer tool: on a structured turn that has tools, the model calls it with its final answer, and the tool's input is the structured output.",
+    'structured.answer_missing': 'The validator rejection in the repair request when a structured turn with tools ended without calling the answer tool. Takes {tool}.',
     'compaction.request': 'Sent to the compactor after the messages it compacts, asking for the summary.',
     'compaction.tool_call': 'How a tool call reads to the compactor. Takes {tool} and {arguments}, the call as JSON.',
     'compaction.tool_result': 'How a tool result reads to the compactor. Takes {tool} and {result}, the output as sent to the model.',
@@ -759,9 +761,9 @@ const LABEL_PLACEHOLDERS = {
     'attachments.turn_too_large': ['maxTurnBytes'],
     'attachments.not_accepted': ['channel'],
     'attachments.mime_not_allowed': ['mimeType', 'channel', 'fileName'],
-    'input.too_long': ['maxChars'],
     'quota.exhausted': ['perDay'],
     'repair.history_heading': ['count'],
+    'structured.answer_missing': TOOL,
     'compaction.tool_call': ['tool', 'arguments'],
     'compaction.tool_result': ['tool', 'result'],
     'decision.box_image': ['image'],

package/esm/src/guardrails/mod.d.ts

@@ -25,7 +25,7 @@ export { errorCopiesSchema, errorKindSchema, guardrailEventSchema } from './even
 export { guardrailFromHits, guardrailFromVerdict, guardrailTurnEvent, projectGuardrailTurnEvent, } from './events.js';
 export { hitFromSpan, projectGuardrailEvent, } from './hits.js';
 export type { CompiledPatterns, HostPattern } from './host-patterns.js';
-export { listsPatterns, MAX_PATTERN_LENGTH, MAX_PATTERNS, patternListProblem, } from './host-patterns.js';
+export { listsPatterns, patternListProblem, } from './host-patterns.js';
 export { injectionSpans } from './injection.js';
 export type { ClientLabelKey, LabelKey, LabelOverrides, LabelParams } from './labels.js';
 export { CLIENT_LABEL_KEYS, LABEL_KEYS, labelCatalogRows, labelDefault, labelText, overrideLabels, resetLabels, validateLabelOverrides, } from './labels.js';
@@ -50,5 +50,5 @@ export type { Directive, DirectiveSignal } from './tool-directives.js';
 export { advisoryLevel, DIRECTIVE_SIGNALS, directives } from './tool-directives.js';
 export type { GuardedToolText, InspectedToolArguments } from './tool-result.js';
 export { checkTaintGate, composeToolText, guardToolFailureText, guardToolResult, inspectToolArguments, isRemoteOrigin, isSuspicious, isTainted, recordTaint, TOOL_CLOSE, toolCallEvent, wrapToolData, } from './tool-result.js';
-export type { AdvisoryLevel, BlockedReplyOnBlock, BlockedReplySpec, DestinationGate, GuardrailAction, GuardrailContext, GuardrailEvent, GuardrailHit, GuardrailStage, HostGuardrailsSpec, NetworkGuardrailSpec, OutboundPayload, ProfileGuardrailsSpec, Provenance, QuotaGuardrailSpec, ResolvedBlockedReply, ResolvedGuardrailPolicy, Severity, TaintGate, TaintGuardrailSpec, ToolOrigin, TrustLevel, TurnTaint, Verdict, } from './types.js';
+export type { AdvisoryLevel, BlockedReplyOnBlock, BlockedReplySpec, DecisionDisclosureEnforcer, DecisionDisclosureVerdict, DecisionGuardrailsSpec, DestinationGate, GuardrailAction, GuardrailContext, GuardrailEvent, GuardrailHit, GuardrailStage, HostGuardrailsSpec, NetworkGuardrailSpec, OutboundPayload, ProfileGuardrailsSpec, Provenance, QuotaGuardrailSpec, ResolvedBlockedReply, ResolvedGuardrailPolicy, Severity, TaintGate, TaintGuardrailSpec, ToolOrigin, TrustLevel, TurnTaint, Verdict, } from './types.js';
 export { ADVISORY_LEVELS, BLOCKED_REPLY_ON_BLOCK, DESTINATION_GATES, GUARDRAIL_STAGES, SEVERITIES, TAINT_GATES, TOOL_ORIGINS, TRUST_LEVELS, } from './types.js';

package/esm/src/guardrails/mod.js

@@ -16,7 +16,7 @@ export { describeError, ERROR_KINDS, errorKind, isAbortError, isTimeoutError, ki
 export { errorCopiesSchema, errorKindSchema, guardrailEventSchema } from './event-schemas.js';
 export { guardrailFromHits, guardrailFromVerdict, guardrailTurnEvent, projectGuardrailTurnEvent, } from './events.js';
 export { hitFromSpan, projectGuardrailEvent, } from './hits.js';
-export { listsPatterns, MAX_PATTERN_LENGTH, MAX_PATTERNS, patternListProblem, } from './host-patterns.js';
+export { listsPatterns, patternListProblem, } from './host-patterns.js';
 export { injectionSpans } from './injection.js';
 export { CLIENT_LABEL_KEYS, LABEL_KEYS, labelCatalogRows, labelDefault, labelText, overrideLabels, resetLabels, validateLabelOverrides, } from './labels.js';
 export { abortLiveOutboundTurn, createLiveOutboundGateSession, finalizeLiveOutboundTurn, processLiveOutboundBatch, } from './live-outbound-gate.js';

package/esm/src/guardrails/normalize.js

@@ -134,8 +134,10 @@ function withoutMatches(view, pattern) {
     let last = 0;
     const keep = (to) => {
         kept.text += view.text.slice(last, to);
-        kept.start.push(...view.start.slice(last, to));
-        kept.end.push(...view.end.slice(last, to));
+        for (let at = last; at < to; at++) {
+            kept.start.push(view.start[at]);
+            kept.end.push(view.end[at]);
+        }
     };
     for (const match of view.text.matchAll(pattern)) {
         keep(match.index);

package/esm/src/guardrails/prompt-echo.js

@@ -61,8 +61,10 @@ function promptReadings(stretches, canary) {
     const readings = { plain: [], slotted: [] };
     for (const view of PROMPT_VIEWS) {
         const read = viewReadings(stretches.map(view), canary === undefined ? undefined : view(canary));
-        readings.plain.push(...read.plain);
-        readings.slotted.push(...read.slotted);
+        for (const each of read.plain)
+            readings.plain.push(each);
+        for (const each of read.slotted)
+            readings.slotted.push(each);
     }
     return readings;
 }

package/esm/src/guardrails/sanitize.d.ts

@@ -19,7 +19,7 @@ declare function sanitizeProjectId(id: string | undefined): string | undefined;
  */
 declare function sanitizeHistory(history: TurnHistoryMessage[], reader: BoundaryReader): TurnHistoryMessage[];
 /** The error a turn ends on when a detector set to `block` matched at `boundary`. */
-declare function requestRefused(boundary: Boundary): TheoremError;
+declare function requestRefused(boundary: Boundary, reason?: string): TheoremError;
 /** A turn request read at each boundary it crosses. */
 interface SanitizedTurnRequest {
     request: NormalizedTurnRequest;

package/esm/src/guardrails/sanitize.js

@@ -91,9 +91,10 @@ function sanitizeHistory(history, reader) {
     });
 }
 /** The error a turn ends on when a detector set to `block` matched at `boundary`. */
-function requestRefused(boundary) {
+function requestRefused(boundary, reason) {
+    const why = reason ? `: ${reason}` : '';
     // labels-exempt: developer contract / internal diagnostic — the user's wording is `detect.blocked`
-    return new TheoremError('input', `guardrails.detect blocked the request at ${boundary}`, {
+    return new TheoremError('input', `guardrails.detect blocked the request at ${boundary}${why}`, {
         copy: { key: 'detect.blocked' },
     });
 }
@@ -125,7 +126,7 @@ function sanitizeTurnRequestWithEvents(req, profile) {
         if (event)
             events.push(guardrailTurnEvent(event));
         if (found.action === 'block')
-            refusal ??= requestRefused(boundary);
+            refusal ??= requestRefused(boundary, found.errorInternal);
     }
     events.push(...told.events.map(guardrailTurnEvent));
     if (told.blocked)

package/esm/src/guardrails/sensitive.d.ts

@@ -4,8 +4,8 @@ declare const CARD_CANDIDATE: RegExp;
 interface SensitivePattern {
     group: SensitiveGroup;
     pattern: RegExp;
-    /** Whether a match at `at` of `text` counts. */
-    hit?: (match: string, text: string, at: number) => boolean;
+    /** Whether a match at `at` of `text` counts; `lower` is `text` in lower case. */
+    hit?: (match: string, text: string, at: number, lower?: () => string) => boolean;
 }
 /** Every pattern, with its group. */
 declare const SENSITIVE_PATTERNS: readonly SensitivePattern[];

package/esm/src/guardrails/sensitive.js

@@ -81,7 +81,7 @@ const SENSITIVE_PATTERNS = [
     ...CREDENTIALS.map((rule) => ({
         group: 'credentials',
         pattern: new RegExp(rule.pattern.source, `${rule.pattern.flags}g`),
-        hit: (match, text, at) => credentialHit(rule, GLOBAL_ALLOWLIST, match, text, at),
+        hit: (match, text, at, lower) => credentialHit(rule, GLOBAL_ALLOWLIST, match, text, at, lower?.()),
     })),
 ];
 const ALL_GROUPS = {

package/esm/src/host/client-turn.js

@@ -33,6 +33,13 @@ function stripErrorInternal(event) {
     const { errorInternal: _internal, ...rest } = event;
     return rest;
 }
+function stripCompactionInternal(event) {
+    if (event.type !== 'compaction' || event.failure?.errorInternal === undefined) {
+        return event;
+    }
+    const { errorInternal: _internal, ...failure } = event.failure;
+    return { ...event, failure };
+}
 function stripGuardrailInternal(event) {
     if (event.type !== 'guardrail' || !event.guardrail?.errorInternal) {
         return event;
@@ -54,7 +61,7 @@ function stripEvidenceRaw(event) {
 function forClient(event, options) {
     let out = options?.reader === 'builder'
         ? builderWording(event)
-        : stripGuardrailInternal(stripErrorInternal(event));
+        : stripCompactionInternal(stripGuardrailInternal(stripErrorInternal(event)));
     if (!options?.includeEvidenceRaw) {
         out = stripEvidenceRaw(out);
     }

package/esm/src/interface/profile-interface.js

@@ -29,6 +29,19 @@ const modelBinding = z.object({
         meter: z.enum(COMPACTION_METERS).optional(),
     })
         .optional(),
+    limits: z
+        .object({
+        operationTimeoutMs: z.number().optional(),
+        connectTimeoutMs: z.number().optional(),
+        liveStepTimeoutMs: z.number().optional(),
+        maxWireRecordBytes: z.number().optional(),
+        maxWireResponseBytes: z.number().optional(),
+        maxEventBytes: z.number().optional(),
+        maxStepBytes: z.number().optional(),
+        maxStepEvents: z.number().optional(),
+        maxPendingToolCalls: z.number().optional(),
+    })
+        .optional(),
 });
 const outputs = z.object({
     structured: z

package/esm/src/kernel/answer-tool.d.ts

@@ -0,0 +1,14 @@
+import { type LabelOverrides } from '../guardrails/labels.js';
+import type { ModelRequest, ResolvedGeneration } from './types.js';
+/** The tool a structured turn with tools answers through. */
+export declare const ANSWER_TOOL = "final_answer";
+/**
+ * True when the turn's structured output comes from the answer tool, not from a response format.
+ *
+ * why: Many endpoints refuse a response format beside tools, and many models given both answer in
+ * JSON at once without calling a tool. Read it off the turn's generation, not one step's: the
+ * step that must answer has its tools taken away, and still answers through this tool.
+ */
+export declare function answersByTool(generation: Pick<ResolvedGeneration, 'structured' | 'tools'>): boolean;
+/** The request with the answer tool in place of the response format, when the turn answers by tool. */
+export declare function withAnswerTool(request: ModelRequest, generation: Pick<ResolvedGeneration, 'structured' | 'tools'>, labels: LabelOverrides | undefined): ModelRequest;

package/esm/src/kernel/answer-tool.js

@@ -0,0 +1,26 @@
+import { labelText } from '../guardrails/labels.js';
+/** The tool a structured turn with tools answers through. */
+export const ANSWER_TOOL = 'final_answer';
+/**
+ * True when the turn's structured output comes from the answer tool, not from a response format.
+ *
+ * why: Many endpoints refuse a response format beside tools, and many models given both answer in
+ * JSON at once without calling a tool. Read it off the turn's generation, not one step's: the
+ * step that must answer has its tools taken away, and still answers through this tool.
+ */
+export function answersByTool(generation) {
+    return generation.structured !== null && generation.tools.wire.length > 0;
+}
+/** The request with the answer tool in place of the response format, when the turn answers by tool. */
+export function withAnswerTool(request, generation, labels) {
+    const { structured } = generation;
+    if (!structured || !answersByTool(generation))
+        return request;
+    const tool = {
+        type: 'function',
+        name: ANSWER_TOOL,
+        description: labelText('structured.answer_tool', {}, labels),
+        parameters: structured.jsonSchema,
+    };
+    return { ...request, structured: null, wireTools: [...(request.wireTools ?? []), tool] };
+}

package/esm/src/kernel/engine/decision-references.d.ts

@@ -0,0 +1,14 @@
+import type { DecisionAsset } from '../types.js';
+/** A run of text, or the image a reference in it stands for. */
+export type ReferencePiece = string | {
+    reference: string;
+    asset: DecisionAsset;
+};
+/**
+ * A string split at the image references in it, as TypeSafe reads them: a string that is exactly a
+ * reference is that image; otherwise references match as plain text, left to right, never
+ * overlapping, the longest where two start together. A string with no reference comes back whole.
+ */
+export declare function splitReferences(text: string, assets: Record<string, DecisionAsset>): ReferencePiece[];
+/** The images the strings of `values` reference, in the order of `assets`. */
+export declare function referencedAssets(values: readonly unknown[], assets: Record<string, DecisionAsset>): Record<string, DecisionAsset>;

package/esm/src/kernel/engine/decision-references.js

@@ -0,0 +1,55 @@
+/**
+ * A string split at the image references in it, as TypeSafe reads them: a string that is exactly a
+ * reference is that image; otherwise references match as plain text, left to right, never
+ * overlapping, the longest where two start together. A string with no reference comes back whole.
+ */
+export function splitReferences(text, assets) {
+    if (Object.hasOwn(assets, text))
+        return [{ reference: text, asset: assets[text] }];
+    const references = Object.keys(assets);
+    const pieces = [];
+    let from = 0;
+    while (from < text.length) {
+        let at = -1;
+        let found = '';
+        for (const reference of references) {
+            const index = text.indexOf(reference, from);
+            if (index < 0)
+                continue;
+            if (at < 0 || index < at || (index === at && reference.length > found.length)) {
+                at = index;
+                found = reference;
+            }
+        }
+        if (at < 0)
+            break;
+        if (at > from)
+            pieces.push(text.slice(from, at));
+        pieces.push({ reference: found, asset: assets[found] });
+        from = at + found.length;
+    }
+    if (from < text.length)
+        pieces.push(text.slice(from));
+    return pieces;
+}
+/** Every string value in a JSON value, keys left out: the only places a reference is read. */
+function* stringValues(value) {
+    if (typeof value === 'string')
+        yield value;
+    else if (Array.isArray(value))
+        for (const item of value)
+            yield* stringValues(item);
+    else if (value !== null && typeof value === 'object')
+        for (const item of Object.values(value))
+            yield* stringValues(item);
+}
+/** The images the strings of `values` reference, in the order of `assets`. */
+export function referencedAssets(values, assets) {
+    const used = new Set();
+    for (const value of values)
+        for (const text of stringValues(value))
+            for (const piece of splitReferences(text, assets))
+                if (typeof piece !== 'string')
+                    used.add(piece.reference);
+    return Object.fromEntries(Object.entries(assets).filter(([reference]) => used.has(reference)));
+}

package/esm/src/kernel/engine/decision.d.ts

@@ -3,7 +3,7 @@ import type { TraceSink } from '../../observability/trace-sink.js';
 import type { ProviderHostOptions } from '../protocols/runtime.js';
 import type { KernelRegistry } from '../registry/kernel-registry.js';
 import type { DecisionProfile, DecisionRequest, DecisionResult } from '../types.js';
-/** Where the provider takes decision requests, as its preset states. */
+/** Each decision failure code, and the error kind it reads as. */
 declare const DECISION_ERROR_KINDS: {
     readonly invalid_request: "request";
     readonly authentication: "auth";
@@ -36,8 +36,8 @@ export declare function validateDecisionRequest(request: Omit<DecisionRequest, '
     questions: unknown;
 }, profile: DecisionProfile): asserts request is DecisionRequest;
 /**
- * Exactly one decision request, traced however it ends. An ambiguous POST is never retried,
- * and a trace write failure never changes the decision's outcome.
+ * One decision, traced however it ends. A transient failure (408, 429, a 5xx gateway or a network
+ * error) is retried within five seconds; a trace write failure never changes the decision's outcome.
  */
 export declare function runDecisionInRegistry(registry: KernelRegistry, request: DecisionRequest, options: RunDecisionOptions): Promise<DecisionResult>;
 export {};