agent-sanitizer 2.61.0 → 2.61.2

package/src/joining-type.mjs

@@ -1,5 +1,5 @@
 /**
- * GENERATED by scripts/gen-joining-type.mjs from ucd-full@17.0.0 — DO NOT EDIT.
+ * GENERATED by scripts/gen-joining-type.mjs from the pinned UCD 17.0.0 — DO NOT EDIT.
  *
  * Unicode Joining_Type, Indic virama and Brahmic consonant range tables backing
  * the ZWNJ/ZWJ carve-out in invisible.mjs. Regenerate with `pnpm gen:joining-type`;
@@ -10,7 +10,7 @@ export const UNICODE_VERSION = "17.0.0";
 
 // The two range tables below are GENERATED UCD data, not hand-written logic.
 // Their correctness is pinned by the SSOT round-trip in
-// test/joining-type.test.mjs (re-derive from the vendored slices, then assert
+// test/joining-type.test.mjs (re-derive from the pinned UCD, then assert
 // every covered code point and range boundary matches) — a far stronger and
 // faster guard than mutation. Mutating ~550 numeric literals is pathologically
 // slow (the shard was cancelled at ~19 min) and redundant, so Stryker skips
@@ -126,6 +126,7 @@ const JOINING_RANGES = [
   [0x886, 0x886, "D"],
   [0x889, 0x88d, "D"],
   [0x88e, 0x88e, "R"],
+  [0x88f, 0x88f, "D"],
   [0x897, 0x89f, "T"],
   [0x8a0, 0x8a9, "D"],
   [0x8aa, 0x8ac, "R"],
@@ -256,7 +257,8 @@ const JOINING_RANGES = [
   [0x1a65, 0x1a6c, "T"],
   [0x1a73, 0x1a7c, "T"],
   [0x1a7f, 0x1a7f, "T"],
-  [0x1ab0, 0x1ace, "T"],
+  [0x1ab0, 0x1add, "T"],
+  [0x1ae0, 0x1aeb, "T"],
   [0x1b00, 0x1b03, "T"],
   [0x1b34, 0x1b34, "T"],
   [0x1b36, 0x1b3a, "T"],
@@ -381,7 +383,8 @@ const JOINING_RANGES = [
   [0x10eab, 0x10eac, "T"],
   [0x10ec2, 0x10ec2, "R"],
   [0x10ec3, 0x10ec4, "D"],
-  [0x10efc, 0x10eff, "T"],
+  [0x10ec6, 0x10ec7, "D"],
+  [0x10efa, 0x10eff, "T"],
   [0x10f30, 0x10f32, "D"],
   [0x10f33, 0x10f33, "R"],
   [0x10f34, 0x10f44, "D"],
@@ -478,6 +481,9 @@ const JOINING_RANGES = [
   [0x11a59, 0x11a5b, "T"],
   [0x11a8a, 0x11a96, "T"],
   [0x11a98, 0x11a99, "T"],
+  [0x11b60, 0x11b60, "T"],
+  [0x11b62, 0x11b64, "T"],
+  [0x11b66, 0x11b66, "T"],
   [0x11c30, 0x11c36, "T"],
   [0x11c38, 0x11c3d, "T"],
   [0x11c3f, 0x11c3f, "T"],
@@ -534,6 +540,10 @@ const JOINING_RANGES = [
   [0x1e2ec, 0x1e2ef, "T"],
   [0x1e4ec, 0x1e4ef, "T"],
   [0x1e5ee, 0x1e5ef, "T"],
+  [0x1e6e3, 0x1e6e3, "T"],
+  [0x1e6e6, 0x1e6e6, "T"],
+  [0x1e6ee, 0x1e6ef, "T"],
+  [0x1e6f5, 0x1e6f5, "T"],
   [0x1e8d0, 0x1e8d6, "T"],
   [0x1e900, 0x1e943, "D"],
   [0x1e944, 0x1e94b, "T"],
@@ -575,9 +585,9 @@ const VIRAMA_RANGES = [
 ];
 
 // [start, end, Script] Indic_Syllabic_Category = Consonant ranges restricted to
-// the Brahmic scripts the joiner carve-out covers — the only bases a virama
-// attaches to. Keyed by script name so the contract test can check each span
-// against the script it claims.
+// the scripts that own a virama — the only bases a virama attaches to. Keyed
+// by script name so the contract test can check each span against the script
+// it claims.
 /** @type {ReadonlyArray<readonly [string, number, number]>} */
 export const BRAHMIC_CONSONANT_RANGES = [
   ["Devanagari", 0x0915, 0x0939],
@@ -628,6 +638,33 @@ export const BRAHMIC_CONSONANT_RANGES = [
   ["Sinhala", 0x0db3, 0x0dbb],
   ["Sinhala", 0x0dbd, 0x0dbd],
   ["Sinhala", 0x0dc0, 0x0dc6],
+  ["Balinese", 0x1b13, 0x1b33],
+  ["Balinese", 0x1b45, 0x1b4c],
+  ["Syloti_Nagri", 0xa807, 0xa80a],
+  ["Syloti_Nagri", 0xa80c, 0xa822],
+  ["Saurashtra", 0xa892, 0xa8b3],
+  ["Javanese", 0xa989, 0xa98b],
+  ["Javanese", 0xa98f, 0xa9b2],
+  ["Brahmi", 0x11013, 0x11037],
+  ["Brahmi", 0x11075, 0x11075],
+  ["Kaithi", 0x1108d, 0x110af],
+  ["Sharada", 0x11191, 0x111b2],
+  ["Khojki", 0x11208, 0x11211],
+  ["Khojki", 0x11213, 0x1122b],
+  ["Khojki", 0x1123f, 0x1123f],
+  ["Grantha", 0x11315, 0x11328],
+  ["Grantha", 0x1132a, 0x11330],
+  ["Grantha", 0x11332, 0x11333],
+  ["Grantha", 0x11335, 0x11339],
+  ["Newa", 0x1140e, 0x11434],
+  ["Tirhuta", 0x1148f, 0x114af],
+  ["Siddham", 0x1158e, 0x115ae],
+  ["Modi", 0x1160e, 0x1162f],
+  ["Takri", 0x1168a, 0x116aa],
+  ["Takri", 0x116b8, 0x116b8],
+  ["Dogra", 0x1180a, 0x1182b],
+  ["Nandinagari", 0x119ae, 0x119d0],
+  ["Bhaiksuki", 0x11c0e, 0x11c2e],
 ];
 // Stryker restore all
 
@@ -674,12 +711,22 @@ export function isVirama(cp) {
 /**
  * True when `cp` is a Brahmic consonant — the only base a virama attaches to,
  * and therefore the only base after which a ZWJ/ZWNJ is a real conjunct
- * request rather than a zero-width payload.
+ * request rather than a zero-width payload. A binary search, like
+ * `lookup`: the spans are sorted and disjoint, and the carve analysis asks
+ * this of every visible code point of a long document, where a scan of all the
+ * spans per code point was the dominant cost.
  * @param {number} cp
  * @returns {boolean}
  */
 export function isBrahmicConsonant(cp) {
-  for (const [, start, end] of BRAHMIC_CONSONANT_RANGES)
-    if (cp >= start && cp <= end) return true;
+  let lo = 0;
+  let hi = BRAHMIC_CONSONANT_RANGES.length - 1;
+  while (lo <= hi) {
+    const mid = (lo + hi) >> 1;
+    const [, start, end] = BRAHMIC_CONSONANT_RANGES[mid];
+    if (cp < start) hi = mid - 1;
+    else if (cp > end) lo = mid + 1;
+    else return true;
+  }
   return false;
 }

package/src/layer1.mjs

@@ -24,14 +24,18 @@
 import { stripInvisibleWithReport, CATEGORY, STRIP } from "./invisible.mjs";
 import {
   CONTROL_INTRODUCER_SOURCE,
+  DEFAULT_RENDITION,
+  foregroundMatchesBackground,
   isCancelledOrphan,
   isOrphanKind,
   orphanKindFor,
   scanAnsi,
-  sgrConcealState,
+  sgrRendition,
   TOKEN_KIND,
 } from "./ansi.mjs";
 
+/** @typedef {import("./ansi.mjs").SgrRendition} SgrRendition */
+
 // The ANSI grammar and the introducer charset live in ./ansi.mjs so this module
 // and invisible.mjs (which owns the public isSgrOnly / SGR_RE and cannot import
 // this one) scan with the SAME tokenizer.
@@ -178,16 +182,24 @@ function rendersNothing(gap) {
 /**
  * True when the SGR sequences in `text` do more than style visible text — the
  * question a consumer must answer before PRESERVING escapes rather than
- * stripping them. Two arms, both model-sees/human-sees divergences:
+ * stripping them. Three arms, all model-sees/human-sees divergences:
  *
- *   1. CONCEAL is on while text that would otherwise render goes by, or the text
- *      ENDS concealed (hiding its own tail, and everything the terminal prints
- *      afterwards). Only SGR moves that state (see {@link sgrConcealState}) — a
- *      cursor move or an erase leaves a terminal exactly as concealed as it was.
- *   2. {@link SGR_RUN_THRESHOLD} sequences with nothing that renders between
+ *   1. CONCEAL is on while text that would otherwise render goes by. Only SGR
+ *      moves that state (see {@link sgrRendition}) — a cursor move or an erase
+ *      leaves a terminal exactly as concealed as it was.
+ *   2. The foreground is the background while a glyph goes by (`ESC[30;40m`):
+ *      concealment by colour, judged only where the match is unambiguous (see
+ *      {@link foregroundMatchesBackground}). Block Elements are the one
+ *      exception judged across the whole text rather than per glyph (see
+ *      {@link drawsSecondBlockElement}).
+ *   3. {@link SGR_RUN_THRESHOLD} sequences with nothing that renders between
  *      them: the run puts no glyph on the screen, so it carries data rather than
  *      styling.
  *
+ * Either still in force when the text ENDS is a refusal too: rendition
+ * outlives its bytes, so a file ending in `ESC[8m` blanks whatever the terminal
+ * prints after it.
+ *
  * What it does NOT claim: a message spread thinly through legitimately coloured
  * text — one sequence per line, say — is indistinguishable from styling, and
  * this answers no for it. That is the same bargain the invisible layer's
@@ -201,24 +213,71 @@ function rendersNothing(gap) {
  * @returns {boolean}
  */
 export function sgrCarriesPayload(text) {
-  let concealed = false;
+  /** @type {Readonly<SgrRendition>} */
+  let rendition = DEFAULT_RENDITION;
   let run = 0;
   let previousEnd = 0;
+  /** @type {Set<string>} */
+  const solidBlocks = new Set();
   for (const token of scanAnsi(text)) {
-    const blankGap = rendersNothing(text.slice(previousEnd, token.start));
+    const gap = text.slice(previousEnd, token.start);
+    const blankGap = rendersNothing(gap);
     previousEnd = token.end;
+    // Judged ahead of the non-SGR exit: the gap before an erase or cursor move
+    // is drawn in the last SGR's state, so `ESC[30;40m` + text + `ESC[2J` +
+    // reset would otherwise hide the text unchecked.
+    if (hidesText(rendition, gap, solidBlocks)) return true;
     if (token.kind !== TOKEN_KIND.SGR) {
       run = 0;
       continue;
     }
-    // This refusal is what blocks `ESC[8m` from hiding text from the human
-    // while leaving its bytes for the model.
-    if (concealed && !blankGap) return true;
     run = blankGap ? run + 1 : 1;
     if (run >= SGR_RUN_THRESHOLD) return true;
-    concealed = sgrConcealState(text.slice(token.start, token.end), concealed);
+    rendition = sgrRendition(text.slice(token.start, token.end), rendition);
+  }
+  return rendition.concealed || foregroundMatchesBackground(rendition);
+}
+
+// A glyph whose identity a foreground painted in its own background hides:
+// anything but whitespace (which looks the same either way) and the Block
+// Elements, which drawsSecondBlockElement judges instead.
+const COLOUR_HIDDEN_GLYPH = /[^\s\u2580-\u259F]/u;
+const BLOCK_ELEMENT = /[\u2580-\u259F]/gu;
+
+/**
+ * True when `gap`, drawn in a foreground matching its background, brings the
+ * text's count of distinct Block Elements (U+2580-U+259F) so drawn past one.
+ * In matching colours every one paints a solid cell, hiding the glyph CHOICE
+ * from a human; a single glyph throughout is what a half-block image renderer
+ * (catimg's `▀`) emits, so only a second one is refused. `seen` spans the whole
+ * text so the choice cannot be spread one glyph per sequence.
+ * @param {string} gap @param {Set<string>} seen
+ * @returns {boolean}
+ */
+function drawsSecondBlockElement(gap, seen) {
+  for (const [glyph] of gap.matchAll(BLOCK_ELEMENT)) {
+    seen.add(glyph);
+    if (seen.size > 1) return true;
   }
-  return concealed;
+  return false;
+}
+
+/**
+ * True when `rendition` hides some of `gap` from a human: CONCEAL blanks every
+ * glyph, and a foreground matching its background hides every
+ * {@link COLOUR_HIDDEN_GLYPH} and the choice among Block Elements.
+ * @param {Readonly<SgrRendition>} rendition @param {string} gap
+ * @param {Set<string>} solidBlocks  the Block Elements already drawn in
+ *   matching colours, across the whole text
+ * @returns {boolean}
+ */
+function hidesText(rendition, gap, solidBlocks) {
+  if (rendition.concealed) return !rendersNothing(gap);
+  if (!foregroundMatchesBackground(rendition)) return false;
+  return (
+    COLOUR_HIDDEN_GLYPH.test(gap.replace(STRIP, "")) ||
+    drawsSecondBlockElement(gap, solidBlocks)
+  );
 }
 
 /**
@@ -233,21 +292,58 @@ export function isBenignAnsi(text) {
   return isBenignAnsiKinds(applyLayer1(text).ansiKinds);
 }
 
+/**
+ * True when the escapes in `text` may be let through: every removed kind is
+ * inert ({@link isBenignAnsiKinds}) AND the SGR is just styling
+ * ({@link sgrCarriesPayload}). THE answer for every surface that preserves
+ * escapes, so `ESC[8m` cannot be inert to one and hiding text in another.
+ * @param {string} text  the raw text, as a terminal would receive it
+ * @param {Iterable<string>} [kinds]  the {@link TOKEN_KIND}s a strip of `text`
+ *   removed, when the caller already has them; defaults to Layer 1's
+ * @returns {boolean}
+ */
+export function escapesPreservable(text, kinds = applyLayer1(text).ansiKinds) {
+  return isBenignAnsiKinds([...kinds]) && !sgrCarriesPayload(text);
+}
+
 // How many times the {ANSI strip, invisible strip} composition may re-run before
-// the sweep is forced. Each iteration deletes at least one character, so the
-// loop terminates on its own; the bound is a DoS guard: n rounds of O(n) scans
-// on adversarial input is quadratic.
-// Three rounds is what the deepest REAL reconstitution needs — strip
-// invisibles, remove the ANSI they hid, strip the joiners that ANSI removal
-// made adjacent, confirm — so four leaves a round of margin. Deeper nesting is
-// not reachable through the carve-out: preserving a joiner requires cursive or
-// emoji neighbours on BOTH sides, so a preserved joiner can never sit inside an
-// escape sequence, and every joiner that hides one is therefore stripped by the
-// FIRST invisible pass. Past the bound the composition simply stops early — the
-// final sweep still holds the no-introducer guarantee, and what is left degrades
-// to visible text (the fail-open direction).
+// it falls back to {@link stripLayer1Monotone}. Each iteration deletes at least
+// one character, so the loop terminates on its own; the bound is a DoS guard: n
+// rounds of O(n) scans on adversarial input is quadratic. Three rounds is what
+// the deepest REAL reconstitution needs (strip invisibles, remove the ANSI they
+// hid, strip the joiners that removal made adjacent, confirm). Adversarial input
+// can need more — a registered variation selector preserved INSIDE an escape,
+// whose preserve budget shrinks as each removal shortens the text.
 const MAX_LAYER1_PASSES = 4;
 
+/**
+ * Remove every complete ANSI sequence and then every raw control introducer
+ * left over. The output holds no introducer, so no later pass can find an
+ * escape in it: a fixed point by construction.
+ * @param {string} text
+ * @param {Set<string>} [kinds]  collects the {@link TOKEN_KIND} of every removal
+ * @returns {string}
+ */
+export function stripTerminalFully(text, kinds = new Set()) {
+  return sweepIntroducers(stripAnsiFully(text, kinds), kinds);
+}
+
+/**
+ * The carve-out-free Layer 1 a non-converging composition falls back to: EVERY
+ * invisible, then every escape and introducer, so its output is a fixed point.
+ * It starts from what the caller SENT: an earlier sweep may already have turned
+ * an escape's body into text no later strip can tell from prose.
+ * @param {string} text  what the caller sent
+ * @param {Set<string>} found  collects the invisible CATEGORY codes removed
+ * @param {Set<string>} kinds  collects the {@link TOKEN_KIND} of every removal
+ * @returns {string}
+ */
+function stripLayer1Monotone(text, found, kinds) {
+  const bulk = stripInvisibleWithReport(text, text, { carveOut: false });
+  for (const category of bulk.found) found.add(category);
+  return stripTerminalFully(bulk.cleaned, kinds);
+}
+
 /**
  * Layer 1: ANSI + invisible-char strip with a result guaranteed free of every
  * raw ANSI control introducer (7-bit ESC U+001B and the whole 8-bit C1 control
@@ -266,9 +362,10 @@ const MAX_LAYER1_PASSES = 4;
  *
  * The residual sweep runs only once the composition is STABLE, because sweeping
  * an introducer early destroys the sequence a later ANSI pass would have removed
- * whole, promoting a hidden control to visible text. A final UNCONDITIONAL sweep
- * follows the loop so the no-raw-introducer guarantee does not depend on the
- * pass bound.
+ * whole, promoting a hidden control to visible text. A composition that has not
+ * converged within the pass bound falls back to a carve-out-free strip whose
+ * output holds no invisible and no introducer, so both the no-raw-introducer
+ * guarantee and idempotence hold whatever the bound.
  *
  * `deAnsi` is the ANSI strip of the ORIGINAL text (invisible runs intact), the
  * scope a LONG_RUN payload check needs — not an intermediate of the loop.
@@ -288,6 +385,7 @@ export function applyLayer1(text) {
   /** @type {Set<string>} Union of the categories every iteration reported. */
   const found = new Set();
   let cleaned = text;
+  let converged = false;
 
   for (let pass = 0; pass < MAX_LAYER1_PASSES; pass++) {
     const afterAnsi = pass === 0 ? deAnsi : stripAnsiFully(cleaned, ansiKinds);
@@ -312,11 +410,16 @@ export function applyLayer1(text) {
     // introducer can make invisibles adjacent, exactly as removing a sequence
     // can); one that changes nothing means the whole composition has converged.
     const swept = sweepIntroducers(cleaned, ansiKinds);
-    if (swept === cleaned) break;
+    if (swept === cleaned) {
+      converged = true;
+      break;
+    }
     cleaned = swept;
   }
 
-  cleaned = sweepIntroducers(cleaned, ansiKinds);
+  // Keeps Layer 1 a FIXED POINT past the pass bound: an unconverged state
+  // re-cleans to something else and may still hold an escape.
+  if (!converged) cleaned = stripLayer1Monotone(text, found, ansiKinds);
 
   // Derived, not tracked in parallel: a kind is recorded exactly when an ANSI
   // pass or the sweep removed bytes, so the category and the severity detail

package/src/prompt.mjs

@@ -14,8 +14,9 @@
  * output (test runs, build logs) is the single most common debugging action,
  * and SGR is display-only by the ECMA-48 grammar; an orphan `ESC` is not a
  * sequence at all. Neither can move the cursor, erase the screen, or carry an
- * OSC payload. Anything that IS a complete CSI/OSC token still blocks, as do
- * the invisible-char thresholds.
+ * OSC payload. Anything that IS a complete CSI/OSC token still blocks, as does
+ * SGR that hides text (CONCEAL, a foreground in its own background, a run that
+ * renders nothing) and the invisible-char verdict.
  */
 import {
   CHECKS,
@@ -23,10 +24,9 @@ import {
   CATEGORY_LABELS,
   LONG_RUN_THRESHOLD,
   SCATTERED_THRESHOLD,
-  countEffectiveInvisible,
-  payloadLongRunSample,
+  payloadVerdict,
 } from "./invisible.mjs";
-import { isBenignAnsi, stripAnsiFully } from "./layer1.mjs";
+import { escapesPreservable, stripAnsiFully } from "./layer1.mjs";
 import { CONTROL_INTRODUCER_SOURCE } from "./ansi.mjs";
 
 // Every raw ANSI control a prompt can carry: 7-bit ESC (U+001B) and the entire
@@ -95,27 +95,21 @@ export function classifyPrompt(prompt, strip = stripAnsiFully) {
   const hasAnsi = ANSI_INTRODUCER.test(prompt);
   const deAnsi = strip(prompt);
 
-  // Both gates read the SHARED definitions in ./invisible.mjs rather than
-  // spelling their own: what counts as a hidden run, and how many invisibles a
-  // text really carries once the carve-out's preserved joiners and its
-  // over-budget surplus are accounted for. See payloadLongRunSample /
-  // countEffectiveInvisible — including why the run probe masks the invisibles
-  // the strip layer would PRESERVE, so a legitimate emoji sequence cannot block
-  // a prompt that the strip layer would not even have flagged.
-  const longRunSample = payloadLongRunSample(deAnsi);
-  const invisibleCount = countEffectiveInvisible(deAnsi);
-  const invisiblesBelowThreshold =
-    longRunSample === null && invisibleCount < SCATTERED_THRESHOLD;
+  // The invisible half is payloadVerdict — the one definition the instruction
+  // scanner and the write path also gate on — so a legitimate emoji sequence
+  // cannot block a prompt that the other surfaces would not even have flagged.
+  const verdict = payloadVerdict(deAnsi);
 
-  if (!hasAnsi && invisiblesBelowThreshold) return { action: "pass" };
+  if (!hasAnsi && !verdict.payloadCapable) return { action: "pass" };
 
   // Inert escapes in an otherwise clean prompt — display-only colour and/or an
   // orphan introducer that forms no sequence: pass with a note instead of
   // blocking, so pasted colored logs and log fragments cut mid-escape remain
-  // usable. isBenignAnsi judges from what Layer 1's strip actually removed, so
-  // it covers the whole C1 block and any sequence that only reconstitutes
-  // during the strip; a complete CSI/OSC token falls through to the block.
-  if (hasAnsi && invisiblesBelowThreshold && isBenignAnsi(prompt))
+  // usable. escapesPreservable judges from what Layer 1's strip actually
+  // removed (the whole C1 block, and any sequence that only reconstitutes during
+  // the strip) AND refuses SGR that hides text; anything else falls through to
+  // the block.
+  if (hasAnsi && !verdict.payloadCapable && escapesPreservable(prompt))
     return { action: "note" };
 
   // CHECKS pairs a machine-readable category code with its detector; map each
@@ -126,6 +120,10 @@ export function classifyPrompt(prompt, strip = stripAnsiFully) {
   if (hasAnsi) categories.push(CATEGORY_LABELS[CATEGORY.ANSI]);
   return {
     action: "block",
-    reason: formatReason(categories, invisibleCount, longRunSample),
+    reason: formatReason(
+      categories,
+      verdict.invisibleCount,
+      verdict.firstRun?.text ?? null,
+    ),
   };
 }

package/src/standardized-variants.mjs

@@ -2,19 +2,19 @@
  * GENERATED by scripts/gen-standardized-variants.mjs from UCD
  * StandardizedVariants.txt (Unicode 17.0.0) — DO NOT EDIT.
  *
- * Registered standardized variation sequences: a base code point followed by a
- * variation selector in U+FE00–U+FE0D. invisible.mjs preserves such a selector
- * only when the immediately preceding base appears here; every other FE00–FE0D
- * selector is stripped as a hidden-payload byte. Regenerate with
- * `node scripts/gen-standardized-variants.mjs`; test/invisible-charset.test.mjs
- * fails if this drifts from the pinned UCD slice.
+ * Registered standardized variation sequences: a base code point followed by the
+ * variation selector the UCD registers for it. invisible.mjs preserves such a
+ * selector only when the immediately preceding base appears here; every other
+ * one is stripped as a hidden-payload byte. Regenerate with
+ * `node scripts/gen-standardized-variants.mjs`;
+ * test/invisible-charset.test.mjs fails if this drifts from the pinned UCD.
  */
 
 export const UNICODE_VERSION = "17.0.0";
 
 // The table below is GENERATED UCD data, not hand-written logic. Its correctness
 // is pinned by the SSOT round-trip in test/invisible-charset.test.mjs (re-parse
-// the vendored slice, then assert every pair matches) — a stronger and faster
+// the vendored file, then assert every pair matches) — a stronger and faster
 // guard than mutating a few hundred numeric literals, so Stryker skips them.
 // Stryker disable all
 /** @type {Array<[number, number]>} [base, selector], sorted by base then selector. */
@@ -36,6 +36,66 @@ export const STANDARDIZED_VARIANTS = [
   [0x1078, 0xfe00],
   [0x107a, 0xfe00],
   [0x1080, 0xfe00],
+  [0x1820, 0x180b],
+  [0x1820, 0x180c],
+  [0x1821, 0x180b],
+  [0x1822, 0x180b],
+  [0x1823, 0x180b],
+  [0x1824, 0x180b],
+  [0x1825, 0x180b],
+  [0x1825, 0x180c],
+  [0x1826, 0x180b],
+  [0x1826, 0x180c],
+  [0x1828, 0x180b],
+  [0x1828, 0x180c],
+  [0x1828, 0x180d],
+  [0x182a, 0x180b],
+  [0x182c, 0x180b],
+  [0x182c, 0x180c],
+  [0x182c, 0x180d],
+  [0x182d, 0x180b],
+  [0x182d, 0x180c],
+  [0x182d, 0x180d],
+  [0x1830, 0x180b],
+  [0x1830, 0x180c],
+  [0x1832, 0x180b],
+  [0x1833, 0x180b],
+  [0x1835, 0x180b],
+  [0x1836, 0x180b],
+  [0x1836, 0x180c],
+  [0x1838, 0x180b],
+  [0x1844, 0x180b],
+  [0x1845, 0x180b],
+  [0x1846, 0x180b],
+  [0x1847, 0x180b],
+  [0x1847, 0x180c],
+  [0x1848, 0x180b],
+  [0x1849, 0x180b],
+  [0x184d, 0x180b],
+  [0x184e, 0x180b],
+  [0x185d, 0x180b],
+  [0x185e, 0x180b],
+  [0x185e, 0x180c],
+  [0x1860, 0x180b],
+  [0x1863, 0x180b],
+  [0x1868, 0x180b],
+  [0x1868, 0x180c],
+  [0x1869, 0x180b],
+  [0x186f, 0x180b],
+  [0x1873, 0x180b],
+  [0x1873, 0x180c],
+  [0x1873, 0x180d],
+  [0x1874, 0x180b],
+  [0x1874, 0x180c],
+  [0x1874, 0x180d],
+  [0x1876, 0x180b],
+  [0x1880, 0x180b],
+  [0x1881, 0x180b],
+  [0x1887, 0x180b],
+  [0x1887, 0x180c],
+  [0x1887, 0x180d],
+  [0x1888, 0x180b],
+  [0x188a, 0x180b],
   [0x2018, 0xfe00],
   [0x2018, 0xfe01],
   [0x2018, 0xfe02],
@@ -1324,8 +1384,8 @@ const VARIANT_KEYS = new Set(
 );
 
 /**
- * True when `base` followed by `selector` (a U+FE00–U+FE0D code point) is a
- * registered standardized variation sequence.
+ * True when `base` followed by `selector` is a registered standardized
+ * variation sequence.
  * @param {number} base
  * @param {number} selector
  * @returns {boolean}