llm-entropy-filter 1.1.0 → 1.2.0

package/rulesets/default.json

@@ -1,73 +1,77 @@
-{
-  "name": "default",
-  "version": 1,
-  "description": "Balanced preset: safe defaults for general apps.",
-  "thresholds": { "warn": 0.45, "block": 0.65 },
-  "normalization": {
-    "lowercase": true,
-    "trim": true,
-    "collapse_whitespace": true,
-    "unicode_nfkc": true
-  },
-  "hard_triggers": [
-    {
-      "id": "shouting",
-      "type": "signal",
-      "weight": 0.18,
-      "notes": "Excess uppercase or repeated punctuation",
-      "patterns": ["[A-ZÁÉÍÓÚÑ]{6,}", "!!+", "\\?\\?+", "¡¡+", "…{3,}"]
-    },
-    {
-      "id": "urgency",
-      "type": "topic_hint",
-      "weight": 0.12,
-      "patterns": ["\\bnow\\b", "\\btoday\\b", "\\burgent\\b", "\\bya\\b", "\\bahora\\b", "\\bhoy\\b", "\\búltim[oa]s?\\b", "\\bsolo\\s+hoy\\b"]
-    },
-    {
-      "id": "money_signal",
-      "type": "topic_hint",
-      "weight": 0.12,
-      "patterns": ["\\$\\d+", "\\bUSD\\b", "\\bMXN\\b", "\\b%\\b", "\\b90%\\b", "\\bfree\\b", "\\bgratis\\b", "\\bpromo\\b", "\\bdiscount\\b", "\\boffer\\b", "\\boferta\\b"]
-    },
-    {
-      "id": "conspiracy_vague",
-      "type": "topic_hint",
-      "weight": 0.14,
-      "patterns": ["\\ball\\s+hide\\b", "\\bthey\\s+hide\\b", "\\beveryone\\s+knows\\b", "\\btodos\\s+lo\\s+esconden\\b", "\\bla\\s+verdad\\s+oculta\\b", "\\bnadie\\s+quiere\\s+que\\s+sepas\\b"]
-    }
-  ],
-  "topics": [
-    {
-      "id": "marketing_spam",
-      "weight": 0.35,
-      "signals": [
-        { "id": "cta", "weight": 0.18, "patterns": ["\\bclick\\b", "\\bclaim\\b", "\\bbuy\\b", "\\bcompra\\b", "\\borden(a|e)\\b"] },
-        { "id": "promo_terms", "weight": 0.15, "patterns": ["\\bfree\\b", "\\bgratis\\b", "\\bwin\\b", "\\bganaste\\b", "\\biphone\\b", "\\bpremio\\b"] },
-        { "id": "links", "weight": 0.12, "patterns": ["https?://", "www\\.", "\\bbit\\.ly\\b"] }
-      ]
-    },
-    {
-      "id": "coercion",
-      "weight": 0.25,
-      "signals": [
-        { "id": "threat", "weight": 0.18, "patterns": ["\\bor\\s+else\\b", "\\bsi\\s+no\\b", "\\bte\\s+voy\\s+a\\b", "\\bI\\s+will\\b"] },
-        { "id": "forced_tone", "weight": 0.12, "patterns": ["\\bdo\\s+it\\b", "\\bhazlo\\b", "\\bahora\\b"] }
-      ]
-    },
-    {
-      "id": "conspiracy",
-      "weight": 0.25,
-      "signals": [
-        { "id": "vague_all", "weight": 0.18, "patterns": ["\\btodos\\b", "\\beveryone\\b", "\\bthey\\b", "\\bel\\s+sistema\\b"] },
-        { "id": "hidden_truth", "weight": 0.14, "patterns": ["\\bocult\\w+\\b", "\\bhidden\\b", "\\bsecret\\b", "\\bcover\\s*up\\b"] }
-      ]
-    },
-    {
-      "id": "broken_causality",
-      "weight": 0.15,
-      "signals": [
-        { "id": "contradiction_markers", "weight": 0.12, "patterns": ["\\bpero\\s+entonces\\b", "\\btherefore\\b.*\\bnot\\b", "\\bsi\\s+A\\s+entonces\\s+no\\s+A\\b"] }
-      ]
-    }
-  ]
-}
+{
+  "name": "default",
+  "version": 1,
+  "description": "Balanced preset: safe defaults for general apps.",
+  "thresholds": { "warn": 0.45, "block": 0.65 },
+  "policy": { "strong_spam_block": false },
+
+  "normalization": {
+    "lowercase": true,
+    "trim": true,
+    "collapse_whitespace": true,
+    "unicode_nfkc": true
+  },
+  "hard_triggers": [
+    {
+      "id": "shouting",
+      "type": "signal",
+      "weight": 0.18,
+      "notes": "Excess uppercase or repeated punctuation",
+      "patterns": ["[A-ZÁÉÍÓÚÑ]{6,}", "!!+", "\\?\\?+", "¡¡+", "…{3,}"]
+    },
+    {
+      "id": "urgency",
+      "type": "topic_hint",
+      "weight": 0.12,
+      "patterns": ["\\bnow\\b", "\\btoday\\b", "\\burgent\\b", "\\bya\\b", "\\bahora\\b", "\\bhoy\\b", "\\búltim[oa]s?\\b", "\\bsolo\\s+hoy\\b"]
+    },
+    {
+      "id": "money_signal",
+      "type": "topic_hint",
+      "weight": 0.12,
+      "patterns": ["\\$\\d+", "\\bUSD\\b", "\\bMXN\\b", "\\b%\\b", "\\b90%\\b", "\\bfree\\b", "\\bgratis\\b", "\\bpromo\\b", "\\bdiscount\\b", "\\boffer\\b", "\\boferta\\b"]
+    },
+    {
+      "id": "conspiracy_vague",
+      "type": "topic_hint",
+      "weight": 0.14,
+      "patterns": ["\\ball\\s+hide\\b", "\\bthey\\s+hide\\b", "\\beveryone\\s+knows\\b", "\\btodos\\s+lo\\s+esconden\\b", "\\bla\\s+verdad\\s+oculta\\b", "\\bnadie\\s+quiere\\s+que\\s+sepas\\b"]
+    }
+  ],
+  "topics": [
+    {
+      "id": "marketing_spam",
+      "weight": 0.35,
+      "signals": [
+        { "id": "cta", "weight": 0.18, "patterns": ["\\bclick\\b", "\\bclaim\\b", "\\bbuy\\b", "\\bcompra\\b", "\\borden(a|e)\\b"] },
+        { "id": "promo_terms", "weight": 0.15, "patterns": ["\\bfree\\b", "\\bgratis\\b", "\\bwin\\b", "\\bganaste\\b", "\\biphone\\b", "\\bpremio\\b"] },
+        { "id": "links", "weight": 0.12, "patterns": ["https?://", "www\\.", "\\bbit\\.ly\\b"] }
+      ]
+    },
+    {
+      "id": "coercion",
+      "weight": 0.25,
+      "signals": [
+        { "id": "threat", "weight": 0.18, "patterns": ["\\bor\\s+else\\b", "\\bsi\\s+no\\b", "\\bte\\s+voy\\s+a\\b", "\\bI\\s+will\\b"] },
+        { "id": "forced_tone", "weight": 0.12, "patterns": ["\\bdo\\s+it\\b", "\\bhazlo\\b", "\\bahora\\b"] }
+      ]
+    },
+    {
+      "id": "conspiracy",
+      "weight": 0.25,
+      "signals": [
+        { "id": "vague_all", "weight": 0.18, "patterns": ["\\btodos\\b", "\\beveryone\\b", "\\bthey\\b", "\\bel\\s+sistema\\b"] },
+        { "id": "hidden_truth", "weight": 0.14, "patterns": ["\\bocult\\w+\\b", "\\bhidden\\b", "\\bsecret\\b", "\\bcover\\s*up\\b"] }
+      ]
+    },
+    {
+      "id": "broken_causality",
+      "weight": 0.15,
+      "signals": [
+        { "id": "contradiction_markers", "weight": 0.12, "patterns": ["\\bpero\\s+entonces\\b", "\\btherefore\\b.*\\bnot\\b", "\\bsi\\s+A\\s+entonces\\s+no\\s+A\\b"] }
+      ]
+    }
+  ]
+}
+
+

package/rulesets/public-api.js

@@ -0,0 +1,7 @@
+import fs from "node:fs";
+import path from "node:path";
+
+const jsonPath = path.join(path.dirname(new URL(import.meta.url).pathname), "public-api.json");
+const rules = JSON.parse(fs.readFileSync(jsonPath, "utf8"));
+
+export default rules;

package/rulesets/public-api.json

@@ -1,27 +1,179 @@
-{
-  "name": "public-api",
-  "version": 1,
-  "description": "Hardened preset for open/public APIs: reduces abuse and quota burn.",
-  "thresholds": { "warn": 0.40, "block": 0.60 },
-  "normalization": { "lowercase": true, "trim": true, "collapse_whitespace": true, "unicode_nfkc": true },
-  "hard_triggers": [
-    { "id": "links", "type": "signal", "weight": 0.22, "patterns": ["https?://", "www\\.", "\\bbit\\.ly\\b", "\\bt\\.co\\b"] },
-    { "id": "shouting", "type": "signal", "weight": 0.18, "patterns": ["[A-ZÁÉÍÓÚÑ]{5,}", "!!+", "\\?\\?+"] },
-    { "id": "money_signal", "type": "topic_hint", "weight": 0.16, "patterns": ["\\$\\d+", "\\b%\\b", "\\bfree\\b", "\\bgratis\\b"] }
-  ],
-  "topics": [
-    { "id": "marketing_spam", "weight": 0.40, "signals": [
-      { "id": "cta", "weight": 0.20, "patterns": ["\\bclick\\b", "\\bclaim\\b", "\\bbuy\\b", "\\bcompra\\b"] },
-      { "id": "promo", "weight": 0.18, "patterns": ["\\bfree\\b", "\\bgratis\\b", "\\bwin\\b", "\\bganaste\\b"] }
-    ]},
-    { "id": "coercion", "weight": 0.25, "signals": [
-      { "id": "threat", "weight": 0.18, "patterns": ["\\bor\\s+else\\b", "\\bsi\\s+no\\b", "\\bI\\s+will\\b"] }
-    ]},
-    { "id": "conspiracy", "weight": 0.20, "signals": [
-      { "id": "hidden", "weight": 0.14, "patterns": ["\\bocult\\w+\\b", "\\bhidden\\b", "\\bsecret\\b"] }
-    ]},
-    { "id": "incoherence", "weight": 0.15, "signals": [
-      { "id": "noise_markers", "weight": 0.10, "patterns": ["\\bqwerty\\b", "\\basdf\\b", "([!?.])\\1{4,}"] }
-    ]}
-  ]
-}
+{
+  "name": "public-api",
+  "version": 1,
+  "description": "Hardened preset for open/public APIs: reduces abuse and quota burn.",
+  "thresholds": { "warn": 0.40, "block": 0.60 },
+  "normalization": {
+    "lowercase": true,
+    "trim": true,
+    "collapse_whitespace": true,
+    "unicode_nfkc": true
+  },
+  "policy": {
+    "strong_spam_block": false,
+    "block_flags": ["phishing_verify_threat_en", "phishing_2fa_code"],
+    "warn_flags": ["fraud_payment_request", "scam_wfh"]
+  },
+  "hard_triggers": [
+    {
+      "id": "links",
+      "type": "signal",
+      "weight": 0.22,
+      "patterns": ["https?://", "www\\.", "\\bbit\\.ly\\b", "\\bt\\.co\\b"]
+    },
+    {
+      "id": "shouting",
+      "type": "signal",
+      "weight": 0.18,
+      "patterns": ["[A-ZÁÉÍÓÚÑ]{5,}", "!!+", "\\?\\?+"]
+    },
+    {
+      "id": "money_signal",
+      "type": "topic_hint",
+      "weight": 0.16,
+      "patterns": ["\\$\\d+", "\\b%\\b", "\\bfree\\b", "\\bgratis\\b"]
+    },
+        {
+      "id": "phishing_2fa_code_request_es",
+      "type": "topic_hint",
+      "weight": 0.60,
+      "notes": "ES: solicitud de código de verificación / 2FA (alto riesgo de phishing).",
+      "patterns": [
+        "\\bc[oó]digo\\s+de\\s+verificaci[oó]n\\b",
+        "\\bc[oó]digo\\s+de\\s+seguridad\\b",
+        "\\btoken\\s+de\\s+verificaci[oó]n\\b",
+        "\\bclave\\s+de\\s+verificaci[oó]n\\b",
+        "\\benv[ií]ame\\s+tu\\s+c[oó]digo\\b",
+        "\\bm[aá]ndame\\s+tu\\s+c[oó]digo\\b"
+      ]
+    },
+    {
+      "id": "fraud_card_request_es",
+      "type": "topic_hint",
+      "weight": 0.55,
+      "notes": "ES: solicitud de tarjeta/datos bancarios (alto riesgo de fraude).",
+      "patterns": [
+        "\\b(tarjeta|n[uú]mero\\s+de\\s+tarjeta)\\b",
+        "\\b(cv[vv]|cvc)\\b",
+        "\\bfecha\\s+de\\s+vencimiento\\b",
+        "\\bpor\\s+mensaje\\s+tu\\s+tarjeta\\b",
+        "\\bm[aá]ndame\\s+tu\\s+tarjeta\\b",
+        "\\benv[ií]ame\\s+tu\\s+tarjeta\\b"
+      ]
+    },
+    {
+      "id": "phish_account_threat_en",
+      "type": "topic_hint",
+      "weight": 0.35,
+      "notes": "EN: verify account + threat of closure (phishing-ish).",
+      "patterns": [
+        "\\bverify\\s+your\\s+account\\b.*\\b(closed|suspended|disabled)\\b",
+        "\\bor\\s+it\\s+will\\s+be\\s+(closed|suspended|disabled)\\b"
+      ]
+    },
+    {
+      "id": "scam_easy_money_es",
+      "type": "topic_hint",
+      "weight": 0.45,
+      "notes": "ES: estafa típica de dinero fácil / desde casa.",
+      "patterns": [
+        "gana\\s+dinero\\s+desde\\s+casa",
+        "sin\\s+esfuerzo",
+        "ingresos\\s+pasivos",
+        "dinero\\s+f[aá]cil"
+      ]
+    }
+  ],
+  "topics": [
+    {
+      "id": "marketing_spam",
+      "weight": 0.4,
+      "signals": [
+        {
+          "id": "cta",
+          "weight": 0.2,
+          "patterns": ["\\bclick\\b", "\\bclaim\\b", "\\bbuy\\b", "\\bcompra\\b"]
+        },
+        {
+          "id": "promo",
+          "weight": 0.18,
+          "patterns": ["\\bfree\\b", "\\bgratis\\b", "\\bwin\\b", "\\bganaste\\b"]
+        }
+      ]
+    },
+    {
+      "id": "coercion",
+      "weight": 0.25,
+      "signals": [
+        {
+          "id": "threat",
+          "weight": 0.18,
+          "patterns": ["\\bor\\s+else\\b", "\\bsi\\s+no\\b", "\\bI\\s+will\\b"]
+        }
+      ]
+    },
+    {
+      "id": "conspiracy",
+      "weight": 0.2,
+      "signals": [
+        {
+          "id": "hidden",
+          "weight": 0.14,
+          "patterns": ["\\bocult\\w+\\b", "\\bhidden\\b", "\\bsecret\\b"]
+        }
+      ]
+    },
+    {
+      "id": "incoherence",
+      "weight": 0.15,
+      "signals": [
+        {
+          "id": "noise_markers",
+          "weight": 0.1,
+          "patterns": ["\\bqwerty\\b", "\\basdf\\b", "([!?.])\\1{4,}"]
+        }
+      ]
+    },
+    {
+      "id": "phishing_fraud",
+      "weight": 0.45,
+      "signals": [
+        {
+          "id": "verify_account_request",
+          "weight": 0.3,
+          "patterns": [
+            "\\bverify\\s+your\\s+account\\b",
+            "\\bconfirm\\s+your\\s+account\\b",
+            "\\baccount\\s+will\\s+be\\s+closed\\b",
+            "\\bcódigo\\s+de\\s+verificación\\b",
+            "\\benvíame\\s+tu\\s+código\\b",
+            "\\bconfirma\\s+tu\\s+cuenta\\b"
+          ]
+        },
+        {
+          "id": "financial_data_request",
+          "weight": 0.35,
+          "patterns": [
+            "\\bmandas\\s+tu\\s+tarjeta\\b",
+            "\\benvía\\s+tu\\s+tarjeta\\b",
+            "\\bsend\\s+me\\s+your\\s+card\\b",
+            "\\btransferencia\\b",
+            "\\bwire\\b",
+            "\\bdeposito\\b",
+            "\\bdepósito\\b"
+          ]
+        },
+        {
+          "id": "easy_money_scam",
+          "weight": 0.25,
+          "patterns": [
+            "\\bgana\\s+dinero\\s+desde\\s+casa\\b",
+            "\\bearn\\s+money\\s+from\\s+home\\b",
+            "\\bsin\\s+esfuerzo\\b",
+            "\\bno\\s+experience\\s+needed\\b"
+          ]
+        }
+      ]
+    }
+  ]
+}

package/rulesets/schema

@@ -1,24 +1,24 @@
-{
-  "name": "default",
-  "version": 1,
-  "description": "Balanced preset",
-  "thresholds": { "warn": 0.45, "block": 0.65 },
-  "hard_triggers": [
-    { "id": "shouting", "type": "pattern", "weight": 0.20, "patterns": ["..."] }
-  ],
-  "topics": [
-    {
-      "id": "marketing_spam",
-      "weight": 0.25,
-      "signals": [
-        { "id": "money_signal", "weight": 0.10, "patterns": ["..."] }
-      ]
-    }
-  ],
-  "normalization": {
-    "lowercase": true,
-    "trim": true,
-    "collapse_whitespace": true,
-    "unicode_nfkc": true
-  }
-}
+{
+  "name": "default",
+  "version": 1,
+  "description": "Balanced preset",
+  "thresholds": { "warn": 0.45, "block": 0.65 },
+  "hard_triggers": [
+    { "id": "shouting", "type": "pattern", "weight": 0.20, "patterns": ["..."] }
+  ],
+  "topics": [
+    {
+      "id": "marketing_spam",
+      "weight": 0.25,
+      "signals": [
+        { "id": "money_signal", "weight": 0.10, "patterns": ["..."] }
+      ]
+    }
+  ],
+  "normalization": {
+    "lowercase": true,
+    "trim": true,
+    "collapse_whitespace": true,
+    "unicode_nfkc": true
+  }
+}

package/rulesets/strict.js

@@ -0,0 +1,7 @@
+import fs from "node:fs";
+import path from "node:path";
+
+const jsonPath = path.join(path.dirname(new URL(import.meta.url).pathname), "strict.json");
+const rules = JSON.parse(fs.readFileSync(jsonPath, "utf8"));
+
+export default rules;

package/rulesets/strict.json

@@ -1,25 +1,173 @@
-{
-  "name": "strict",
-  "version": 1,
-  "description": "Aggressive preset for public endpoints and high-abuse environments.",
-  "thresholds": { "warn": 0.35, "block": 0.55 },
-  "normalization": { "lowercase": true, "trim": true, "collapse_whitespace": true, "unicode_nfkc": true },
-  "hard_triggers": [
-    { "id": "shouting", "type": "signal", "weight": 0.22, "patterns": ["[A-ZÁÉÍÓÚÑ]{5,}", "!!+", "\\?\\?+", "¡¡+"] },
-    { "id": "money_signal", "type": "topic_hint", "weight": 0.18, "patterns": ["\\$\\d+", "\\b%\\b", "\\bfree\\b", "\\bgratis\\b"] },
-    { "id": "links", "type": "signal", "weight": 0.20, "patterns": ["https?://", "www\\.", "\\bbit\\.ly\\b"] },
-    { "id": "conspiracy_vague", "type": "topic_hint", "weight": 0.18, "patterns": ["\\btodos\\s+lo\\s+esconden\\b", "\\btruth\\s+is\\s+hidden\\b"] }
-  ],
-  "topics": [
-    { "id": "marketing_spam", "weight": 0.45, "signals": [
-      { "id": "cta", "weight": 0.22, "patterns": ["\\bclick\\b", "\\bclaim\\b", "\\bbuy\\b", "\\bcompra\\b"] },
-      { "id": "promo", "weight": 0.18, "patterns": ["\\bwin\\b", "\\bganaste\\b", "\\bgratis\\b", "\\bfree\\b"] }
-    ]},
-    { "id": "coercion", "weight": 0.30, "signals": [
-      { "id": "threat", "weight": 0.22, "patterns": ["\\bor\\s+else\\b", "\\bsi\\s+no\\b", "\\bI\\s+will\\b", "\\bte\\s+voy\\s+a\\b"] }
-    ]},
-    { "id": "conspiracy", "weight": 0.25, "signals": [
-      { "id": "hidden", "weight": 0.20, "patterns": ["\\bocult\\w+\\b", "\\bhidden\\b", "\\bsecret\\b"] }
-    ]}
-  ]
-}
+{
+  "name": "strict",
+  "version": 1,
+  "description": "Aggressive preset for public endpoints and high-abuse environments.",
+  "thresholds": { "warn": 0.35, "block": 0.55 },
+  "normalization": {
+    "lowercase": true,
+    "trim": true,
+    "collapse_whitespace": true,
+    "unicode_nfkc": true
+  },
+  "policy": {
+    "strong_spam_block": false,
+    "block_flags": ["fraud_payment_request", "scam_wfh", "phishing_verify_threat_en", "phishing_2fa_code"]
+  },
+  "hard_triggers": [
+    {
+      "id": "shouting",
+      "type": "signal",
+      "weight": 0.22,
+      "patterns": ["[A-ZÁÉÍÓÚÑ]{5,}", "!!+", "\\?\\?+", "¡¡+"]
+    },
+    {
+      "id": "money_signal",
+      "type": "topic_hint",
+      "weight": 0.18,
+      "patterns": ["\\$\\d+", "\\b%\\b", "\\bfree\\b", "\\bgratis\\b"]
+    },
+    {
+      "id": "links",
+      "type": "signal",
+      "weight": 0.2,
+      "patterns": ["https?://", "www\\.", "\\bbit\\.ly\\b"]
+    },
+    {
+      "id": "conspiracy_vague",
+      "type": "topic_hint",
+      "weight": 0.18,
+      "patterns": ["\\btodos\\s+lo\\s+esconden\\b", "\\btruth\\s+is\\s+hidden\\b"]
+    },
+        {
+      "id": "phishing_2fa_code_request_es",
+      "type": "topic_hint",
+      "weight": 0.60,
+      "notes": "ES: solicitud de código de verificación / 2FA (alto riesgo de phishing).",
+      "patterns": [
+        "\\bc[oó]digo\\s+de\\s+verificaci[oó]n\\b",
+        "\\bc[oó]digo\\s+de\\s+seguridad\\b",
+        "\\btoken\\s+de\\s+verificaci[oó]n\\b",
+        "\\bclave\\s+de\\s+verificaci[oó]n\\b",
+        "\\benv[ií]ame\\s+tu\\s+c[oó]digo\\b",
+        "\\bm[aá]ndame\\s+tu\\s+c[oó]digo\\b"
+      ]
+    },
+    {
+      "id": "fraud_card_request_es",
+      "type": "topic_hint",
+      "weight": 0.55,
+      "notes": "ES: solicitud de tarjeta/datos bancarios (alto riesgo de fraude).",
+      "patterns": [
+        "\\b(tarjeta|n[uú]mero\\s+de\\s+tarjeta)\\b",
+        "\\b(cv[vv]|cvc)\\b",
+        "\\bfecha\\s+de\\s+vencimiento\\b",
+        "\\bpor\\s+mensaje\\s+tu\\s+tarjeta\\b",
+        "\\bm[aá]ndame\\s+tu\\s+tarjeta\\b",
+        "\\benv[ií]ame\\s+tu\\s+tarjeta\\b"
+      ]
+    },
+    {
+      "id": "phish_account_threat_en",
+      "type": "topic_hint",
+      "weight": 0.35,
+      "notes": "EN: verify account + threat of closure (phishing-ish).",
+      "patterns": [
+        "\\bverify\\s+your\\s+account\\b.*\\b(closed|suspended|disabled)\\b",
+        "\\bor\\s+it\\s+will\\s+be\\s+(closed|suspended|disabled)\\b"
+      ]
+    },
+    {
+      "id": "scam_easy_money_es",
+      "type": "topic_hint",
+      "weight": 0.45,
+      "notes": "ES: estafa típica de dinero fácil / desde casa.",
+      "patterns": [
+        "gana\\s+dinero\\s+desde\\s+casa",
+        "sin\\s+esfuerzo",
+        "ingresos\\s+pasivos",
+        "dinero\\s+f[aá]cil"
+      ]
+    }
+  ],
+  "topics": [
+    {
+      "id": "marketing_spam",
+      "weight": 0.45,
+      "signals": [
+        {
+          "id": "cta",
+          "weight": 0.22,
+          "patterns": ["\\bclick\\b", "\\bclaim\\b", "\\bbuy\\b", "\\bcompra\\b"]
+        },
+        {
+          "id": "promo",
+          "weight": 0.18,
+          "patterns": ["\\bwin\\b", "\\bganaste\\b", "\\bgratis\\b", "\\bfree\\b"]
+        }
+      ]
+    },
+    {
+      "id": "coercion",
+      "weight": 0.3,
+      "signals": [
+        {
+          "id": "threat",
+          "weight": 0.22,
+          "patterns": ["\\bor\\s+else\\b", "\\bsi\\s+no\\b", "\\bI\\s+will\\b", "\\bte\\s+voy\\s+a\\b"]
+        }
+      ]
+    },
+    {
+      "id": "conspiracy",
+      "weight": 0.25,
+      "signals": [
+        {
+          "id": "hidden",
+          "weight": 0.2,
+          "patterns": ["\\bocult\\w+\\b", "\\bhidden\\b", "\\bsecret\\b"]
+        }
+      ]
+    },
+    {
+      "id": "phishing_fraud",
+      "weight": 0.45,
+      "signals": [
+        {
+          "id": "verify_account_request",
+          "weight": 0.3,
+          "patterns": [
+            "\\bverify\\s+your\\s+account\\b",
+            "\\bconfirm\\s+your\\s+account\\b",
+            "\\baccount\\s+will\\s+be\\s+closed\\b",
+            "\\bcódigo\\s+de\\s+verificación\\b",
+            "\\benvíame\\s+tu\\s+código\\b",
+            "\\bconfirma\\s+tu\\s+cuenta\\b"
+          ]
+        },
+        {
+          "id": "financial_data_request",
+          "weight": 0.35,
+          "patterns": [
+            "\\bmandas\\s+tu\\s+tarjeta\\b",
+            "\\benvía\\s+tu\\s+tarjeta\\b",
+            "\\bsend\\s+me\\s+your\\s+card\\b",
+            "\\btransferencia\\b",
+            "\\bwire\\b",
+            "\\bdeposito\\b",
+            "\\bdepósito\\b"
+          ]
+        },
+        {
+          "id": "easy_money_scam",
+          "weight": 0.25,
+          "patterns": [
+            "\\bgana\\s+dinero\\s+desde\\s+casa\\b",
+            "\\bearn\\s+money\\s+from\\s+home\\b",
+            "\\bsin\\s+esfuerzo\\b",
+            "\\bno\\s+experience\\s+needed\\b"
+          ]
+        }
+      ]
+    }
+  ]
+}

package/rulesets/support.js

@@ -0,0 +1,7 @@
+import fs from "node:fs";
+import path from "node:path";
+
+const jsonPath = path.join(path.dirname(new URL(import.meta.url).pathname), "support.json");
+const rules = JSON.parse(fs.readFileSync(jsonPath, "utf8"));
+
+export default rules;