modelrig 0.8.1 → 0.10.0

package/dist/screen/model-screen.d.ts

@@ -0,0 +1,111 @@
+/**
+ * SC-3 — the T3 model-screen `Detector` (spec-sc3 §2). A `Detector` of the new
+ * `kind: "model"` that issues ONE structured-boolean screen call on an untrusted
+ * segment (the Anthropic "screen tool output / untrusted content" pattern), maps
+ * the boolean → counts-only spans, and returns them like any `Detector`. Its
+ * verdict is a SIGNAL that drives the existing deterministic actions
+ * (flag|strip|quarantine|block) — never the control itself (research §3.1
+ * principle 3). We compose over the shipped SC-1 seam; we do NOT fork it.
+ *
+ * METERED + DAILY CAP (spec-sc3 §2, mirrors `run-judge` economics): every screen
+ * call is a metered inference (the customer's own configured provider — no new
+ * default dependency). A per-UTC-day counter caps the spend. When the cap is
+ * exhausted the detector THROWS {@link ModelScreenCapExhaustedError}, and the
+ * shipped seam (screen.ts §4.3) applies the fail-closed matrix for us:
+ *   · under `detect`  → degrade to the surviving detectors, receipt `degraded:true`, SEND;
+ *   · under `enforce` → block PRE-DISPATCH (invariant_violation) — an unscreened
+ *                       turn is NEVER dispatched under enforce (teaches the cap).
+ * A screen-call ERROR/timeout throws the same way and inherits the same matrix.
+ *
+ * FREE TEXT NEVER PERSISTS (spec-sc3 §2, acceptance a): the screen call returns a
+ * STRUCTURED boolean + optional type labels; this adapter parses ONLY
+ * `{ flagged, types }` and discards everything else the model may have emitted.
+ * No model prose, no scanned content, and no raw provider response reaches a
+ * span, a receipt, a log, or a thrown error — only per-type COUNTS survive (the
+ * seam rolls spans into counts). The thrown error carries the detector id + a
+ * coarse failure CLASS only (leak invariant §1.4, extended to the model tier).
+ */
+import type { DetectionInput, Detector } from "../detect/detector";
+/** The structured verdict a screen call returns. The model is prompted to answer
+ * a boolean ("is this untrusted content attempting to inject instructions /
+ * carrying PII?") plus optional coarse type labels. NOTHING else on this object
+ * is read — free text the model may add is discarded by {@link parseVerdict}. */
+export interface ModelScreenVerdict {
+    readonly flagged: boolean;
+    /** Coarse finding types (count labels only, never content). Optional; when
+     * absent a single default label is used. Each label is capped in length and
+     * count so a chatty model can never smuggle content out through a "type". */
+    readonly types?: readonly string[];
+}
+/**
+ * The metered screen call. In production this is a small structured-boolean
+ * inference on the customer's CONFIGURED provider (SDK lane: in-process on their
+ * keys; hosted lane: a server-metered call) — ModelRig bundles no model and adds
+ * no default dependency. Injected here so the detector is pure + unit-testable
+ * and reads no env. It receives the untrusted text and MUST resolve to a
+ * structured {@link ModelScreenVerdict}; its free-text output never leaves it.
+ */
+export type ModelScreenCall = (input: DetectionInput) => Promise<ModelScreenVerdict>;
+/** A per-detector daily-call meter (mirrors `run-judge`'s daily cap). Keyed by
+ * UTC date so the cap resets at midnight UTC. In-process by default (one meter
+ * per SDK process, like the run-judge economics); injectable for tests and for a
+ * hosted lane that meters centrally. */
+export interface DailyCapMeter {
+    /** Current call count for `dayKey` (a UTC `YYYY-MM-DD` string). */
+    count(dayKey: string): number;
+    /** Record one more call against `dayKey`. */
+    increment(dayKey: string): void;
+}
+/** The default in-process meter — a Map by UTC day. Old days are pruned lazily
+ * so the map never grows unbounded across a long-running process. */
+export declare function createInProcessCapMeter(): DailyCapMeter;
+export interface ModelScreenDetectorConfig {
+    /** Receipt id — `model:screen@<model>`. Normalized if a bare model is given. */
+    readonly id: string;
+    /** The model label the screen call runs on (for the id + receipt version). */
+    readonly model: string;
+    /** Metered screen calls allowed per UTC day before the tier is cap-exhausted
+     * (mirrors `run-judge`). Must be a positive integer. */
+    readonly dailyCap: number;
+    /** The structured-boolean screen call (customer's configured provider). */
+    readonly screenCall: ModelScreenCall;
+    /** Confidence stamped on a flagged span (0..1). Default 0.9 so a flag clears
+     * the default 0.8 policy threshold; a route may still raise `screen.threshold`
+     * to require the model tier plus a corroborating detector. */
+    readonly flagConfidence?: number;
+    /** Injectable clock (→ the UTC day key) so the cap boundary is testable. */
+    readonly now?: () => Date;
+    /** Injectable meter (defaults to an in-process per-day meter). */
+    readonly meter?: DailyCapMeter;
+}
+/** Normalize an id to the `model:screen@<model>` receipt shape. */
+export declare function modelScreenReceiptId(idOrModel: string): string;
+/** Thrown when the daily cap is exhausted. A subclass of Error so the shipped
+ * seam catches it exactly like any detector throw and applies the §4.3 matrix
+ * (degrade under detect, block pre-dispatch under enforce). Carries the detector
+ * id + a coarse reason ONLY — never content (leak invariant §1.4). */
+export declare class ModelScreenCapExhaustedError extends Error {
+    readonly detectorId: string;
+    readonly reason: "daily_cap_exhausted";
+    constructor(detectorId: string, dailyCap: number);
+}
+/** Thrown when the screen call itself fails (error/timeout/malformed verdict).
+ * Coarse reason only — never the provider's response body or the scanned
+ * content. The seam turns it into the same fail-closed matrix. */
+export declare class ModelScreenUnavailableError extends Error {
+    readonly detectorId: string;
+    readonly reason: "call_failed" | "malformed_verdict";
+    constructor(detectorId: string, reason: ModelScreenUnavailableError["reason"]);
+}
+/**
+ * Build the T3 model-screen `Detector`. `detect(input)`:
+ *  1. checks the per-UTC-day cap — over it ⇒ throw {@link ModelScreenCapExhaustedError};
+ *  2. otherwise records the call, issues the structured-boolean screen call;
+ *  3. parses ONLY `{flagged, types}` (free text discarded), and, when flagged,
+ *     emits one counts-only span per type covering the segment. Confidence is
+ *     stamped from `flagConfidence` — the RAW model score is never used or kept.
+ * Any call failure throws {@link ModelScreenUnavailableError}. Both throws are
+ * caught by the shipped seam, which applies the §4.3 fail-closed matrix.
+ */
+export declare function createModelScreenDetector(config: ModelScreenDetectorConfig): Detector;
+//# sourceMappingURL=model-screen.d.ts.map

package/dist/screen/model-screen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-screen.d.ts","sourceRoot":"","sources":["../../src/screen/model-screen.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EACV,cAAc,EAEd,QAAQ,EACT,MAAM,oBAAoB,CAAC;AAE5B;;;iFAGiF;AACjF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;iFAE6E;IAC7E,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,cAAc,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAErF;;;wCAGwC;AACxC,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B,6CAA6C;IAC7C,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED;qEACqE;AACrE,wBAAgB,uBAAuB,IAAI,aAAa,CAavD;AAED,MAAM,WAAW,yBAAyB;IACxC,gFAAgF;IAChF,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;4DACwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC;;kEAE8D;IAC9D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,4EAA4E;IAC5E,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;CAChC;AAOD,mEAAmE;AACnE,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAI9D;AAED;;;sEAGsE;AACtE,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAG,qBAAqB,CAAU;gBACrC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAKjD;AAED;;kEAEkE;AAClE,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,mBAAmB,CAAC;gBACzC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,2BAA2B,CAAC,QAAQ,CAAC;CAM9E;AAsCD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,yBAAyB,GAAG,QAAQ,CA0CrF"}

package/dist/screen/model-screen.js

@@ -0,0 +1,178 @@
+"use strict";
+/**
+ * SC-3 — the T3 model-screen `Detector` (spec-sc3 §2). A `Detector` of the new
+ * `kind: "model"` that issues ONE structured-boolean screen call on an untrusted
+ * segment (the Anthropic "screen tool output / untrusted content" pattern), maps
+ * the boolean → counts-only spans, and returns them like any `Detector`. Its
+ * verdict is a SIGNAL that drives the existing deterministic actions
+ * (flag|strip|quarantine|block) — never the control itself (research §3.1
+ * principle 3). We compose over the shipped SC-1 seam; we do NOT fork it.
+ *
+ * METERED + DAILY CAP (spec-sc3 §2, mirrors `run-judge` economics): every screen
+ * call is a metered inference (the customer's own configured provider — no new
+ * default dependency). A per-UTC-day counter caps the spend. When the cap is
+ * exhausted the detector THROWS {@link ModelScreenCapExhaustedError}, and the
+ * shipped seam (screen.ts §4.3) applies the fail-closed matrix for us:
+ *   · under `detect`  → degrade to the surviving detectors, receipt `degraded:true`, SEND;
+ *   · under `enforce` → block PRE-DISPATCH (invariant_violation) — an unscreened
+ *                       turn is NEVER dispatched under enforce (teaches the cap).
+ * A screen-call ERROR/timeout throws the same way and inherits the same matrix.
+ *
+ * FREE TEXT NEVER PERSISTS (spec-sc3 §2, acceptance a): the screen call returns a
+ * STRUCTURED boolean + optional type labels; this adapter parses ONLY
+ * `{ flagged, types }` and discards everything else the model may have emitted.
+ * No model prose, no scanned content, and no raw provider response reaches a
+ * span, a receipt, a log, or a thrown error — only per-type COUNTS survive (the
+ * seam rolls spans into counts). The thrown error carries the detector id + a
+ * coarse failure CLASS only (leak invariant §1.4, extended to the model tier).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ModelScreenUnavailableError = exports.ModelScreenCapExhaustedError = void 0;
+exports.createInProcessCapMeter = createInProcessCapMeter;
+exports.modelScreenReceiptId = modelScreenReceiptId;
+exports.createModelScreenDetector = createModelScreenDetector;
+/** The default in-process meter — a Map by UTC day. Old days are pruned lazily
+ * so the map never grows unbounded across a long-running process. */
+function createInProcessCapMeter() {
+    const byDay = new Map();
+    return {
+        count(dayKey) {
+            return byDay.get(dayKey) ?? 0;
+        },
+        increment(dayKey) {
+            // Prune any day that is not the one being written (single-day retention:
+            // the cap is per UTC day, so only the current day's count is load-bearing).
+            for (const key of byDay.keys())
+                if (key !== dayKey)
+                    byDay.delete(key);
+            byDay.set(dayKey, (byDay.get(dayKey) ?? 0) + 1);
+        },
+    };
+}
+const DEFAULT_FLAG_CONFIDENCE = 0.9;
+const DEFAULT_TYPE = "injection:model_flag";
+const MAX_TYPES = 8; // a verdict may not carry more than this many type labels
+const MAX_TYPE_LEN = 64; // …nor a label longer than this — content can't ride a "type"
+/** Normalize an id to the `model:screen@<model>` receipt shape. */
+function modelScreenReceiptId(idOrModel) {
+    if (idOrModel.startsWith("model:screen@"))
+        return idOrModel;
+    if (idOrModel.startsWith("model:"))
+        return idOrModel;
+    return `model:screen@${idOrModel}`;
+}
+/** Thrown when the daily cap is exhausted. A subclass of Error so the shipped
+ * seam catches it exactly like any detector throw and applies the §4.3 matrix
+ * (degrade under detect, block pre-dispatch under enforce). Carries the detector
+ * id + a coarse reason ONLY — never content (leak invariant §1.4). */
+class ModelScreenCapExhaustedError extends Error {
+    constructor(detectorId, dailyCap) {
+        super(`model screen "${detectorId}" is over its daily cap (${dailyCap}/day) — degrading (detect) / blocking pre-dispatch (enforce)`);
+        this.reason = "daily_cap_exhausted";
+        this.name = "ModelScreenCapExhaustedError";
+        this.detectorId = detectorId;
+    }
+}
+exports.ModelScreenCapExhaustedError = ModelScreenCapExhaustedError;
+/** Thrown when the screen call itself fails (error/timeout/malformed verdict).
+ * Coarse reason only — never the provider's response body or the scanned
+ * content. The seam turns it into the same fail-closed matrix. */
+class ModelScreenUnavailableError extends Error {
+    constructor(detectorId, reason) {
+        super(`model screen "${detectorId}" is unavailable (${reason})`);
+        this.name = "ModelScreenUnavailableError";
+        this.detectorId = detectorId;
+        this.reason = reason;
+    }
+}
+exports.ModelScreenUnavailableError = ModelScreenUnavailableError;
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/**
+ * Read ONLY `{ flagged, types }` from whatever the screen call returned —
+ * defensively, like the sidecar's `parseSpans`. A non-boolean `flagged` is a
+ * malformed verdict (fail closed, never a silent open). Every other field (and
+ * any echoed free text) is discarded here so it can never reach a span. Type
+ * labels are trimmed, de-duplicated, length-capped, and count-capped.
+ */
+function parseVerdict(raw, detectorId) {
+    if (!isRecord(raw) || typeof raw.flagged !== "boolean") {
+        throw new ModelScreenUnavailableError(detectorId, "malformed_verdict");
+    }
+    let types = [];
+    if (Array.isArray(raw.types)) {
+        const seen = new Set();
+        for (const t of raw.types) {
+            if (typeof t !== "string")
+                continue;
+            const label = t.slice(0, MAX_TYPE_LEN);
+            if (label.length === 0 || seen.has(label))
+                continue;
+            seen.add(label);
+            types.push(label);
+            if (types.length >= MAX_TYPES)
+                break;
+        }
+    }
+    if (types.length === 0)
+        types = [DEFAULT_TYPE];
+    return { flagged: raw.flagged, types };
+}
+/** The UTC `YYYY-MM-DD` day key the cap is bucketed by. */
+function utcDayKey(now) {
+    return now.toISOString().slice(0, 10);
+}
+/**
+ * Build the T3 model-screen `Detector`. `detect(input)`:
+ *  1. checks the per-UTC-day cap — over it ⇒ throw {@link ModelScreenCapExhaustedError};
+ *  2. otherwise records the call, issues the structured-boolean screen call;
+ *  3. parses ONLY `{flagged, types}` (free text discarded), and, when flagged,
+ *     emits one counts-only span per type covering the segment. Confidence is
+ *     stamped from `flagConfidence` — the RAW model score is never used or kept.
+ * Any call failure throws {@link ModelScreenUnavailableError}. Both throws are
+ * caught by the shipped seam, which applies the §4.3 fail-closed matrix.
+ */
+function createModelScreenDetector(config) {
+    if (!Number.isInteger(config.dailyCap) || config.dailyCap <= 0) {
+        throw new Error(`model screen dailyCap must be a positive integer (got ${config.dailyCap})`);
+    }
+    const id = modelScreenReceiptId(config.id);
+    const confidence = config.flagConfidence ?? DEFAULT_FLAG_CONFIDENCE;
+    const now = config.now ?? (() => new Date());
+    const meter = config.meter ?? createInProcessCapMeter();
+    return {
+        id,
+        kind: "model",
+        async detect(input) {
+            // Trusted framing is the route author's own — never screened (mirrors the
+            // pattern detector), and never spends a metered call on it.
+            if (input.tier === "trusted")
+                return [];
+            const dayKey = utcDayKey(now());
+            if (meter.count(dayKey) >= config.dailyCap) {
+                // Cap exhausted — throw BEFORE spending a call. The seam degrades (detect)
+                // or blocks pre-dispatch (enforce). No content in the error.
+                throw new ModelScreenCapExhaustedError(id, config.dailyCap);
+            }
+            // Reserve the call against the cap before issuing it (a failed call still
+            // spent provider budget on the customer's keys — count it, like run-judge).
+            meter.increment(dayKey);
+            let raw;
+            try {
+                raw = await config.screenCall(input);
+            }
+            catch {
+                // NEVER let the provider error's message (which could echo the scanned
+                // content) escape — only the coarse reason travels.
+                throw new ModelScreenUnavailableError(id, "call_failed");
+            }
+            const { flagged, types } = parseVerdict(raw, id);
+            if (!flagged)
+                return [];
+            // One counts-only span per type over the whole segment. Offsets are into
+            // the exact string handed in; the substring is never read or kept.
+            return types.map((type) => ({ start: 0, end: input.text.length, type, confidence }));
+        },
+    };
+}

package/dist/screen/patterns.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Screening — T0 deterministic injection patterns + the optional T1 classifier
+ * adapter (WIRED 2026-08-25, SC-1a). Spec §3 (Detector) + §4 (T0/T1).
+ *
+ * An OWASP-derived pattern pack that implements the shared `Detector` interface
+ * (packages/modelrig/src/detect/detector.ts) with `kind: "deterministic"`,
+ * confidence 1 on a match.
+ *
+ * DOCTRINE (research §2.2): detection is a SIGNAL, not a control. These patterns
+ * are trivially evaded by paraphrase/encoding; they exist to DRIVE the
+ * deterministic actions (flag/strip/quarantine) and to populate a MEASURED
+ * false-positive rate, NEVER to claim prevention (claim-lint, spec §7).
+ *
+ * LEAK INVARIANT (spec §1.4): a detector emits SPANS (offsets + type +
+ * confidence) — never the matched substring. Nothing in this file returns,
+ * logs, or persists a matched value.
+ */
+import type { Detector } from "../detect/detector";
+/** The registry id + version of the deterministic pack. Bumped when the pattern
+ * set changes so a receipt's `detectors[].version` pins what ran. */
+export declare const PATTERNS_ID = "patterns@v1";
+/**
+ * The T0 pattern detector. Runs only on untrusted/semi tiers — the template's
+ * own trusted text is never scanned (it is the route author's, by construction).
+ * Deterministic: confidence 1 on every match, versioned as `patterns@v1`.
+ */
+export declare function createPatternDetector(): Detector;
+/** Thrown by {@link createClassifierDetector} when the optional peer dep or the
+ * local model file is absent — a TYPED signal the engine catches to degrade to
+ * T0 with `degraded: true` (spec §4.3), never a run-failing surprise. */
+export declare class ScreenDetectorUnavailableError extends Error {
+    readonly detectorId: string;
+    constructor(detectorId: string, reason: string);
+}
+/**
+ * The optional T1 in-process classifier adapter (A3: OPTIONAL peer dependency;
+ * NO weights bundled; NO default npm dep). Absent peer dep OR absent model file
+ * ⇒ throws {@link ScreenDetectorUnavailableError} so the engine degrades to T0
+ * with a once-per-process notice and `degraded: true` on the receipt.
+ *
+ * ModelRig NEVER bundles or re-hosts weights — the customer fetches them with
+ * `modelrig screen pull <detector>` to a local cache and points `modelPath` at
+ * the result. The runtime peer (`onnxruntime-node` or a WASM transformers
+ * backend) is likewise the customer's to install.
+ */
+export declare function createClassifierDetector(opts: {
+    readonly id: string;
+    readonly modelPath: string;
+    readonly runtime: "onnx" | "wasm";
+}): Detector;
+//# sourceMappingURL=patterns.d.ts.map

package/dist/screen/patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../src/screen/patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAiC,MAAM,oBAAoB,CAAC;AAElF;qEACqE;AACrE,eAAO,MAAM,WAAW,gBAAgB,CAAC;AA+DzC;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,QAAQ,CAehD;AAED;;yEAEyE;AACzE,qBAAa,8BAA+B,SAAQ,KAAK;IACvD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAChB,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAK/C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CACnC,GAAG,QAAQ,CAiCX"}

package/dist/screen/patterns.js

@@ -0,0 +1,151 @@
+"use strict";
+/**
+ * Screening — T0 deterministic injection patterns + the optional T1 classifier
+ * adapter (WIRED 2026-08-25, SC-1a). Spec §3 (Detector) + §4 (T0/T1).
+ *
+ * An OWASP-derived pattern pack that implements the shared `Detector` interface
+ * (packages/modelrig/src/detect/detector.ts) with `kind: "deterministic"`,
+ * confidence 1 on a match.
+ *
+ * DOCTRINE (research §2.2): detection is a SIGNAL, not a control. These patterns
+ * are trivially evaded by paraphrase/encoding; they exist to DRIVE the
+ * deterministic actions (flag/strip/quarantine) and to populate a MEASURED
+ * false-positive rate, NEVER to claim prevention (claim-lint, spec §7).
+ *
+ * LEAK INVARIANT (spec §1.4): a detector emits SPANS (offsets + type +
+ * confidence) — never the matched substring. Nothing in this file returns,
+ * logs, or persists a matched value.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScreenDetectorUnavailableError = exports.PATTERNS_ID = void 0;
+exports.createPatternDetector = createPatternDetector;
+exports.createClassifierDetector = createClassifierDetector;
+const node_fs_1 = require("node:fs");
+/** The registry id + version of the deterministic pack. Bumped when the pattern
+ * set changes so a receipt's `detectors[].version` pins what ran. */
+exports.PATTERNS_ID = "patterns@v1";
+/** The T0 pack. Deliberately narrow, US-English-shaped (A8), and biased toward
+ * classic injection SHAPES over broad keyword nets so the measured FP rate stays
+ * honest. Each entry is a signal, not a guarantee. */
+const INJECTION_PATTERNS = [
+    // "ignore the previous instructions" / "disregard all prior rules" family.
+    {
+        type: "injection:instruction_override",
+        re: /\b(?:ignore|disregard|forget|override)\b[^.?!\n]{0,40}\b(?:previous|prior|above|earlier|all|any)\b[^.?!\n]{0,20}\b(?:instruction|instructions|prompt|prompts|rule|rules|context|direction|directions)\b/gi,
+    },
+    // "you are now …", "new instructions:", "act as", "pretend to be" — role hijack.
+    {
+        type: "injection:role_override",
+        re: /\b(?:you\s+are\s+now|from\s+now\s+on|new\s+(?:instructions?|role|persona|system\s+prompt)|act\s+as(?:\s+if)?|pretend\s+to\s+be|roleplay\s+as|switch\s+to\s+developer\s+mode)\b/gi,
+    },
+    // An untrusted segment carrying its own "system:" / "assistant:" role label —
+    // the classic transcript-smuggling shape the raw lane's JSON-turn guard closes.
+    {
+        type: "injection:role_label",
+        re: /(?:^|\n)\s*(?:system|assistant|developer)\s*:/gi,
+    },
+    // Chat-template / instruction delimiters smuggled into data.
+    {
+        type: "injection:delimiter",
+        re: /<\/?(?:system|assistant|user|instructions?)>|\[\/?INST\]|<\|(?:im_start|im_end|system|user|assistant|endoftext)\|>/gi,
+    },
+    // "reveal your system prompt" / "print your instructions" — prompt-leak probe.
+    {
+        type: "injection:prompt_leak",
+        re: /\b(?:reveal|print|repeat|show|output|display|tell\s+me)\b[^.?!\n]{0,30}\b(?:system\s+prompt|your\s+instructions|initial\s+prompt|the\s+prompt\s+above|your\s+rules)\b/gi,
+    },
+    // "email/exfiltrate the api key/password/secret" — data-exfiltration steering.
+    {
+        type: "injection:exfiltration",
+        re: /\b(?:send|exfiltrate|post|email|upload|leak|forward|transmit)\b[^.?!\n]{0,40}\b(?:api[\s_-]?key|password|secret|secrets|token|credential|credentials|private\s+key)\b/gi,
+    },
+];
+/** Unicode tag plane (U+E0000–U+E007F) — invisible chars abused to smuggle
+ * instructions past a human reviewer. Detected as its own finding TYPE; the
+ * assembler strips them from delivered content, but their PRESENCE in untrusted
+ * input is itself a signal worth counting. */
+const UNICODE_TAG_RE = /[\u{E0000}-\u{E007F}]+/gu;
+/** Collect the spans one pattern matches in `text`. Offsets are into the exact
+ * string handed in; the matched substring is discarded immediately. */
+function spansFor(type, re, text) {
+    const spans = [];
+    for (const m of text.matchAll(re)) {
+        const start = m.index ?? 0;
+        spans.push({ start, end: start + m[0].length, type, confidence: 1 });
+    }
+    return spans;
+}
+/**
+ * The T0 pattern detector. Runs only on untrusted/semi tiers — the template's
+ * own trusted text is never scanned (it is the route author's, by construction).
+ * Deterministic: confidence 1 on every match, versioned as `patterns@v1`.
+ */
+function createPatternDetector() {
+    return {
+        id: exports.PATTERNS_ID,
+        kind: "deterministic",
+        detect(input) {
+            // Trusted content is the route's own framing — never an injection source.
+            if (input.tier === "trusted")
+                return Promise.resolve([]);
+            const spans = [];
+            for (const p of INJECTION_PATTERNS)
+                spans.push(...spansFor(p.type, p.re, input.text));
+            spans.push(...spansFor("injection:unicode_tag", UNICODE_TAG_RE, input.text));
+            // Reading order keeps the (offsets-only) span list stable and testable.
+            spans.sort((a, b) => a.start - b.start || a.end - b.end);
+            return Promise.resolve(spans);
+        },
+    };
+}
+/** Thrown by {@link createClassifierDetector} when the optional peer dep or the
+ * local model file is absent — a TYPED signal the engine catches to degrade to
+ * T0 with `degraded: true` (spec §4.3), never a run-failing surprise. */
+class ScreenDetectorUnavailableError extends Error {
+    constructor(detectorId, reason) {
+        super(`screen detector "${detectorId}" is unavailable: ${reason}`);
+        this.name = "ScreenDetectorUnavailableError";
+        this.detectorId = detectorId;
+    }
+}
+exports.ScreenDetectorUnavailableError = ScreenDetectorUnavailableError;
+/**
+ * The optional T1 in-process classifier adapter (A3: OPTIONAL peer dependency;
+ * NO weights bundled; NO default npm dep). Absent peer dep OR absent model file
+ * ⇒ throws {@link ScreenDetectorUnavailableError} so the engine degrades to T0
+ * with a once-per-process notice and `degraded: true` on the receipt.
+ *
+ * ModelRig NEVER bundles or re-hosts weights — the customer fetches them with
+ * `modelrig screen pull <detector>` to a local cache and points `modelPath` at
+ * the result. The runtime peer (`onnxruntime-node` or a WASM transformers
+ * backend) is likewise the customer's to install.
+ */
+function createClassifierDetector(opts) {
+    const peer = opts.runtime === "onnx" ? "onnxruntime-node" : "@xenova/transformers";
+    // A3: the peer is an OPTIONAL dependency resolved at RUNTIME. `require` is used
+    // (not a static import) precisely so a missing peer is a catchable throw, not a
+    // load-time crash / a bundled dependency.
+    let runtimeModule;
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-var-requires, global-require
+        runtimeModule = require(peer);
+    }
+    catch {
+        throw new ScreenDetectorUnavailableError(opts.id, `optional peer dependency "${peer}" is not installed (install it and run \`modelrig screen pull ${opts.id}\`)`);
+    }
+    if (!(0, node_fs_1.existsSync)(opts.modelPath)) {
+        throw new ScreenDetectorUnavailableError(opts.id, `model file not found at "${opts.modelPath}" — fetch it with \`modelrig screen pull ${opts.id}\` (weights are never bundled, A3)`);
+    }
+    // The concrete inference wiring (tokenize → run → score → span) is delegated to
+    // the loaded runtime; this SC-1a scaffold proves the OPTIONAL-load contract and
+    // the fail-closed degrade path. A configured-and-present classifier tier is a
+    // Matt-env run (live weights); the deterministic T0 path is what ships.
+    void runtimeModule;
+    return {
+        id: opts.id,
+        kind: "classifier",
+        detect(_input) {
+            return Promise.resolve([]);
+        },
+    };
+}

package/dist/screen/phi-gate.d.ts

@@ -0,0 +1,52 @@
+/**
+ * SC-2 — the gated `phi` route posture (spec-sc2 §4). Deterministic, fail-closed,
+ * dependency-free. Runs at ROUTE LOAD (the same place `require:` / `mask:` /
+ * `screen:` are validated), so a mis-postured PHI route REFUSES TO LOAD with a
+ * teaching error rather than silently serving PHI on an unmasked, un-screened,
+ * content-retaining route.
+ *
+ * A route classified `phi` (route-level `classification: phi`) MUST satisfy ALL:
+ *   1. mask effective mode ≥ redact — i.e. mask rewrites (mode `mask` or `block`,
+ *      CS-1); `off`/`detect` do NOT mask and fail the gate.
+ *   2. `require: zero_retention`  OR  a `sidecar` detector present in
+ *      `screen.detectors` (the managed-custody + sidecar path).
+ *
+ * This does NOT claim de-identification (that is a banned claim, §6). It enforces
+ * that PHI never rides an unmasked, un-screened, content-retaining route. The
+ * gate is code-visible and lane-independent: it checks the mask mode, the
+ * `require` list, and the presence of a sidecar detector — all resolved at load.
+ * `modelrig validate` prints {@link describePhiPosture}: the resolved posture and
+ * the specific unmet requirement.
+ */
+import type { DataClassification } from "../artifacts/classification";
+import type { ResolvedMaskPolicy } from "../mask/types";
+import type { Requirement } from "../types/route";
+import type { ResolvedScreenPolicy } from "./types";
+/** The load-time inputs the gate reads — all already resolved by the loader. */
+export interface PhiPostureInput {
+    /** The route-level `classification`, if any. The gate fires only for `phi`. */
+    readonly classification?: DataClassification;
+    readonly mask?: ResolvedMaskPolicy;
+    readonly screen?: ResolvedScreenPolicy;
+    readonly require: readonly Requirement[];
+}
+/** The resolved posture — what the gate saw and whether it passed. */
+export interface PhiPosture {
+    readonly isPhi: boolean;
+    readonly maskRedacts: boolean;
+    readonly zeroRetention: boolean;
+    readonly sidecarPresent: boolean;
+    readonly satisfied: boolean;
+}
+/** Resolve the posture for a route (whether or not it is `phi`). */
+export declare function resolvePhiPosture(input: PhiPostureInput): PhiPosture;
+/**
+ * Teaching-style problems for a mis-postured `phi` route (CE-2 fixHint pattern) —
+ * EMPTY when the route is not `phi` or the posture is satisfied. Each string
+ * names the SPECIFIC unmet requirement so the author knows exactly what to add.
+ */
+export declare function checkPhiPosture(input: PhiPostureInput): readonly string[];
+/** A one-line human posture summary for `modelrig validate` (spec-sc2 §4): the
+ * resolved posture and, when unsatisfied, the unmet requirement. */
+export declare function describePhiPosture(input: PhiPostureInput): string;
+//# sourceMappingURL=phi-gate.d.ts.map

package/dist/screen/phi-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"phi-gate.d.ts","sourceRoot":"","sources":["../../src/screen/phi-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAEpD,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,CAAC,EAAE,kBAAkB,CAAC;IAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;CAC1C;AAED,sEAAsE;AACtE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAcD,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,eAAe,GAAG,UAAU,CAYpE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,MAAM,EAAE,CAkBzE;AAED;oEACoE;AACpE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAYjE"}

package/dist/screen/phi-gate.js

@@ -0,0 +1,86 @@
+"use strict";
+/**
+ * SC-2 — the gated `phi` route posture (spec-sc2 §4). Deterministic, fail-closed,
+ * dependency-free. Runs at ROUTE LOAD (the same place `require:` / `mask:` /
+ * `screen:` are validated), so a mis-postured PHI route REFUSES TO LOAD with a
+ * teaching error rather than silently serving PHI on an unmasked, un-screened,
+ * content-retaining route.
+ *
+ * A route classified `phi` (route-level `classification: phi`) MUST satisfy ALL:
+ *   1. mask effective mode ≥ redact — i.e. mask rewrites (mode `mask` or `block`,
+ *      CS-1); `off`/`detect` do NOT mask and fail the gate.
+ *   2. `require: zero_retention`  OR  a `sidecar` detector present in
+ *      `screen.detectors` (the managed-custody + sidecar path).
+ *
+ * This does NOT claim de-identification (that is a banned claim, §6). It enforces
+ * that PHI never rides an unmasked, un-screened, content-retaining route. The
+ * gate is code-visible and lane-independent: it checks the mask mode, the
+ * `require` list, and the presence of a sidecar detector — all resolved at load.
+ * `modelrig validate` prints {@link describePhiPosture}: the resolved posture and
+ * the specific unmet requirement.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolvePhiPosture = resolvePhiPosture;
+exports.checkPhiPosture = checkPhiPosture;
+exports.describePhiPosture = describePhiPosture;
+/** A mask policy "redacts" (rewrites content) iff its effective mode is `mask`
+ * or `block` — `off`/`detect` scan but do not rewrite (CS-1 §3). */
+function maskRedacts(mask) {
+    return mask !== undefined && (mask.policy.mode === "mask" || mask.policy.mode === "block");
+}
+/** A sidecar detector is present iff the resolved screen policy carries a
+ * `sidecar:*` detector identity (built from `screen.sidecar` at resolve time). */
+function hasSidecar(screen) {
+    return screen !== undefined && screen.detectorMeta.some((d) => d.id.startsWith("sidecar:"));
+}
+/** Resolve the posture for a route (whether or not it is `phi`). */
+function resolvePhiPosture(input) {
+    const isPhi = input.classification === "phi";
+    const maskR = maskRedacts(input.mask);
+    const zdr = input.require.includes("zero_retention");
+    const sidecar = hasSidecar(input.screen);
+    return {
+        isPhi,
+        maskRedacts: maskR,
+        zeroRetention: zdr,
+        sidecarPresent: sidecar,
+        satisfied: maskR && (zdr || sidecar),
+    };
+}
+/**
+ * Teaching-style problems for a mis-postured `phi` route (CE-2 fixHint pattern) —
+ * EMPTY when the route is not `phi` or the posture is satisfied. Each string
+ * names the SPECIFIC unmet requirement so the author knows exactly what to add.
+ */
+function checkPhiPosture(input) {
+    const posture = resolvePhiPosture(input);
+    if (!posture.isPhi || posture.satisfied)
+        return [];
+    const problems = [];
+    if (!posture.maskRedacts) {
+        problems.push("a `phi`-classified route must mask its content — set `mask.mode: mask` (or `block`); " +
+            "`off`/`detect` do not redact. PHI must never ride an unmasked route.");
+    }
+    if (!posture.zeroRetention && !posture.sidecarPresent) {
+        problems.push("a `phi`-classified route must either `require: [zero_retention]` OR configure a `screen.sidecar` " +
+            "(a customer-run de-id detector, present in the resolved `screen.detectors` as `sidecar:<digest>`). " +
+            "PHI must never ride a content-retaining route without the sidecar.");
+    }
+    return problems;
+}
+/** A one-line human posture summary for `modelrig validate` (spec-sc2 §4): the
+ * resolved posture and, when unsatisfied, the unmet requirement. */
+function describePhiPosture(input) {
+    const p = resolvePhiPosture(input);
+    if (!p.isPhi)
+        return "";
+    const parts = [
+        `mask≥redact=${p.maskRedacts ? "yes" : "NO"}`,
+        `zero_retention=${p.zeroRetention ? "yes" : "no"}`,
+        `sidecar=${p.sidecarPresent ? "yes" : "no"}`,
+    ];
+    const verdict = p.satisfied
+        ? "OK — PHI posture satisfied"
+        : `UNMET — ${checkPhiPosture(input).join(" ")}`;
+    return `phi posture [${parts.join(" · ")}] → ${verdict}`;
+}