palaryn 0.1.0

package/dist/src/dlp/prompt-injection-backend.js

@@ -0,0 +1,148 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PromptInjectionBackend = void 0;
+const prompt_injection_patterns_1 = require("./prompt-injection-patterns");
+const text_normalizer_1 = require("./text-normalizer");
+/**
+ * DLP backend that detects common prompt injection patterns in text.
+ *
+ * Scans for 13 categories of prompt injection:
+ *   - Direct instruction overrides
+ *   - Role manipulation
+ *   - Jailbreak keywords
+ *   - System prompt extraction attempts
+ *   - Delimiter injection
+ *   - Context manipulation
+ *   - Authority impersonation
+ *   - Indirect injection
+ *   - Encoding indicators
+ *   - Synonym variants
+ *   - Prompt leakage requests
+ *   - Obfuscation markers
+ *   - Multi-turn manipulation
+ *
+ * All text is normalized before pattern matching to resist evasion via
+ * zero-width chars, HTML entities, homoglyphs, URL encoding, etc.
+ *
+ * Combination severity scoring: 3+ medium = effective high, 2+ high = effective critical.
+ */
+class PromptInjectionBackend {
+    constructor(config) {
+        this.name = 'prompt_injection';
+        this.enabled = config?.enabled ?? true;
+        this.scanOutput = config?.scan_output ?? false;
+        this.patterns = [
+            ...prompt_injection_patterns_1.PROMPT_INJECTION_PATTERNS,
+            ...(config?.custom_patterns ?? []),
+        ];
+        this.outputPatterns = prompt_injection_patterns_1.OUTPUT_INJECTION_PATTERNS;
+    }
+    /**
+     * Scan a string for prompt injection patterns.
+     *
+     * Text is normalized before matching to defeat evasion techniques.
+     * Patterns are matched against both the standard-normalized text and
+     * the leetspeak-normalized variant. Positions in detections refer to
+     * the original (un-normalized) string for accurate redaction.
+     */
+    scanString(value) {
+        if (!this.enabled) {
+            return [];
+        }
+        const detections = [];
+        // Normalize text for bypass resistance
+        const normalized = (0, text_normalizer_1.normalizeText)(value);
+        const leetNormalized = (0, text_normalizer_1.normalizeLeetspeak)(normalized);
+        // Choose pattern set: include output patterns when configured
+        const patternsToScan = this.scanOutput
+            ? [...this.patterns, ...this.outputPatterns]
+            : this.patterns;
+        // Scan standard-normalized text
+        this.matchPatterns(patternsToScan, normalized, detections);
+        // Scan leetspeak-normalized text (only if it differs from standard)
+        if (leetNormalized !== normalized) {
+            const existingNames = new Set(detections.map(d => d.pattern_name + ':' + d.match));
+            const leetDetections = [];
+            this.matchPatterns(patternsToScan, leetNormalized, leetDetections);
+            // Deduplicate — only add leet detections not already found
+            for (const ld of leetDetections) {
+                const key = ld.pattern_name + ':' + ld.match;
+                if (!existingNames.has(key)) {
+                    existingNames.add(key);
+                    detections.push(ld);
+                }
+            }
+        }
+        // Apply combination severity scoring
+        this.applyCombinationScoring(detections);
+        return detections;
+    }
+    /**
+     * Scan output text specifically for output-side injection patterns.
+     * Called during postExecute DLP scanning.
+     */
+    scanOutputText(value) {
+        if (!this.enabled) {
+            return [];
+        }
+        const normalized = (0, text_normalizer_1.normalizeText)(value);
+        const detections = [];
+        this.matchPatterns(this.outputPatterns, normalized, detections);
+        return detections;
+    }
+    /**
+     * Run all patterns against a text value and append matches to the detections array.
+     */
+    matchPatterns(patterns, text, detections) {
+        for (const pat of patterns) {
+            pat.pattern.lastIndex = 0;
+            let m;
+            while ((m = pat.pattern.exec(text)) !== null) {
+                detections.push({
+                    pattern_name: pat.name,
+                    severity: pat.severity,
+                    match: m[0],
+                    start: m.index,
+                    end: m.index + m[0].length,
+                });
+                // Prevent infinite loops on zero-length matches
+                if (m[0].length === 0) {
+                    pat.pattern.lastIndex++;
+                }
+            }
+            pat.pattern.lastIndex = 0;
+        }
+    }
+    /**
+     * Apply combination severity escalation:
+     * - 3+ medium detections -> add effective_severity 'high' metadata
+     * - 2+ high detections -> add effective_severity 'critical' metadata
+     *
+     * Mutates detections in place by upgrading severity where applicable.
+     */
+    applyCombinationScoring(detections) {
+        if (detections.length < 2)
+            return;
+        const mediumCount = detections.filter(d => d.severity === 'medium').length;
+        const highCount = detections.filter(d => d.severity === 'high').length;
+        // 3+ medium -> escalate all mediums to high
+        if (mediumCount >= 3) {
+            for (const d of detections) {
+                if (d.severity === 'medium') {
+                    d.effective_severity = 'high';
+                    d.severity = 'high';
+                }
+            }
+        }
+        // 2+ high -> mark effective severity as critical on all highs
+        if (highCount >= 2) {
+            for (const d of detections) {
+                if (d.severity === 'high') {
+                    d.effective_severity = 'critical';
+                }
+            }
+        }
+    }
+}
+exports.PromptInjectionBackend = PromptInjectionBackend;
+//# sourceMappingURL=prompt-injection-backend.js.map

package/dist/src/dlp/prompt-injection-backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-injection-backend.js","sourceRoot":"","sources":["../../../src/dlp/prompt-injection-backend.ts"],"names":[],"mappings":";;;AAGA,2EAAmG;AACnG,uDAAsE;AAWtE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAa,sBAAsB;IAQjC,YAAY,MAA8B;QAPjC,SAAI,GAAG,kBAAkB,CAAC;QAQjC,IAAI,CAAC,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,MAAM,EAAE,WAAW,IAAI,KAAK,CAAC;QAC/C,IAAI,CAAC,QAAQ,GAAG;YACd,GAAG,qDAAyB;YAC5B,GAAG,CAAC,MAAM,EAAE,eAAe,IAAI,EAAE,CAAC;SACnC,CAAC;QACF,IAAI,CAAC,cAAc,GAAG,qDAAyB,CAAC;IAClD,CAAC;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,KAAa;QACtB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,UAAU,GAAmB,EAAE,CAAC;QAEtC,uCAAuC;QACvC,MAAM,UAAU,GAAG,IAAA,+BAAa,EAAC,KAAK,CAAC,CAAC;QACxC,MAAM,cAAc,GAAG,IAAA,oCAAkB,EAAC,UAAU,CAAC,CAAC;QAEtD,8DAA8D;QAC9D,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU;YACpC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC;YAC5C,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAElB,gCAAgC;QAChC,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QAE3D,oEAAoE;QACpE,IAAI,cAAc,KAAK,UAAU,EAAE,CAAC;YAClC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,GAAG,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACnF,MAAM,cAAc,GAAmB,EAAE,CAAC;YAC1C,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;YAEnE,2DAA2D;YAC3D,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;gBAChC,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,GAAG,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC;gBAC7C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC5B,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBACvB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;QAED,qCAAqC;QACrC,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;QAEzC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;OAGG;IACH,cAAc,CAAC,KAAa;QAC1B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,+BAAa,EAAC,KAAK,CAAC,CAAC;QACxC,MAAM,UAAU,GAAmB,EAAE,CAAC;QACtC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QAChE,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;OAEG;IACK,aAAa,CACnB,QAAsB,EACtB,IAAY,EACZ,UAA0B;QAE1B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,GAAG,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YAC1B,IAAI,CAAyB,CAAC;YAC9B,OAAO,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC7C,UAAU,CAAC,IAAI,CAAC;oBACd,YAAY,EAAE,GAAG,CAAC,IAAI;oBACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;oBACX,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,GAAG,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;iBAC3B,CAAC,CAAC;gBACH,gDAAgD;gBAChD,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACtB,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC1B,CAAC;YACH,CAAC;YACD,GAAG,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,uBAAuB,CAAC,UAA0B;QACxD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO;QAElC,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;QAC3E,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QAEvE,4CAA4C;QAC5C,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;YACrB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;gBAC3B,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBAC3B,CAAS,CAAC,kBAAkB,GAAG,MAAM,CAAC;oBACvC,CAAC,CAAC,QAAQ,GAAG,MAAqB,CAAC;gBACrC,CAAC;YACH,CAAC;QACH,CAAC;QAED,8DAA8D;QAC9D,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;gBAC3B,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;oBACzB,CAAS,CAAC,kBAAkB,GAAG,UAAU,CAAC;gBAC7C,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;CACF;AA9ID,wDA8IC"}

package/dist/src/dlp/prompt-injection-patterns.d.ts

@@ -0,0 +1,32 @@
+import { DLPPattern } from './patterns';
+/**
+ * Prompt injection detection patterns.
+ *
+ * Organized into categories:
+ *   1. Direct instruction override (high)
+ *   2. Role manipulation (medium)
+ *   3. Jailbreak keywords (high)
+ *   4. System prompt extraction (high)
+ *   5. Delimiter injection (high)
+ *   6. Context manipulation (medium)
+ *   7. Authority impersonation (high)
+ *   8. Indirect injection (high)
+ *   9. Encoding indicators (medium)
+ *  10. Synonym variants (high)
+ *  11. Prompt leakage requests (high)
+ *  12. Obfuscation markers (medium)
+ *  13. Multi-turn manipulation (medium)
+ *
+ * All patterns use the /gi flags for global, case-insensitive matching.
+ * Pattern names are prefixed with `prompt_injection_` for namespacing.
+ */
+export declare const PROMPT_INJECTION_PATTERNS: DLPPattern[];
+/**
+ * Patterns for detecting prompt injection artifacts in model output.
+ * These indicate the model may have been manipulated and is leaking
+ * system prompt content or following injected instructions.
+ *
+ * Scanned during postExecute DLP on response bodies.
+ */
+export declare const OUTPUT_INJECTION_PATTERNS: DLPPattern[];
+//# sourceMappingURL=prompt-injection-patterns.d.ts.map

package/dist/src/dlp/prompt-injection-patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-injection-patterns.d.ts","sourceRoot":"","sources":["../../../src/dlp/prompt-injection-patterns.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,yBAAyB,EAAE,UAAU,EAyPjD,CAAC;AAMF;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,UAAU,EAgBjD,CAAC"}

package/dist/src/dlp/prompt-injection-patterns.js

@@ -0,0 +1,290 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OUTPUT_INJECTION_PATTERNS = exports.PROMPT_INJECTION_PATTERNS = void 0;
+/**
+ * Prompt injection detection patterns.
+ *
+ * Organized into categories:
+ *   1. Direct instruction override (high)
+ *   2. Role manipulation (medium)
+ *   3. Jailbreak keywords (high)
+ *   4. System prompt extraction (high)
+ *   5. Delimiter injection (high)
+ *   6. Context manipulation (medium)
+ *   7. Authority impersonation (high)
+ *   8. Indirect injection (high)
+ *   9. Encoding indicators (medium)
+ *  10. Synonym variants (high)
+ *  11. Prompt leakage requests (high)
+ *  12. Obfuscation markers (medium)
+ *  13. Multi-turn manipulation (medium)
+ *
+ * All patterns use the /gi flags for global, case-insensitive matching.
+ * Pattern names are prefixed with `prompt_injection_` for namespacing.
+ */
+exports.PROMPT_INJECTION_PATTERNS = [
+    // -----------------------------------------------------------------------
+    // Category 1: Direct instruction override (high)
+    // -----------------------------------------------------------------------
+    {
+        name: 'prompt_injection_ignore_previous',
+        pattern: /ignore\s+(?:all\s+)?previous\s+instructions/gi,
+        severity: 'high',
+    },
+    {
+        name: 'prompt_injection_disregard_rules',
+        pattern: /disregard\s+(?:all\s+)?(?:above|previous|prior)\s+(?:rules|instructions|guidelines|directives)/gi,
+        severity: 'high',
+    },
+    {
+        name: 'prompt_injection_forget_instructions',
+        pattern: /forget\s+(?:all\s+)?(?:your|the|previous|prior)\s+instructions/gi,
+        severity: 'high',
+    },
+    {
+        name: 'prompt_injection_override_instructions',
+        pattern: /override\s+(?:all\s+)?(?:your|the|previous|prior)\s+(?:instructions|rules|guidelines)/gi,
+        severity: 'high',
+    },
+    // -----------------------------------------------------------------------
+    // Category 2: Role manipulation (medium)
+    // -----------------------------------------------------------------------
+    {
+        name: 'prompt_injection_you_are_now',
+        pattern: /you\s+are\s+now\s+(?:a|an|the)\s+/gi,
+        severity: 'medium',
+    },
+    {
+        name: 'prompt_injection_act_as',
+        pattern: /(?:act|behave|function)\s+as\s+(?:a|an|if\s+you\s+(?:are|were))\s+/gi,
+        severity: 'medium',
+    },
+    {
+        name: 'prompt_injection_pretend_to_be',
+        pattern: /pretend\s+(?:to\s+be|you\s+are)\s+/gi,
+        severity: 'medium',
+    },
+    {
+        name: 'prompt_injection_roleplay_as',
+        pattern: /roleplay\s+as\s+/gi,
+        severity: 'medium',
+    },
+    // -----------------------------------------------------------------------
+    // Category 3: Jailbreak keywords (high)
+    // -----------------------------------------------------------------------
+    {
+        // FIX: ReDoS-safe version. Original had unbounded `.*?` causing
+        // catastrophic backtracking. Now uses bounded `.{0,40}` with no nested quantifiers.
+        name: 'prompt_injection_dan_jailbreak',
+        pattern: /\bD\s*A\s*N\b.{0,40}do\s+anything\s+now/gi,
+        severity: 'high',
+    },
+    {
+        name: 'prompt_injection_do_anything_now',
+        pattern: /do\s+anything\s+now/gi,
+        severity: 'high',
+    },
+    {
+        name: 'prompt_injection_developer_mode',
+        pattern: /(?:enter|enable|activate|switch\s+to)\s+developer\s+mode/gi,
+        severity: 'high',
+    },
+    {
+        name: 'prompt_injection_no_restrictions',
+        pattern: /(?:without|no|remove\s+all|disable\s+all)\s+(?:any\s+)?restrictions/gi,
+        severity: 'high',
+    },
+    // -----------------------------------------------------------------------
+    // Category 4: System prompt extraction (high)
+    // -----------------------------------------------------------------------
+    {
+        name: 'prompt_injection_show_system_prompt',
+        pattern: /(?:show|display|reveal|print|output)\s+(?:me\s+)?(?:your|the)\s+system\s+prompt/gi,
+        severity: 'high',
+    },
+    {
+        name: 'prompt_injection_repeat_above',
+        pattern: /repeat\s+(?:everything|all\s+the\s+text|the\s+text|all)\s+above/gi,
+        severity: 'high',
+    },
+    {
+        name: 'prompt_injection_what_are_instructions',
+        pattern: /what\s+are\s+your\s+(?:instructions|rules|guidelines|directives)/gi,
+        severity: 'high',
+    },
+    // -----------------------------------------------------------------------
+    // Category 5: Delimiter injection (high)
+    // -----------------------------------------------------------------------
+    {
+        name: 'prompt_injection_im_start_delimiter',
+        pattern: /<\|im_start\|>/gi,
+        severity: 'high',
+    },
+    {
+        name: 'prompt_injection_system_delimiter',
+        pattern: /###\s*System\s*:/gi,
+        severity: 'high',
+    },
+    {
+        name: 'prompt_injection_inst_delimiter',
+        pattern: /\[INST\]/gi,
+        severity: 'high',
+    },
+    {
+        name: 'prompt_injection_system_tag',
+        pattern: /<system>/gi,
+        severity: 'high',
+    },
+    // -----------------------------------------------------------------------
+    // Category 6: Context manipulation (medium)
+    // -----------------------------------------------------------------------
+    {
+        name: 'prompt_injection_hypothetical_scenario',
+        pattern: /in\s+this\s+hypothetical\s+scenario/gi,
+        severity: 'medium',
+    },
+    {
+        name: 'prompt_injection_educational_purposes',
+        pattern: /for\s+educational\s+purposes\s+only/gi,
+        severity: 'medium',
+    },
+    // -----------------------------------------------------------------------
+    // Category 7: Authority impersonation (high)
+    // -----------------------------------------------------------------------
+    {
+        name: 'prompt_injection_authority_developer',
+        pattern: /(?:as\s+your|i\s+am\s+(?:your|the))\s+(?:developer|creator|programmer|admin|administrator|owner)/gi,
+        severity: 'high',
+    },
+    {
+        name: 'prompt_injection_admin_override',
+        pattern: /(?:admin|administrator|root)\s+(?:override|access|mode|command)/gi,
+        severity: 'high',
+    },
+    {
+        name: 'prompt_injection_maintenance_mode',
+        pattern: /(?:enter|enable|activate|switch\s+to)\s+(?:maintenance|debug|test|unsafe)\s+mode/gi,
+        severity: 'high',
+    },
+    // -----------------------------------------------------------------------
+    // Category 8: Indirect injection (high)
+    // -----------------------------------------------------------------------
+    {
+        name: 'prompt_injection_indirect_when_user',
+        pattern: /when\s+(?:the\s+)?user\s+asks?\s+[\w\s]{1,40},?\s*(?:do|say|respond|reply|tell|output)\b/gi,
+        severity: 'high',
+    },
+    {
+        name: 'prompt_injection_indirect_if_anyone',
+        pattern: /if\s+(?:anyone|somebody|someone|the\s+user)\s+asks?,?\s*(?:say|tell|respond|reply)\b/gi,
+        severity: 'high',
+    },
+    {
+        name: 'prompt_injection_indirect_new_instructions',
+        pattern: /(?:new|updated|revised|replacement)\s+(?:system\s+)?instructions?\s*:/gi,
+        severity: 'high',
+    },
+    // -----------------------------------------------------------------------
+    // Category 9: Encoding indicators (medium)
+    // -----------------------------------------------------------------------
+    {
+        name: 'prompt_injection_decode_base64',
+        pattern: /(?:decode|interpret|execute|run|eval)\s+(?:the\s+following\s+)?(?:base64|rot13|hex|binary)/gi,
+        severity: 'medium',
+    },
+    {
+        name: 'prompt_injection_encode_request',
+        pattern: /(?:base64|rot13|hex)\s+(?:encode|decode|convert)\s+(?:this|the\s+following)/gi,
+        severity: 'medium',
+    },
+    // -----------------------------------------------------------------------
+    // Category 10: Synonym variants (high)
+    // -----------------------------------------------------------------------
+    {
+        name: 'prompt_injection_bypass_instructions',
+        pattern: /bypass\s+(?:all\s+)?(?:your|the|previous|prior|above|earlier)\s+(?:instructions|rules|guidelines|constraints|restrictions)/gi,
+        severity: 'high',
+    },
+    {
+        name: 'prompt_injection_skip_instructions',
+        pattern: /(?:skip|drop|abandon|dismiss)\s+(?:all\s+)?(?:your|the|previous|prior|above|earlier)\s+(?:instructions|rules|guidelines|constraints)/gi,
+        severity: 'high',
+    },
+    {
+        name: 'prompt_injection_new_rules',
+        pattern: /(?:your|the)\s+new\s+(?:instructions|rules|guidelines|directives)\s+are/gi,
+        severity: 'high',
+    },
+    // -----------------------------------------------------------------------
+    // Category 11: Prompt leakage requests (high)
+    // -----------------------------------------------------------------------
+    {
+        name: 'prompt_injection_show_rules',
+        pattern: /(?:show|tell|give|list|display)\s+(?:me\s+)?(?:your|the)\s+(?:rules|instructions|guidelines|directives|constraints)/gi,
+        severity: 'high',
+    },
+    {
+        name: 'prompt_injection_print_config',
+        pattern: /(?:print|output|dump|display)\s+(?:your|the)\s+(?:config|configuration|settings|prompt|system\s+message)/gi,
+        severity: 'high',
+    },
+    // -----------------------------------------------------------------------
+    // Category 12: Obfuscation markers (medium)
+    // -----------------------------------------------------------------------
+    {
+        name: 'prompt_injection_read_vertically',
+        pattern: /(?:read|interpret)\s+(?:this\s+)?(?:vertically|diagonally|backwards|in\s+reverse)/gi,
+        severity: 'medium',
+    },
+    {
+        name: 'prompt_injection_first_letter',
+        pattern: /(?:first|last|initial)\s+(?:letter|character|char)\s+of\s+each\s+(?:word|line|sentence)/gi,
+        severity: 'medium',
+    },
+    {
+        name: 'prompt_injection_split_across',
+        pattern: /(?:split|spread|distributed?)\s+across\s+(?:messages?|lines?|parts?|chunks?)/gi,
+        severity: 'medium',
+    },
+    // -----------------------------------------------------------------------
+    // Category 13: Multi-turn manipulation (medium)
+    // -----------------------------------------------------------------------
+    {
+        name: 'prompt_injection_remember_later',
+        pattern: /remember\s+this\s+(?:for\s+later|instruction|rule|command)/gi,
+        severity: 'medium',
+    },
+    {
+        name: 'prompt_injection_next_conversation',
+        pattern: /in\s+(?:our|the)\s+next\s+(?:conversation|session|chat|interaction)/gi,
+        severity: 'medium',
+    },
+];
+// ---------------------------------------------------------------------------
+// Output-side prompt injection patterns
+// ---------------------------------------------------------------------------
+/**
+ * Patterns for detecting prompt injection artifacts in model output.
+ * These indicate the model may have been manipulated and is leaking
+ * system prompt content or following injected instructions.
+ *
+ * Scanned during postExecute DLP on response bodies.
+ */
+exports.OUTPUT_INJECTION_PATTERNS = [
+    {
+        name: 'prompt_injection_output_system_leak',
+        pattern: /(?:my\s+(?:system\s+)?instructions\s+(?:are|say|tell)|i\s+was\s+(?:told|instructed|programmed)\s+to)/gi,
+        severity: 'high',
+    },
+    {
+        name: 'prompt_injection_output_prompt_reflection',
+        pattern: /(?:here\s+(?:are|is)\s+my\s+(?:rules|instructions|system\s+prompt|prompt)|as\s+(?:instructed|directed|told)(?:\s+by\s+my\s+(?:system|developer))?\s*:)/gi,
+        severity: 'high',
+    },
+    {
+        name: 'prompt_injection_output_role_break',
+        pattern: /(?:i\s+(?:am\s+)?now\s+(?:operating|running|acting)\s+(?:in|as)\s+(?:\w+\s+)?mode|(?:developer|unrestricted|DAN)\s+mode\s+(?:enabled|activated|on))/gi,
+        severity: 'high',
+    },
+];
+//# sourceMappingURL=prompt-injection-patterns.js.map

package/dist/src/dlp/prompt-injection-patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-injection-patterns.js","sourceRoot":"","sources":["../../../src/dlp/prompt-injection-patterns.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;;;;;;;;;;GAoBG;AACU,QAAA,yBAAyB,GAAiB;IACrD,0EAA0E;IAC1E,iDAAiD;IACjD,0EAA0E;IAC1E;QACE,IAAI,EAAE,kCAAkC;QACxC,OAAO,EAAE,+CAA+C;QACxD,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,kCAAkC;QACxC,OAAO,EAAE,kGAAkG;QAC3G,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,sCAAsC;QAC5C,OAAO,EAAE,kEAAkE;QAC3E,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,wCAAwC;QAC9C,OAAO,EAAE,yFAAyF;QAClG,QAAQ,EAAE,MAAM;KACjB;IAED,0EAA0E;IAC1E,yCAAyC;IACzC,0EAA0E;IAC1E;QACE,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,qCAAqC;QAC9C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,sEAAsE;QAC/E,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,oBAAoB;QAC7B,QAAQ,EAAE,QAAQ;KACnB;IAED,0EAA0E;IAC1E,wCAAwC;IACxC,0EAA0E;IAC1E;QACE,gEAAgE;QAChE,oFAAoF;QACpF,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,2CAA2C;QACpD,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,kCAAkC;QACxC,OAAO,EAAE,uBAAuB;QAChC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,OAAO,EAAE,4DAA4D;QACrE,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,kCAAkC;QACxC,OAAO,EAAE,uEAAuE;QAChF,QAAQ,EAAE,MAAM;KACjB;IAED,0EAA0E;IAC1E,8CAA8C;IAC9C,0EAA0E;IAC1E;QACE,IAAI,EAAE,qCAAqC;QAC3C,OAAO,EAAE,mFAAmF;QAC5F,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,mEAAmE;QAC5E,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,wCAAwC;QAC9C,OAAO,EAAE,oEAAoE;QAC7E,QAAQ,EAAE,MAAM;KACjB;IAED,0EAA0E;IAC1E,yCAAyC;IACzC,0EAA0E;IAC1E;QACE,IAAI,EAAE,qCAAqC;QAC3C,OAAO,EAAE,kBAAkB;QAC3B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,mCAAmC;QACzC,OAAO,EAAE,oBAAoB;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,OAAO,EAAE,YAAY;QACrB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,YAAY;QACrB,QAAQ,EAAE,MAAM;KACjB;IAED,0EAA0E;IAC1E,4CAA4C;IAC5C,0EAA0E;IAC1E;QACE,IAAI,EAAE,wCAAwC;QAC9C,OAAO,EAAE,uCAAuC;QAChD,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,uCAAuC;QAC7C,OAAO,EAAE,uCAAuC;QAChD,QAAQ,EAAE,QAAQ;KACnB;IAED,0EAA0E;IAC1E,6CAA6C;IAC7C,0EAA0E;IAC1E;QACE,IAAI,EAAE,sCAAsC;QAC5C,OAAO,EAAE,oGAAoG;QAC7G,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,OAAO,EAAE,mEAAmE;QAC5E,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,mCAAmC;QACzC,OAAO,EAAE,oFAAoF;QAC7F,QAAQ,EAAE,MAAM;KACjB;IAED,0EAA0E;IAC1E,wCAAwC;IACxC,0EAA0E;IAC1E;QACE,IAAI,EAAE,qCAAqC;QAC3C,OAAO,EAAE,4FAA4F;QACrG,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,qCAAqC;QAC3C,OAAO,EAAE,wFAAwF;QACjG,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,4CAA4C;QAClD,OAAO,EAAE,yEAAyE;QAClF,QAAQ,EAAE,MAAM;KACjB;IAED,0EAA0E;IAC1E,2CAA2C;IAC3C,0EAA0E;IAC1E;QACE,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,8FAA8F;QACvG,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,OAAO,EAAE,+EAA+E;QACxF,QAAQ,EAAE,QAAQ;KACnB;IAED,0EAA0E;IAC1E,uCAAuC;IACvC,0EAA0E;IAC1E;QACE,IAAI,EAAE,sCAAsC;QAC5C,OAAO,EAAE,8HAA8H;QACvI,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,oCAAoC;QAC1C,OAAO,EAAE,wIAAwI;QACjJ,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,2EAA2E;QACpF,QAAQ,EAAE,MAAM;KACjB;IAED,0EAA0E;IAC1E,8CAA8C;IAC9C,0EAA0E;IAC1E;QACE,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,uHAAuH;QAChI,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,4GAA4G;QACrH,QAAQ,EAAE,MAAM;KACjB;IAED,0EAA0E;IAC1E,4CAA4C;IAC5C,0EAA0E;IAC1E;QACE,IAAI,EAAE,kCAAkC;QACxC,OAAO,EAAE,qFAAqF;QAC9F,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,2FAA2F;QACpG,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,gFAAgF;QACzF,QAAQ,EAAE,QAAQ;KACnB;IAED,0EAA0E;IAC1E,gDAAgD;IAChD,0EAA0E;IAC1E;QACE,IAAI,EAAE,iCAAiC;QACvC,OAAO,EAAE,8DAA8D;QACvE,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,oCAAoC;QAC1C,OAAO,EAAE,uEAAuE;QAChF,QAAQ,EAAE,QAAQ;KACnB;CACF,CAAC;AAEF,8EAA8E;AAC9E,wCAAwC;AACxC,8EAA8E;AAE9E;;;;;;GAMG;AACU,QAAA,yBAAyB,GAAiB;IACrD;QACE,IAAI,EAAE,qCAAqC;QAC3C,OAAO,EAAE,wGAAwG;QACjH,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,2CAA2C;QACjD,OAAO,EAAE,0JAA0J;QACnK,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,oCAAoC;QAC1C,OAAO,EAAE,uJAAuJ;QAChK,QAAQ,EAAE,MAAM;KACjB;CACF,CAAC"}

package/dist/src/dlp/regex-backend.d.ts

@@ -0,0 +1,32 @@
+import { DLPBackend, DLPDetection } from './interfaces';
+export interface RegexBackendConfig {
+    /** Enable secret pattern detection. Default true. */
+    secrets_detection?: boolean;
+    /** Enable PII pattern detection. Default true. */
+    pii_detection?: boolean;
+}
+/**
+ * Regex-based DLP backend that uses the same patterns as the built-in DLPScanner.
+ *
+ * This backend is extracted as a standalone DLPBackend implementation so it can
+ * be composed with other backends (e.g. TruffleHog) via the CompositeDLPScanner.
+ * The original DLPScanner remains unchanged and fully functional on its own.
+ */
+export declare class RegexDLPBackend implements DLPBackend {
+    readonly name = "regex";
+    private readonly secretsEnabled;
+    private readonly piiEnabled;
+    constructor(config?: RegexBackendConfig);
+    /**
+     * Scan a string for secrets and PII using regex patterns.
+     *
+     * Input is normalized before scanning to defeat evasion techniques
+     * (zero-width chars, Unicode homoglyphs, NFC normalization).
+     *
+     * Every regex with the /g flag has its lastIndex reset before and after
+     * testing to avoid state leaking between calls.
+     */
+    scanString(value: string): DLPDetection[];
+    private scanPatterns;
+}
+//# sourceMappingURL=regex-backend.d.ts.map

package/dist/src/dlp/regex-backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"regex-backend.d.ts","sourceRoot":"","sources":["../../../src/dlp/regex-backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGxD,MAAM,WAAW,kBAAkB;IACjC,qDAAqD;IACrD,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,kDAAkD;IAClD,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAiFD;;;;;;GAMG;AACH,qBAAa,eAAgB,YAAW,UAAU;IAChD,QAAQ,CAAC,IAAI,WAAW;IAExB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAU;gBAEzB,MAAM,CAAC,EAAE,kBAAkB;IAKvC;;;;;;;;OAQG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,EAAE;IAwCzC,OAAO,CAAC,YAAY;CAwBrB"}