theorum 1.0.0 → 1.1.3

package/esm/src/guardrails/sanitize.js

@@ -6,35 +6,50 @@
 import { sanitizeTurnBlobsForProfile } from '../kernel/registry/attachments.js';
 import { getProfile } from '../kernel/registry/profiles.js';
 import { applySpans } from '../observability/spans.js';
+import { guardrailFromHits } from './events.js';
+import { hitFromSpan } from './hits.js';
 import { injectionSpans } from './injection.js';
+import { detectionForTrust, resolveGuardrailPolicy } from './policy.js';
 import { sensitiveSpans } from './sensitive.js';
-/** Sanitize one text value using prompt-injection and sensitive-data detectors. */
-function sanitizeText(text, options) {
+/**
+ * Detect and redact injection / sensitive spans. Returns hits for observability
+ * (rule + offsets + optional `match` preview for debugging).
+ */
+function detectText(text, options) {
     const sanitizeInput = options?.sanitizeInput ?? true;
     const redactSensitive = options?.redactSensitive ?? true;
     if (!sanitizeInput && !redactSensitive) {
-        return text;
+        return { text, hits: [] };
     }
     const spans = [
         ...(sanitizeInput ? injectionSpans(text) : []),
         ...(redactSensitive ? sensitiveSpans(text) : []),
     ];
-    return applySpans(text, spans);
+    const hits = spans.map((span) => hitFromSpan(text, span, span.kind === 'injection' ? 'sanitize.injection' : 'sanitize.sensitive', 'high'));
+    return { text: applySpans(text, spans), hits };
+}
+/** Sanitize one text value using prompt-injection and sensitive-data detectors. */
+function sanitizeText(text, options) {
+    return detectText(text, options).text;
 }
 /** Redact only sensitive data (credentials, PII) — skip injection patterns. */
 function redactSensitiveOnly(text) {
-    const spans = sensitiveSpans(text);
-    if (spans.length === 0)
-        return text;
-    return applySpans(text, spans);
+    return detectText(text, { sanitizeInput: false, redactSensitive: true }).text;
 }
-function sanitizeSlots(slots, options) {
+function appendHits(into, hits) {
+    for (const hit of hits) {
+        into.push(hit);
+    }
+}
+function sanitizeSlots(slots, options, hits) {
     if (!slots) {
         return slots;
     }
     const out = {};
     for (const [key, value] of Object.entries(slots)) {
-        out[key] = sanitizeText(value, options);
+        const detected = detectText(value, options);
+        appendHits(hits, detected.hits);
+        out[key] = detected.text;
     }
     return out;
 }
@@ -50,85 +65,162 @@ function sanitizeProjectId(id) {
     }
     return trimmed;
 }
-function sanitizeRepair(repair, options) {
+function sanitizeRepair(repair, options, hits) {
     if (!repair) {
         return repair;
     }
+    const previous = detectText(repair.previousOutput, options);
+    const rejection = detectText(repair.rejection, options);
+    appendHits(hits, previous.hits);
+    appendHits(hits, rejection.hits);
+    let guidance = repair.guidance;
+    if (guidance) {
+        const detected = detectText(guidance, options);
+        appendHits(hits, detected.hits);
+        guidance = detected.text;
+    }
     return {
-        previousOutput: sanitizeText(repair.previousOutput, options),
-        rejection: sanitizeText(repair.rejection, options),
-        guidance: repair.guidance ? sanitizeText(repair.guidance, options) : undefined,
+        previousOutput: previous.text,
+        rejection: rejection.text,
+        ...(guidance ? { guidance } : {}),
     };
 }
-function sanitizeHistory(history, options) {
-    if (!history) {
-        return history;
-    }
-    return history.map((m) => ({
-        role: m.role,
-        ...(m.content !== undefined ? { content: sanitizeText(m.content, options) } : {}),
-        ...(m.parts
-            ? {
-                parts: m.parts.map((p) => p.type === 'text' ? { ...p, text: sanitizeText(p.text, options) } : p),
-            }
-            : {}),
-        ...(m.tool_calls ? { tool_calls: m.tool_calls } : {}),
-        ...(m.tool_call_id ? { tool_call_id: m.tool_call_id } : {}),
-        ...(m.name ? { name: m.name } : {}),
-        ...(m.metadata ? { metadata: m.metadata } : {}),
-    }));
+/**
+ * Sanitize the text of each history message; tool calls, ids, and metadata pass
+ * through untouched.
+ *
+ * Exported because every path that injects messages into a turn needs it — turn
+ * history, and host steer injects mid-turn. A second copy would drift.
+ */
+function sanitizeHistory(history, options, hits = []) {
+    return history.map((m) => {
+        let content = m.content;
+        if (content !== undefined) {
+            const detected = detectText(content, options);
+            appendHits(hits, detected.hits);
+            content = detected.text;
+        }
+        let parts = m.parts;
+        if (parts) {
+            parts = parts.map((p) => {
+                if (p.type !== 'text') {
+                    return p;
+                }
+                const detected = detectText(p.text, options);
+                appendHits(hits, detected.hits);
+                return { ...p, text: detected.text };
+            });
+        }
+        return {
+            role: m.role,
+            ...(content !== undefined ? { content } : {}),
+            ...(parts ? { parts } : {}),
+            ...(m.tool_calls ? { tool_calls: m.tool_calls } : {}),
+            ...(m.tool_call_id ? { tool_call_id: m.tool_call_id } : {}),
+            ...(m.name ? { name: m.name } : {}),
+            ...(m.metadata ? { metadata: m.metadata } : {}),
+        };
+    });
 }
-function guardrailTextOptions(profileId) {
-    let profileGuardrails;
+/**
+ * Detection switches for one profile at one trust level.
+ *
+ * Falls back to full detection when the profile is not registered yet, so an
+ * unknown id never silently disables guardrails.
+ */
+function detectionForProfile(profileId, trust) {
+    let spec;
     try {
-        profileGuardrails = getProfile(profileId)?.guardrails;
+        spec = getProfile(profileId)?.guardrails;
     }
     catch {
         // If profile not registered yet, default to full guardrails.
     }
-    return {
-        sanitizeInput: profileGuardrails?.sanitizeInput ?? true,
-        redactSensitive: profileGuardrails?.redactSensitive ?? true,
-    };
+    return detectionForTrust(resolveGuardrailPolicy(spec), trust);
+}
+function pushStageEvent(events, stage, trust, hits) {
+    const event = guardrailFromHits(stage, trust, hits, 'redact');
+    if (event) {
+        events.push(event);
+    }
 }
-/** Sanitize user-controlled text fields; leave attachments/voice untouched. */
-function sanitizeTurnRequestText(req, options) {
+/**
+ * Sanitize user-controlled text fields; leave attachments/voice untouched.
+ *
+ * Returns `{ type: 'guardrail' }` events for stages that redacted something.
+ * Clean surfaces emit nothing.
+ *
+ * `req.system` is host-assembled per turn — it interpolates retrieval and user
+ * data, so it is treated as `assembled`, not trusted. `identity.system` never
+ * reaches this path and stays verbatim.
+ */
+function sanitizeTurnRequestText(req, profileId) {
+    const untrusted = detectionForProfile(profileId, 'untrusted');
+    const assembled = detectionForProfile(profileId, 'assembled');
     const input = req.input ?? {};
+    const events = [];
+    const inputHits = [];
+    const historyHits = [];
+    const systemHits = [];
     const { text: rawText } = input;
     let text = rawText;
     if (rawText !== undefined) {
-        text = sanitizeText(rawText, options);
+        const detected = detectText(rawText, untrusted);
+        appendHits(inputHits, detected.hits);
+        text = detected.text;
     }
     let system = req.system;
     if (system !== undefined) {
-        system = sanitizeText(system, options);
+        const detected = detectText(system, assembled);
+        appendHits(systemHits, detected.hits);
+        system = detected.text;
     }
+    const slots = sanitizeSlots(input.slots, untrusted, inputHits);
+    const repair = sanitizeRepair(input.repair, untrusted, inputHits);
+    const history = input.history
+        ? sanitizeHistory(input.history, untrusted, historyHits)
+        : undefined;
+    pushStageEvent(events, 'input', 'untrusted', inputHits);
+    pushStageEvent(events, 'history', 'untrusted', historyHits);
+    pushStageEvent(events, 'system', 'assembled', systemHits);
     return {
-        ...req,
-        system,
-        projectId: sanitizeProjectId(req.projectId),
-        input: {
-            ...input,
-            text,
-            slots: sanitizeSlots(input.slots, options),
-            repair: sanitizeRepair(input.repair, options),
-            history: sanitizeHistory(input.history, options),
+        request: {
+            ...req,
+            system,
+            projectId: sanitizeProjectId(req.projectId),
+            input: {
+                ...input,
+                text,
+                slots,
+                repair,
+                history,
+            },
         },
+        events,
     };
 }
 /** Sanitize all user-controlled text and blobs in a turn request. */
 function sanitizeTurnRequest(req) {
-    const options = guardrailTextOptions(req.profile);
-    const textSafe = sanitizeTurnRequestText(req, options);
+    return sanitizeTurnRequestWithEvents(req).request;
+}
+/**
+ * Sanitize a turn request and return guardrail events for any redactionsactions spans.
+ * Attachments/voice are validated but do not emit content-span events.
+ */
+function sanitizeTurnRequestWithEvents(req) {
+    const { request: textSafe, events } = sanitizeTurnRequestText(req, req.profile);
     const input = textSafe.input ?? {};
     const { attachments, voice } = sanitizeTurnBlobsForProfile(req.profile, input.attachments, input.voice);
     return {
-        ...textSafe,
-        input: {
-            ...input,
-            attachments,
-            voice,
+        request: {
+            ...textSafe,
+            input: {
+                ...input,
+                attachments,
+                voice,
+            },
         },
+        events,
     };
 }
 /**
@@ -142,9 +234,9 @@ function sanitizeTurnRequestForTrace(req) {
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         return {
-            request: sanitizeTurnRequestText(req, guardrailTextOptions(req.profile)),
+            request: sanitizeTurnRequestText(req, req.profile).request,
             sanitizeError: message,
         };
     }
 }
-export { PROJECT_ID_MAX, redactSensitiveOnly, sanitizeProjectId, sanitizeText, sanitizeTurnRequest, sanitizeTurnRequestForTrace, };
+export { detectionForProfile, detectText, PROJECT_ID_MAX, redactSensitiveOnly, sanitizeHistory, sanitizeProjectId, sanitizeText, sanitizeTurnRequest, sanitizeTurnRequestForTrace, sanitizeTurnRequestWithEvents, };

package/esm/src/guardrails/serialize.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Serialization for guardrail scanning.
+ *
+ * Detectors work on strings, so non-text event payloads (structured output, tool
+ * arguments, grounding metadata) must be flattened before they can be inspected.
+ * A guardrail must never be the thing that throws, so this never propagates a
+ * serializer error: cycles and bigints are represented rather than fatal, and a
+ * payload that still cannot be rendered is reported so the caller can fail closed.
+ *
+ * @module
+ */
+/** Marker substituted for a repeated reference so a cycle terminates. */
+declare const CIRCULAR = "[circular]";
+export interface ScanText {
+    text: string;
+    /** True when the payload could not be rendered and was not inspected. */
+    unscannable: boolean;
+}
+/**
+ * Flatten an arbitrary payload to text for detector scanning.
+ *
+ * Cycles collapse to `[circular]` and bigints render as digits, so the common
+ * unserializable shapes still get inspected instead of aborting the turn. Only a
+ * payload that defeats that (a throwing `toJSON`, for instance) comes back
+ * `unscannable`.
+ */
+declare function textForScan(value: unknown): ScanText;
+/**
+ * Scan-ready text, discarding the unscannable signal.
+ *
+ * For callers whose only question is "does this contain X" and for whom an
+ * unrenderable payload is the same as no match.
+ */
+declare function scanTextOf(value: unknown): string;
+export { CIRCULAR, scanTextOf, textForScan };

package/esm/src/guardrails/serialize.js

@@ -0,0 +1,58 @@
+/**
+ * Serialization for guardrail scanning.
+ *
+ * Detectors work on strings, so non-text event payloads (structured output, tool
+ * arguments, grounding metadata) must be flattened before they can be inspected.
+ * A guardrail must never be the thing that throws, so this never propagates a
+ * serializer error: cycles and bigints are represented rather than fatal, and a
+ * payload that still cannot be rendered is reported so the caller can fail closed.
+ *
+ * @module
+ */
+/** Marker substituted for a repeated reference so a cycle terminates. */
+const CIRCULAR = '[circular]';
+/**
+ * Flatten an arbitrary payload to text for detector scanning.
+ *
+ * Cycles collapse to `[circular]` and bigints render as digits, so the common
+ * unserializable shapes still get inspected instead of aborting the turn. Only a
+ * payload that defeats that (a throwing `toJSON`, for instance) comes back
+ * `unscannable`.
+ */
+function textForScan(value) {
+    if (value === undefined) {
+        return { text: '', unscannable: false };
+    }
+    if (typeof value === 'string') {
+        return { text: value, unscannable: false };
+    }
+    const seen = new WeakSet();
+    try {
+        const json = JSON.stringify(value, (_key, val) => {
+            if (typeof val === 'bigint') {
+                return val.toString();
+            }
+            if (typeof val === 'object' && val !== null) {
+                if (seen.has(val)) {
+                    return CIRCULAR;
+                }
+                seen.add(val);
+            }
+            return val;
+        });
+        return { text: json ?? '', unscannable: false };
+    }
+    catch {
+        return { text: '', unscannable: true };
+    }
+}
+/**
+ * Scan-ready text, discarding the unscannable signal.
+ *
+ * For callers whose only question is "does this contain X" and for whom an
+ * unrenderable payload is the same as no match.
+ */
+function scanTextOf(value) {
+    return textForScan(value).text;
+}
+export { CIRCULAR, scanTextOf, textForScan };

package/esm/src/guardrails/testing.d.ts

@@ -5,6 +5,13 @@
  *
  * @module
  */
+/** lexicon-exempt-file: adversarial harness helpers — not runtime user or model copy (P2) */
 import "../../_dnt.polyfills.js";
 export type { CanaryEgressAttack, CanaryEgressCatalogEntry, InboundFuzzPayload, InboundFuzzResult, LiveAttack, } from './corpus/mod.js';
 export { buildCanaryEgressAttacks, buildLiveAttacks, canaryEgressCatalog, FIXED_CANARY, filterLiveAttacks, inboundFuzzPayloads, inboundPayloadByName, runInboundGuardrailFuzz, summarizeAttackBank, } from './corpus/mod.js';
+export type { CorpusSample, CorpusSource } from './eval/corpus.js';
+export { createCorpusCache, parseLabelledCsv, recordsFromYaml, SOURCES } from './eval/corpus.js';
+export type { EvalOptions, EvalReport } from './eval/mod.js';
+export { DETECTORS, formatReport, runGuardrailEval } from './eval/mod.js';
+export type { DetectorScore, EvalDetector } from './eval/score.js';
+export { formatScores, scoreAll, scoreDetector } from './eval/score.js';

package/esm/src/guardrails/testing.js

@@ -5,5 +5,9 @@
  *
  * @module
  */
+/** lexicon-exempt-file: adversarial harness helpers — not runtime user or model copy (P2) */
 import "../../_dnt.polyfills.js";
 export { buildCanaryEgressAttacks, buildLiveAttacks, canaryEgressCatalog, FIXED_CANARY, filterLiveAttacks, inboundFuzzPayloads, inboundPayloadByName, runInboundGuardrailFuzz, summarizeAttackBank, } from './corpus/mod.js';
+export { createCorpusCache, parseLabelledCsv, recordsFromYaml, SOURCES } from './eval/corpus.js';
+export { DETECTORS, formatReport, runGuardrailEval } from './eval/mod.js';
+export { formatScores, scoreAll, scoreDetector } from './eval/score.js';

package/esm/src/guardrails/theorum-error.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Contract-failure error class for THEORUM.
+ *
+ * Lives in its own module so `lexicon.ts` can throw it without importing
+ * `error.ts` (which resolves public copy through the lexicon).
+ *
+ * @module
+ */
+/** Error class used for expected THEORUM contract failures. */
+export declare class TheorumError extends Error {
+    constructor(message?: string, options?: ErrorOptions);
+}

package/esm/src/guardrails/theorum-error.js

@@ -0,0 +1,15 @@
+/**
+ * Contract-failure error class for THEORUM.
+ *
+ * Lives in its own module so `lexicon.ts` can throw it without importing
+ * `error.ts` (which resolves public copy through the lexicon).
+ *
+ * @module
+ */
+/** Error class used for expected THEORUM contract failures. */
+export class TheorumError extends Error {
+    constructor(message = '', options) {
+        super(message, options);
+        this.name = 'TheorumError';
+    }
+}

package/esm/src/guardrails/tool-directives.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Directive detection for tool ingress.
+ *
+ * Tool results carry a different threat than user text. The jailbreak phrasings in
+ * `injection.ts` name the thing they attack — "ignore previous instructions",
+ * "reveal your system prompt" — and real indirect injection rarely does. It reads
+ * like a status update or a helpful next step, and pattern-matching for the word
+ * "instructions" misses all of it.
+ *
+ * What is anomalous in *data* is content that behaves like an instruction: naming
+ * a tool the agent can call, issuing an imperative at the agent, or claiming an
+ * authority the content does not have.
+ *
+ * A signal only counts when it co-occurs with a concrete external destination —
+ * an address or URL. Directive language alone is far too common in legitimate
+ * output to act on. These signals raise the turn's taint rather than rewriting the text. A page
+ * documenting an email API legitimately says "call send_email"; redacting that
+ * would corrupt content the model needs. Being wrong here should cost a refused
+ * write — recoverable and visible — not silently damaged input.
+ *
+ * @module
+ */
+import type { AdvisoryLevel, GuardrailHit } from './types.js';
+/** Rule ids emitted by tool-ingress directive detection. */
+export declare const DIRECTIVE_RULES: {
+    readonly toolName: "tool_result.names-callable-tool";
+    readonly imperative: "tool_result.imperative";
+    readonly authority: "tool_result.authority-claim";
+};
+/**
+ * Detect instruction-shaped content in a tool result.
+ *
+ * `callableTools` is the set the model can actually invoke this turn. A result
+ * naming one is the highest-precision signal available — ordinary data has no
+ * reason to name the agent's tools, and no generic content filter can check it
+ * because it requires the turn's registry.
+ */
+declare function directiveHits(text: string, callableTools?: readonly string[]): GuardrailHit[];
+/** True when a result looked like it was trying to steer the agent. */
+declare function looksDirective(hits: GuardrailHit[]): boolean;
+/**
+ * Strength of the signals, read off the hits rather than invented.
+ *
+ * Naming a tool the model can call is the sharpest signal available, so it alone
+ * reaches `high`; so does agreement between two different signal kinds.
+ */
+declare function advisoryLevel(hits: GuardrailHit[]): AdvisoryLevel;
+export { advisoryLevel, directiveHits, looksDirective };

package/esm/src/guardrails/tool-directives.js

@@ -0,0 +1,124 @@
+/**
+ * Directive detection for tool ingress.
+ *
+ * Tool results carry a different threat than user text. The jailbreak phrasings in
+ * `injection.ts` name the thing they attack — "ignore previous instructions",
+ * "reveal your system prompt" — and real indirect injection rarely does. It reads
+ * like a status update or a helpful next step, and pattern-matching for the word
+ * "instructions" misses all of it.
+ *
+ * What is anomalous in *data* is content that behaves like an instruction: naming
+ * a tool the agent can call, issuing an imperative at the agent, or claiming an
+ * authority the content does not have.
+ *
+ * A signal only counts when it co-occurs with a concrete external destination —
+ * an address or URL. Directive language alone is far too common in legitimate
+ * output to act on. These signals raise the turn's taint rather than rewriting the text. A page
+ * documenting an email API legitimately says "call send_email"; redacting that
+ * would corrupt content the model needs. Being wrong here should cost a refused
+ * write — recoverable and visible — not silently damaged input.
+ *
+ * @module
+ */
+import { normalizeForDetection } from './normalize.js';
+/** Rule ids emitted by tool-ingress directive detection. */
+export const DIRECTIVE_RULES = {
+    toolName: 'tool_result.names-callable-tool',
+    imperative: 'tool_result.imperative',
+    authority: 'tool_result.authority-claim',
+};
+/**
+ * Imperatives aimed at an agent rather than a reader.
+ *
+ * Bounded quantifiers throughout: tool results can be large, and an unbounded
+ * scanner on attacker-controlled bytes is a denial-of-service surface.
+ */
+const IMPERATIVES = [
+    /\b(?:next|final|remaining)\s+steps?\s*[:—-]/gi,
+    /\byou\s+(?:must|should|need\s+to|are\s+required\s+to)\s+(?:now\s+)?\w{2,20}/gi,
+    /\bto\s+(?:complete|finish|fulfil|fulfill)\s+(?:this|the)\s+\w{2,20}/gi,
+    /\b(?:call|invoke|run|execute)\s+(?:the\s+)?[\w.-]{2,40}\s+(?:tool|function)\b/gi,
+    /\b(?:send|forward|email|transfer|upload|post)\s+(?:the\s+|all\s+|your\s+)?[\w\s]{2,40}\s+to\s+\S{3,80}/gi,
+    /\b(?:delete|remove|drop|purge)\s+(?:the\s+|all\s+)?[\w\s]{2,40}\b/gi,
+];
+/**
+ * A concrete external destination — the thing exfiltration needs and ordinary
+ * process prose almost never carries.
+ *
+ * This is the discriminator. Directive language on its own is everywhere in
+ * legitimate tool output: documentation says "you must be an admin", support
+ * articles say "to remove a user", status reports say "the user has approved".
+ * Measured on a benign sample, directive signals alone produced false positives
+ * on most of it. Pairing a signal with a destination removed all of them.
+ */
+const EXFIL_TARGET = /\b[\w.+-]{1,64}@[\w-]{1,63}(?:\.[\w-]{1,63}){1,4}\b|\bhttps?:\/\/\S{4,120}/i;
+/** Claims of permission or provenance the content cannot actually hold. */
+const AUTHORITY = [
+    /\b(?:the\s+)?user\s+has\s+(?:already\s+)?(?:approved|authorised|authorized|confirmed|requested)\b/gi,
+    /\b(?:system|admin|operator)\s+(?:note|notice|message|override|instruction)s?\s*[:—-]/gi,
+    /\bon\s+behalf\s+of\s+the\s+(?:user|operator|admin)\b/gi,
+    /\bthis\s+(?:is|was)\s+(?:pre-?)?(?:approved|authorised|authorized)\b/gi,
+];
+function matches(patterns, text) {
+    return patterns.some((pattern) => {
+        pattern.lastIndex = 0;
+        return pattern.test(text);
+    });
+}
+/** Word-boundary match for a tool name, escaped so registry names cannot inject. */
+function mentionsTool(text, tool) {
+    if (tool.length < 3) {
+        return false;
+    }
+    const escaped = tool.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return new RegExp(`(?:^|[^\\w-])${escaped}(?:$|[^\\w-])`, 'i').test(text);
+}
+/**
+ * Detect instruction-shaped content in a tool result.
+ *
+ * `callableTools` is the set the model can actually invoke this turn. A result
+ * naming one is the highest-precision signal available — ordinary data has no
+ * reason to name the agent's tools, and no generic content filter can check it
+ * because it requires the turn's registry.
+ */
+function directiveHits(text, callableTools = []) {
+    if (!text || !EXFIL_TARGET.test(text)) {
+        // No destination, no exfiltration. Action-shaped attacks that carry no target
+        // are left to the taint gate, which does not depend on reading the content.
+        return [];
+    }
+    const normalized = normalizeForDetection(text);
+    const hits = [];
+    // One hit per named tool — several names is a stronger signal than one.
+    for (const _tool of callableTools.filter((tool) => mentionsTool(normalized, tool))) {
+        hits.push({ rule: DIRECTIVE_RULES.toolName, severity: 'high' });
+    }
+    if (matches(IMPERATIVES, normalized)) {
+        hits.push({ rule: DIRECTIVE_RULES.imperative, severity: 'medium' });
+    }
+    if (matches(AUTHORITY, normalized)) {
+        hits.push({ rule: DIRECTIVE_RULES.authority, severity: 'medium' });
+    }
+    return hits;
+}
+/** True when a result looked like it was trying to steer the agent. */
+function looksDirective(hits) {
+    return hits.length > 0;
+}
+/**
+ * Strength of the signals, read off the hits rather than invented.
+ *
+ * Naming a tool the model can call is the sharpest signal available, so it alone
+ * reaches `high`; so does agreement between two different signal kinds.
+ */
+function advisoryLevel(hits) {
+    if (hits.length === 0) {
+        return 'none';
+    }
+    const kinds = new Set(hits.map((hit) => hit.rule));
+    if (kinds.has(DIRECTIVE_RULES.toolName) || kinds.size > 1) {
+        return 'high';
+    }
+    return 'elevated';
+}
+export { advisoryLevel, directiveHits, looksDirective };