@discretion/core 0.1.0

package/dist/src/detect/detectors/contact/ipv4.js

@@ -0,0 +1,109 @@
+/**
+ * IP_ADDRESS (IPv4) — valid-range checking with scope classification.
+ *
+ * SPEC.md: "IP_ADDRESS — v4 and v6 with valid-range checking;
+ * private/reserved ranges classified separately and lower sensitivity by
+ * default." Scope drives both metadata and confidence: a routable public
+ * address is a strong signal; a 10.x.x.x reveals only that someone has a
+ * LAN. The TEST-NET documentation ranges are non-sensitive by construction —
+ * they exist so that documentation can contain addresses.
+ */
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, GLOBAL_REGION, invalid, valid } from '../../types.js';
+function classify(o) {
+    const [a, b, c] = o;
+    if (a === 0)
+        return o.every((x) => x === 0) ? 'unspecified' : 'this-network';
+    if (a === 10)
+        return 'private';
+    if (a === 100 && b >= 64 && b <= 127)
+        return 'cgn';
+    if (a === 127)
+        return 'loopback';
+    if (a === 169 && b === 254)
+        return 'link-local';
+    if (a === 172 && b >= 16 && b <= 31)
+        return 'private';
+    if (a === 192 && b === 0 && c === 2)
+        return 'documentation'; // TEST-NET-1
+    if (a === 192 && b === 168)
+        return 'private';
+    if (a === 198 && (b === 18 || b === 19))
+        return 'benchmarking';
+    if (a === 198 && b === 51 && c === 100)
+        return 'documentation'; // TEST-NET-2
+    if (a === 203 && b === 0 && c === 113)
+        return 'documentation'; // TEST-NET-3
+    if (a >= 224 && a <= 239)
+        return 'multicast';
+    if (o[0] === 255 && o[1] === 255 && o[2] === 255 && o[3] === 255)
+        return 'broadcast';
+    if (a >= 240)
+        return 'reserved';
+    return 'public';
+}
+function validateIpv4(ctx) {
+    // Reject dotted runs that are fragments of something longer: a version
+    // string ("v1.2.3.4"), a 5-part sequence ("1.2.3.4.5"), or a decimal
+    // neighbourhood. \b cannot see these, so the validator looks around.
+    const before = ctx.start > 0 ? ctx.text[ctx.start - 1] : '';
+    if (before === '.' || before === 'v' || before === 'V' || /\d/.test(before ?? '')) {
+        return invalid('embedded in a longer dotted sequence');
+    }
+    const after = ctx.text.slice(ctx.end, ctx.end + 2);
+    if (/^\.\d/.test(after))
+        return invalid('embedded in a longer dotted sequence');
+    const parts = ctx.match[0].split('.');
+    if (parts.length !== 4)
+        return invalid('not four octets');
+    const octets = [];
+    for (const p of parts) {
+        if (p.length === 0 || p.length > 3)
+            return invalid('octet length out of range');
+        const v = Number(p);
+        if (!Number.isInteger(v) || v < 0 || v > 255)
+            return invalid('octet out of range');
+        octets.push(v);
+    }
+    const o = octets;
+    const scope = classify(o);
+    // Canonical form strips zero-padding ("192.168.001.001" → "192.168.1.1")
+    // so log-formatted and plain writings of one address share a vault entry.
+    const canonical = o.join('.');
+    if (scope === 'documentation') {
+        return valid({
+            canonical,
+            sensitive: false,
+            confidence: CONFIDENCE.MEDIUM,
+            metadata: { version: 4, scope },
+            validator: 'ipv4-range',
+        });
+    }
+    if (scope === 'broadcast' || scope === 'unspecified') {
+        // Well-known constants; identifying nothing.
+        return valid({
+            canonical,
+            sensitive: false,
+            confidence: CONFIDENCE.LOW,
+            metadata: { version: 4, scope },
+            validator: 'ipv4-range',
+        });
+    }
+    const isPublic = scope === 'public';
+    return valid({
+        canonical,
+        confidence: isPublic ? CONFIDENCE.HIGH : CONFIDENCE.MEDIUM,
+        metadata: { version: 4, scope },
+        validator: 'ipv4-range',
+    });
+}
+registerDetector({
+    id: 'ip-v4',
+    entityType: 'IP_ADDRESS',
+    regions: [GLOBAL_REGION],
+    pattern: /\b(?:\d{1,3}\.){3}\d{1,3}\b/g,
+    baseConfidence: CONFIDENCE.HIGH,
+    description: 'IPv4 addresses with range validation; private/reserved scopes classified at lower confidence.',
+    validate: validateIpv4,
+});
+//# sourceMappingURL=ipv4.js.map

package/dist/src/detect/detectors/contact/ipv4.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ipv4.js","sourceRoot":"","sources":["../../../../../src/detect/detectors/contact/ipv4.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAiB3E,SAAS,QAAQ,CAAC,CAA4C;IAC5D,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACpB,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC;IAC7E,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,UAAU,CAAC;IACjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,YAAY,CAAC;IAChD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,eAAe,CAAC,CAAC,aAAa;IAC1E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,cAAc,CAAC;IAC/D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,eAAe,CAAC,CAAC,aAAa;IAC7E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,eAAe,CAAC,CAAC,aAAa;IAC5E,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,WAAW,CAAC;IAC7C,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC;IACrF,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,UAAU,CAAC;IAChC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,GAAsB;IAC1C,uEAAuE;IACvE,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QAClF,OAAO,OAAO,CAAC,sCAAsC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,sCAAsC,CAAC,CAAC;IAEhF,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;QAChF,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG;YAAE,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACnF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,MAAM,CAAC,GAAG,MAA8D,CAAC;IACzE,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAE1B,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE9B,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;YACX,SAAS;YACT,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,UAAU,CAAC,MAAM;YAC7B,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE;YAC/B,SAAS,EAAE,YAAY;SACxB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;QACrD,6CAA6C;QAC7C,OAAO,KAAK,CAAC;YACX,SAAS;YACT,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,UAAU,CAAC,GAAG;YAC1B,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE;YAC/B,SAAS,EAAE,YAAY;SACxB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,KAAK,QAAQ,CAAC;IACpC,OAAO,KAAK,CAAC;QACX,SAAS;QACT,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM;QAC1D,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE;QAC/B,SAAS,EAAE,YAAY;KACxB,CAAC,CAAC;AACL,CAAC;AAED,gBAAgB,CAAC;IACf,EAAE,EAAE,OAAO;IACX,UAAU,EAAE,YAAY;IACxB,OAAO,EAAE,CAAC,aAAa,CAAC;IACxB,OAAO,EAAE,8BAA8B;IACvC,cAAc,EAAE,UAAU,CAAC,IAAI;IAC/B,WAAW,EAAE,+FAA+F;IAC5G,QAAQ,EAAE,YAAY;CACvB,CAAC,CAAC"}

package/dist/src/detect/detectors/contact/ipv6.d.ts

@@ -0,0 +1,16 @@
+/**
+ * IP_ADDRESS (IPv6) — full parse with compression, zone ids and v4-mapped
+ * tails, plus scope classification.
+ *
+ * The candidate pattern is deliberately loose — hex-and-colon runs are easy
+ * to over-match and hard to precisely match with one regex (compressed
+ * forms, embedded IPv4, zones). Precision comes from `parseIpv6`, a strict
+ * parser that either produces exactly eight 16-bit groups or rejects. Times
+ * ("12:30:45"), MACs ("aa:bb:cc:dd:ee:ff") and C++ scope operators
+ * ("std::vector") all fail the parse or the pattern's look-arounds.
+ *
+ * The all-zero address `::` is rejected outright rather than classified:
+ * a bare double colon appears in too many non-address contexts to report.
+ */
+export {};
+//# sourceMappingURL=ipv6.d.ts.map

package/dist/src/detect/detectors/contact/ipv6.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ipv6.d.ts","sourceRoot":"","sources":["../../../../../src/detect/detectors/contact/ipv6.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}

package/dist/src/detect/detectors/contact/ipv6.js

@@ -0,0 +1,187 @@
+/**
+ * IP_ADDRESS (IPv6) — full parse with compression, zone ids and v4-mapped
+ * tails, plus scope classification.
+ *
+ * The candidate pattern is deliberately loose — hex-and-colon runs are easy
+ * to over-match and hard to precisely match with one regex (compressed
+ * forms, embedded IPv4, zones). Precision comes from `parseIpv6`, a strict
+ * parser that either produces exactly eight 16-bit groups or rejects. Times
+ * ("12:30:45"), MACs ("aa:bb:cc:dd:ee:ff") and C++ scope operators
+ * ("std::vector") all fail the parse or the pattern's look-arounds.
+ *
+ * The all-zero address `::` is rejected outright rather than classified:
+ * a bare double colon appears in too many non-address contexts to report.
+ */
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, GLOBAL_REGION, invalid, valid } from '../../types.js';
+/** Strict parse to eight groups, or null. */
+function parseIpv6(input) {
+    let s = input;
+    let zone;
+    const pct = s.indexOf('%');
+    if (pct >= 0) {
+        zone = s.slice(pct + 1);
+        s = s.slice(0, pct);
+        if (zone.length === 0)
+            return null;
+    }
+    // Embedded IPv4 tail → two trailing hex groups.
+    let v4Groups = null;
+    if (s.includes('.')) {
+        const lastColon = s.lastIndexOf(':');
+        if (lastColon < 0)
+            return null;
+        const tail = s.slice(lastColon + 1);
+        const parts = tail.split('.');
+        if (parts.length !== 4)
+            return null;
+        const octets = [];
+        for (const p of parts) {
+            if (!/^\d{1,3}$/.test(p))
+                return null;
+            const v = Number(p);
+            if (v > 255)
+                return null;
+            octets.push(v);
+        }
+        v4Groups = [(octets[0] << 8) | octets[1], (octets[2] << 8) | octets[3]];
+        s = s.slice(0, lastColon + 1); // keep the colon: "::ffff:" stays parseable
+    }
+    const splitGroups = (part) => {
+        if (part === '')
+            return [];
+        const out = [];
+        for (const g of part.split(':')) {
+            if (!/^[0-9A-Fa-f]{1,4}$/.test(g))
+                return null;
+            out.push(parseInt(g, 16));
+        }
+        return out;
+    };
+    let groups;
+    const compressionIndex = s.indexOf('::');
+    if (compressionIndex >= 0) {
+        if (s.indexOf('::', compressionIndex + 1) >= 0)
+            return null; // two '::'
+        let head = s.slice(0, compressionIndex);
+        let tail = s.slice(compressionIndex + 2);
+        if (head.endsWith(':'))
+            head = head.slice(0, -1);
+        if (tail.endsWith(':'))
+            tail = tail.slice(0, -1);
+        const headGroups = splitGroups(head);
+        const tailGroups = splitGroups(tail);
+        if (headGroups === null || tailGroups === null)
+            return null;
+        const tailAll = v4Groups === null ? tailGroups : [...tailGroups, ...v4Groups];
+        const fixed = headGroups.length + tailAll.length;
+        if (fixed > 7)
+            return null; // '::' must compress at least one group
+        groups = [...headGroups, ...new Array(8 - fixed).fill(0), ...tailAll];
+    }
+    else {
+        let body = s;
+        if (v4Groups !== null) {
+            if (!body.endsWith(':'))
+                return null;
+            body = body.slice(0, -1);
+        }
+        const parsed = splitGroups(body);
+        if (parsed === null)
+            return null;
+        const all = v4Groups === null ? parsed : [...parsed, ...v4Groups];
+        if (all.length !== 8)
+            return null;
+        groups = all;
+    }
+    return zone === undefined ? { groups } : { groups, zone };
+}
+function classify(g) {
+    if (g.every((x) => x === 0))
+        return 'unspecified';
+    if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1)
+        return 'loopback';
+    const g0 = g[0];
+    if ((g0 & 0xffc0) === 0xfe80)
+        return 'link-local';
+    if ((g0 & 0xfe00) === 0xfc00)
+        return 'unique-local';
+    if ((g0 & 0xff00) === 0xff00)
+        return 'multicast';
+    if (g0 === 0x2001 && g[1] === 0x0db8)
+        return 'documentation';
+    if (g.slice(0, 5).every((x) => x === 0) && g[5] === 0xffff)
+        return 'v4-mapped';
+    if (g0 === 0x2002)
+        return '6to4';
+    return 'global';
+}
+/** RFC 5952 canonical text: lowercase hex, longest zero run compressed. */
+function canonicalIpv6(groups) {
+    let bestStart = -1;
+    let bestLen = 0;
+    let i = 0;
+    while (i < 8) {
+        if (groups[i] === 0) {
+            let j = i;
+            while (j < 8 && groups[j] === 0)
+                j++;
+            if (j - i > bestLen) {
+                bestLen = j - i;
+                bestStart = i;
+            }
+            i = j;
+        }
+        else {
+            i++;
+        }
+    }
+    const hex = groups.map((g) => g.toString(16));
+    if (bestLen < 2)
+        return hex.join(':');
+    const head = hex.slice(0, bestStart).join(':');
+    const tail = hex.slice(bestStart + bestLen).join(':');
+    return `${head}::${tail}`;
+}
+function validateIpv6(ctx) {
+    const parsed = parseIpv6(ctx.match[0]);
+    if (parsed === null)
+        return invalid('not a parseable IPv6 address');
+    const scope = classify(parsed.groups);
+    if (scope === 'unspecified')
+        return invalid('unspecified address');
+    const canonical = canonicalIpv6(parsed.groups);
+    if (scope === 'documentation') {
+        return valid({
+            canonical,
+            sensitive: false,
+            confidence: CONFIDENCE.MEDIUM,
+            metadata: { version: 6, scope },
+            validator: 'ipv6-parse',
+        });
+    }
+    const strong = scope === 'global' || scope === '6to4' || scope === 'v4-mapped';
+    return valid({
+        canonical,
+        confidence: strong ? CONFIDENCE.HIGH : scope === 'multicast' ? CONFIDENCE.LOW : CONFIDENCE.MEDIUM,
+        metadata: {
+            version: 6,
+            scope,
+            ...(parsed.zone !== undefined ? { zone: parsed.zone } : {}),
+        },
+        validator: 'ipv6-parse',
+    });
+}
+registerDetector({
+    id: 'ip-v6',
+    entityType: 'IP_ADDRESS',
+    regions: [GLOBAL_REGION],
+    // Loose harvest: needs a colon early (two colons total guaranteed by the
+    // parser), hex/colon body, optional v4 tail and zone. Look-arounds keep it
+    // out of words, times and scope operators.
+    pattern: /(?<![\w:.])(?=[0-9A-Fa-f]{0,4}:[0-9A-Fa-f]{0,4}:)[0-9A-Fa-f:]{2,45}(?:\.\d{1,3}(?:\.\d{1,3}){2})?(?:%[0-9A-Za-z._~-]{1,16})?(?![\w:])/g,
+    baseConfidence: CONFIDENCE.HIGH,
+    description: 'IPv6 addresses (compressed, zoned, v4-mapped) with strict parsing and scope classification.',
+    validate: validateIpv6,
+});
+//# sourceMappingURL=ipv6.js.map

package/dist/src/detect/detectors/contact/ipv6.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ipv6.js","sourceRoot":"","sources":["../../../../../src/detect/detectors/contact/ipv6.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAkB3E,6CAA6C;AAC7C,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,CAAC,GAAG,KAAK,CAAC;IACd,IAAI,IAAwB,CAAC;IAE7B,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACb,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACxB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACpB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IACrC,CAAC;IAED,gDAAgD;IAChD,IAAI,QAAQ,GAAoB,IAAI,CAAC;IACrC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,SAAS,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,GAAG,GAAG;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QACD,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;QAC5E,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,4CAA4C;IAC7E,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,IAAY,EAAmB,EAAE;QACpD,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,IAAI,MAAgB,CAAC;IACrB,MAAM,gBAAgB,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,WAAW;QACxE,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACxC,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5D,MAAM,OAAO,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,QAAQ,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QACjD,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,wCAAwC;QACpE,MAAM,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,IAAI,KAAK,CAAS,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC;IAChF,CAAC;SAAM,CAAC;QACN,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,GAAG,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC;QAClE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,GAAG,GAAG,CAAC;IACf,CAAC;IAED,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,QAAQ,CAAC,CAAoB;IACpC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,aAAa,CAAC;IAClD,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC;IACzE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACjB,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,YAAY,CAAC;IAClD,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,cAAc,CAAC;IACpD,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,WAAW,CAAC;IACjD,IAAI,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,eAAe,CAAC;IAC7D,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,WAAW,CAAC;IAC/E,IAAI,EAAE,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACjC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,2EAA2E;AAC3E,SAAS,aAAa,CAAC,MAAyB;IAC9C,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;IACnB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;gBAAE,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,EAAE,CAAC;gBACpB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;gBAChB,SAAS,GAAG,CAAC,CAAC;YAChB,CAAC;YACD,CAAC,GAAG,CAAC,CAAC;QACR,CAAC;aAAM,CAAC;YACN,CAAC,EAAE,CAAC;QACN,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9C,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtD,OAAO,GAAG,IAAI,KAAK,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,YAAY,CAAC,GAAsB;IAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAEpE,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,aAAa;QAAE,OAAO,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAEnE,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/C,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;YACX,SAAS;YACT,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,UAAU,CAAC,MAAM;YAC7B,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE;YAC/B,SAAS,EAAE,YAAY;SACxB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,WAAW,CAAC;IAC/E,OAAO,KAAK,CAAC;QACX,SAAS;QACT,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM;QACjG,QAAQ,EAAE;YACR,OAAO,EAAE,CAAC;YACV,KAAK;YACL,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D;QACD,SAAS,EAAE,YAAY;KACxB,CAAC,CAAC;AACL,CAAC;AAED,gBAAgB,CAAC;IACf,EAAE,EAAE,OAAO;IACX,UAAU,EAAE,YAAY;IACxB,OAAO,EAAE,CAAC,aAAa,CAAC;IACxB,yEAAyE;IACzE,2EAA2E;IAC3E,2CAA2C;IAC3C,OAAO,EACL,wIAAwI;IAC1I,cAAc,EAAE,UAAU,CAAC,IAAI;IAC/B,WAAW,EAAE,6FAA6F;IAC1G,QAAQ,EAAE,YAAY;CACvB,CAAC,CAAC"}

package/dist/src/detect/detectors/contact/mac.d.ts

@@ -0,0 +1,14 @@
+/**
+ * MAC_ADDRESS — colon, hyphen and Cisco dotted notations.
+ *
+ * A MAC has no checksum, but its shape — six hex octets with a CONSISTENT
+ * separator, or three dotted quads — is distinctive enough that structural
+ * validation carries high confidence. The separator consistency is enforced
+ * in the pattern via a backreference; mixed separators do not match at all.
+ *
+ * The broadcast (ff:ff:…) and null (00:00:…) addresses are well-known
+ * constants that identify no device: detected, classified non-sensitive,
+ * mirroring SPEC.md's treatment of known test values.
+ */
+export {};
+//# sourceMappingURL=mac.d.ts.map

package/dist/src/detect/detectors/contact/mac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mac.d.ts","sourceRoot":"","sources":["../../../../../src/detect/detectors/contact/mac.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}

package/dist/src/detect/detectors/contact/mac.js

@@ -0,0 +1,64 @@
+/**
+ * MAC_ADDRESS — colon, hyphen and Cisco dotted notations.
+ *
+ * A MAC has no checksum, but its shape — six hex octets with a CONSISTENT
+ * separator, or three dotted quads — is distinctive enough that structural
+ * validation carries high confidence. The separator consistency is enforced
+ * in the pattern via a backreference; mixed separators do not match at all.
+ *
+ * The broadcast (ff:ff:…) and null (00:00:…) addresses are well-known
+ * constants that identify no device: detected, classified non-sensitive,
+ * mirroring SPEC.md's treatment of known test values.
+ */
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, GLOBAL_REGION, invalid, valid } from '../../types.js';
+function validateMac(ctx) {
+    // A six-group run inside a longer separated sequence (an IPv6 address, a
+    // long hex dump) is a fragment, not a MAC. \b cannot see separators.
+    const before = ctx.start >= 2 ? ctx.text.slice(ctx.start - 2, ctx.start) : '';
+    if (/[0-9A-Fa-f][:-]$/.test(before))
+        return invalid('fragment of a longer sequence');
+    const after = ctx.text.slice(ctx.end, ctx.end + 2);
+    if (/^[:-][0-9A-Fa-f]/.test(after))
+        return invalid('fragment of a longer sequence');
+    const raw = ctx.match[0];
+    const hex = raw.replace(/[^0-9A-Fa-f]/g, '');
+    if (hex.length !== 12)
+        return invalid('not six octets');
+    const bytes = [];
+    for (let i = 0; i < 12; i += 2)
+        bytes.push(parseInt(hex.slice(i, i + 2), 16));
+    const canonical = bytes.map((b) => b.toString(16).padStart(2, '0')).join(':');
+    const notation = raw.includes(':') ? 'colon' : raw.includes('-') ? 'hyphen' : 'cisco-dotted';
+    const allFF = bytes.every((b) => b === 0xff);
+    const allZero = bytes.every((b) => b === 0);
+    if (allFF || allZero) {
+        return valid({
+            canonical,
+            sensitive: false,
+            confidence: CONFIDENCE.LOW,
+            metadata: { notation, special: allFF ? 'broadcast' : 'null' },
+            validator: 'mac-structural',
+        });
+    }
+    const b0 = bytes[0];
+    return valid({
+        canonical,
+        metadata: {
+            notation,
+            multicast: (b0 & 0x01) !== 0,
+            locallyAdministered: (b0 & 0x02) !== 0,
+        },
+        validator: 'mac-structural',
+    });
+}
+registerDetector({
+    id: 'mac-address',
+    entityType: 'MAC_ADDRESS',
+    regions: [GLOBAL_REGION],
+    pattern: /\b(?:[0-9A-Fa-f]{2}([:-])(?:[0-9A-Fa-f]{2}\1){4}[0-9A-Fa-f]{2}|[0-9A-Fa-f]{4}\.[0-9A-Fa-f]{4}\.[0-9A-Fa-f]{4})\b/g,
+    baseConfidence: CONFIDENCE.HIGH,
+    description: 'MAC addresses in colon, hyphen, or Cisco dotted notation; broadcast/null non-sensitive.',
+    validate: validateMac,
+});
+//# sourceMappingURL=mac.js.map

package/dist/src/detect/detectors/contact/mac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mac.js","sourceRoot":"","sources":["../../../../../src/detect/detectors/contact/mac.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG3E,SAAS,WAAW,CAAC,GAAsB;IACzC,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC,+BAA+B,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACnD,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAEpF,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACxD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAE9E,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC;IAE7F,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5C,IAAI,KAAK,IAAI,OAAO,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;YACX,SAAS;YACT,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,UAAU,CAAC,GAAG;YAC1B,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE;YAC7D,SAAS,EAAE,gBAAgB;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACrB,OAAO,KAAK,CAAC;QACX,SAAS;QACT,QAAQ,EAAE;YACR,QAAQ;YACR,SAAS,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;YAC5B,mBAAmB,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;SACvC;QACD,SAAS,EAAE,gBAAgB;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,gBAAgB,CAAC;IACf,EAAE,EAAE,aAAa;IACjB,UAAU,EAAE,aAAa;IACzB,OAAO,EAAE,CAAC,aAAa,CAAC;IACxB,OAAO,EACL,mHAAmH;IACrH,cAAc,EAAE,UAAU,CAAC,IAAI;IAC/B,WAAW,EAAE,yFAAyF;IACtG,QAAQ,EAAE,WAAW;CACtB,CAAC,CAAC"}

package/dist/src/detect/detectors/contact/phone.d.ts

@@ -0,0 +1,21 @@
+/**
+ * PHONE — libphonenumber-js with the FULL metadata bundle.
+ *
+ * SPEC.md: "use libphonenumber-js with the full metadata bundle, not the
+ * minimal one. Never hand-roll phone regex. Parse and validate, with region
+ * inference from surrounding text and a user-set default region."
+ *
+ * The regex below is a candidate harvester only — it collects digit runs with
+ * phone-ish punctuation and hands them to libphonenumber, which is the
+ * validator. Region inference from SURROUNDING TEXT is a Stage 3 concern
+ * (trigger lexicons carry language/region evidence); in M2 the sources of
+ * region are the number's own +prefix or the user's configured default.
+ *
+ * Known false-positive shapes are rejected before parsing: year ranges
+ * ("2019-2023") and calendar dates, both of which are 8-digit runs that
+ * genuinely validate as subscriber numbers in 8-digit national plans
+ * (Denmark's 20 19 20 23 is a real mobile shape). The date guard is cheap
+ * and kills the whole class.
+ */
+export {};
+//# sourceMappingURL=phone.d.ts.map

package/dist/src/detect/detectors/contact/phone.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"phone.d.ts","sourceRoot":"","sources":["../../../../../src/detect/detectors/contact/phone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG"}

package/dist/src/detect/detectors/contact/phone.js

@@ -0,0 +1,76 @@
+/**
+ * PHONE — libphonenumber-js with the FULL metadata bundle.
+ *
+ * SPEC.md: "use libphonenumber-js with the full metadata bundle, not the
+ * minimal one. Never hand-roll phone regex. Parse and validate, with region
+ * inference from surrounding text and a user-set default region."
+ *
+ * The regex below is a candidate harvester only — it collects digit runs with
+ * phone-ish punctuation and hands them to libphonenumber, which is the
+ * validator. Region inference from SURROUNDING TEXT is a Stage 3 concern
+ * (trigger lexicons carry language/region evidence); in M2 the sources of
+ * region are the number's own +prefix or the user's configured default.
+ *
+ * Known false-positive shapes are rejected before parsing: year ranges
+ * ("2019-2023") and calendar dates, both of which are 8-digit runs that
+ * genuinely validate as subscriber numbers in 8-digit national plans
+ * (Denmark's 20 19 20 23 is a real mobile shape). The date guard is cheap
+ * and kills the whole class.
+ */
+import { parsePhoneNumberFromString } from 'libphonenumber-js/max';
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, GLOBAL_REGION, invalid, valid } from '../../types.js';
+/** "2019-2023", "1999/2001" — year ranges, never phone numbers. */
+const YEAR_RANGE = /^(?:19|20)\d{2}\s?[-/]\s?(?:19|20)\d{2}$/;
+/** Calendar dates: 2023-08-26, 26/08/2023, 08.26.23 and friends. */
+const DATE_LIKE = /^(?:\d{4}[-/.]\d{1,2}[-/.]\d{1,4}|\d{1,2}[-/.]\d{1,2}[-/.]\d{2,4})$/;
+function validatePhone(ctx) {
+    const raw = ctx.match[0];
+    const trimmed = raw.trim();
+    if (YEAR_RANGE.test(trimmed))
+        return invalid('year range');
+    if (DATE_LIKE.test(trimmed))
+        return invalid('date-like');
+    const digitCount = raw.replace(/\D/g, '').length;
+    // E.164 caps national significant numbers at 15 digits; anything shorter
+    // than 7 is a short code or fragment we do not report.
+    if (digitCount < 7)
+        return invalid('too few digits');
+    if (digitCount > 16)
+        return invalid('too many digits');
+    const hasPlus = trimmed.startsWith('+');
+    let parsed;
+    if (hasPlus) {
+        parsed = parsePhoneNumberFromString(trimmed);
+    }
+    else if (ctx.defaultRegion !== undefined) {
+        parsed = parsePhoneNumberFromString(trimmed, ctx.defaultRegion);
+    }
+    else {
+        // A national-format number with no region context cannot be validated,
+        // and emitting unvalidated digit runs is the false-positive machine
+        // SPEC.md forbids. Stage 3's trigger evidence will widen this later.
+        return invalid('national format with no region context');
+    }
+    if (parsed === undefined || !parsed.isValid())
+        return invalid('not a valid number for any plan');
+    return valid({
+        canonical: parsed.number,
+        metadata: {
+            ...(parsed.country !== undefined ? { country: parsed.country } : {}),
+            countryCallingCode: parsed.countryCallingCode,
+            viaDefaultRegion: !hasPlus,
+        },
+        validator: 'libphonenumber-isvalid',
+    });
+}
+registerDetector({
+    id: 'phone',
+    entityType: 'PHONE',
+    regions: [GLOBAL_REGION],
+    pattern: /[+(]?\d[\d \t()./-]{4,22}\d/g,
+    baseConfidence: CONFIDENCE.HIGH,
+    description: 'Phone numbers in all international formats, validated by libphonenumber (full metadata).',
+    validate: validatePhone,
+});
+//# sourceMappingURL=phone.js.map

package/dist/src/detect/detectors/contact/phone.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"phone.js","sourceRoot":"","sources":["../../../../../src/detect/detectors/contact/phone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAEnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG3E,mEAAmE;AACnE,MAAM,UAAU,GAAG,0CAA0C,CAAC;AAE9D,oEAAoE;AACpE,MAAM,SAAS,GAAG,qEAAqE,CAAC;AAExF,SAAS,aAAa,CAAC,GAAsB;IAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEzB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3D,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC;IAEzD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;IACjD,yEAAyE;IACzE,uDAAuD;IACvD,IAAI,UAAU,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACrD,IAAI,UAAU,GAAG,EAAE;QAAE,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAEvD,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAExC,IAAI,MAAM,CAAC;IACX,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;SAAM,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,GAAG,0BAA0B,CAAC,OAAO,EAAE,GAAG,CAAC,aAA4B,CAAC,CAAC;IACjF,CAAC;SAAM,CAAC;QACN,uEAAuE;QACvE,oEAAoE;QACpE,qEAAqE;QACrE,OAAO,OAAO,CAAC,wCAAwC,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE;QAAE,OAAO,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAEjG,OAAO,KAAK,CAAC;QACX,SAAS,EAAE,MAAM,CAAC,MAAM;QACxB,QAAQ,EAAE;YACR,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,gBAAgB,EAAE,CAAC,OAAO;SAC3B;QACD,SAAS,EAAE,wBAAwB;KACpC,CAAC,CAAC;AACL,CAAC;AAED,gBAAgB,CAAC;IACf,EAAE,EAAE,OAAO;IACX,UAAU,EAAE,OAAO;IACnB,OAAO,EAAE,CAAC,aAAa,CAAC;IACxB,OAAO,EAAE,8BAA8B;IACvC,cAAc,EAAE,UAAU,CAAC,IAAI;IAC/B,WAAW,EAAE,0FAA0F;IACvG,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC"}

package/dist/src/detect/detectors/contact/urlCredentials.d.ts

@@ -0,0 +1,23 @@
+/**
+ * URL_WITH_CREDENTIALS — userinfo passwords and credential-bearing query
+ * parameters.
+ *
+ * SPEC.md: "URL_WITH_CREDENTIALS — userinfo components or tokens in query
+ * parameters."
+ *
+ * Two shapes, one detector:
+ *   • scheme://user:password@host…      (userinfo with a password)
+ *   • scheme://…?token=…&…              (a credential-named query parameter)
+ *
+ * The emitted span is the WHOLE URL, not just the secret. Masking only the
+ * password would leave "https://admin:…@internal.corp.com" — still leaking
+ * the username and the internal host — and M4's surrogate substitution can
+ * replace a whole URL with a same-shape fake, which it cannot do for a URL
+ * with a hole in it. The credential's location travels in metadata.
+ *
+ * A bare username without a password (git@github.com style) is NOT a
+ * credential; ubiquitous and public. Template placeholders (${VAR},
+ * YOUR_API_KEY) are detected but non-sensitive, mirroring test values.
+ */
+export {};
+//# sourceMappingURL=urlCredentials.d.ts.map

package/dist/src/detect/detectors/contact/urlCredentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"urlCredentials.d.ts","sourceRoot":"","sources":["../../../../../src/detect/detectors/contact/urlCredentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG"}