@surfinguard/core-engine 0.1.0 → 1.0.0

package/dist/analyzers/query.d.ts

@@ -0,0 +1,23 @@
+import type { QueryPatternDatabase } from '@surfinguard/types';
+import type { Analyzer, AnalyzerResult } from './base.js';
+/**
+ * Query Analyzer — detects dangerous SQL query patterns.
+ *
+ * Detects 7 threat patterns (D01-D07) mapped to 4 risk primitives.
+ * Lightweight regex-based (not a full SQL parser).
+ */
+export declare class QueryAnalyzer implements Analyzer {
+    readonly actionType: "query";
+    private readonly destructiveDdl;
+    private readonly destructiveDml;
+    private readonly exfiltrationPatterns;
+    private readonly escalationPatterns;
+    private readonly persistencePatterns;
+    private readonly obfuscationPatterns;
+    private readonly safeRegexes;
+    private readonly exfiltrationRegexes;
+    constructor(patterns: QueryPatternDatabase);
+    analyze(value: string): AnalyzerResult;
+    private splitStatements;
+}
+//# sourceMappingURL=query.d.ts.map

package/dist/analyzers/query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../src/analyzers/query.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAmB,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3E;;;;;GAKG;AACH,qBAAa,aAAc,YAAW,QAAQ;IAC5C,QAAQ,CAAC,UAAU,EAAG,OAAO,CAAU;IAEvC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAW;IAC1C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAW;IAC1C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAW;IAChD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAW;IAC9C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAW;IAC/C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAW;IAC/C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAW;IAEvC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAW;gBAEnC,QAAQ,EAAE,oBAAoB;IAgC1C,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc;IA+HtC,OAAO,CAAC,eAAe;CA4BxB"}

package/dist/analyzers/query.js

@@ -0,0 +1,183 @@
+/**
+ * Query Analyzer — detects dangerous SQL query patterns.
+ *
+ * Detects 7 threat patterns (D01-D07) mapped to 4 risk primitives.
+ * Lightweight regex-based (not a full SQL parser).
+ */
+export class QueryAnalyzer {
+    actionType = 'query';
+    destructiveDdl;
+    destructiveDml;
+    exfiltrationPatterns;
+    escalationPatterns;
+    persistencePatterns;
+    obfuscationPatterns;
+    safeRegexes;
+    exfiltrationRegexes;
+    constructor(patterns) {
+        this.destructiveDdl = patterns.destructiveDdl.map((p) => p.toLowerCase());
+        this.destructiveDml = patterns.destructiveDml.map((p) => p.toLowerCase());
+        this.escalationPatterns = patterns.escalationPatterns.map((p) => p.toLowerCase());
+        this.persistencePatterns = patterns.persistencePatterns.map((p) => p.toLowerCase());
+        this.obfuscationPatterns = patterns.obfuscationPatterns;
+        // Separate regex-like exfiltration patterns from plain strings
+        this.exfiltrationPatterns = [];
+        this.exfiltrationRegexes = [];
+        for (const p of patterns.exfiltrationPatterns) {
+            if (/[\\+*?{}[\]^$|]/.test(p)) {
+                try {
+                    this.exfiltrationRegexes.push(new RegExp(p, 'i'));
+                }
+                catch {
+                    this.exfiltrationPatterns.push(p.toLowerCase());
+                }
+            }
+            else {
+                this.exfiltrationPatterns.push(p.toLowerCase());
+            }
+        }
+        this.safeRegexes = [];
+        for (const p of patterns.safePatterns) {
+            try {
+                this.safeRegexes.push(new RegExp(p, 'i'));
+            }
+            catch {
+                // skip invalid regex
+            }
+        }
+    }
+    analyze(value) {
+        const raw = value.trim();
+        if (!raw) {
+            return {
+                actionType: 'query',
+                findings: [],
+                shortCircuit: { safe: true, reason: 'Empty query' },
+            };
+        }
+        // Normalize: lowercase, strip SQL comments, collapse whitespace
+        const stripped = raw.toLowerCase().replace(/\/\*.*?\*\//g, ' ');
+        const query = stripped.replace(/\s+/g, ' ').trim();
+        const findings = [];
+        const add = (primitive, score, reason, threatId) => {
+            findings.push({ primitive, score, reason, threatId });
+        };
+        // ── Safe short-circuit ──
+        // Only short-circuit simple single-statement queries with no dangerous patterns
+        const statements = this.splitStatements(query);
+        if (statements.length === 1) {
+            const hasDestructive = this.destructiveDdl.some((p) => query.includes(p));
+            const hasEscalation = this.escalationPatterns.some((p) => query.includes(p));
+            const hasPersistence = this.persistencePatterns.some((p) => query.includes(p));
+            const hasExfiltration = this.exfiltrationPatterns.some((p) => query.includes(p)) ||
+                this.exfiltrationRegexes.some((r) => r.test(query));
+            if (!hasDestructive && !hasEscalation && !hasPersistence && !hasExfiltration) {
+                if (this.safeRegexes.some((r) => r.test(query))) {
+                    return {
+                        actionType: 'query',
+                        findings: [],
+                        shortCircuit: { safe: true, reason: 'Safe query pattern' },
+                    };
+                }
+            }
+        }
+        // ── D01: Destructive DDL ──
+        if (this.destructiveDdl.some((p) => query.includes(p))) {
+            const ddlMatch = this.destructiveDdl.find((p) => query.includes(p));
+            add('DESTRUCTION', 10, `Destructive DDL — ${ddlMatch?.toUpperCase()}`, 'D01');
+        }
+        // ── D02/D07: Mass deletion/update (DML without WHERE) ──
+        if (query.includes('delete from') && !query.includes('where')) {
+            add('DESTRUCTION', 9, 'Mass data deletion — DELETE FROM without WHERE clause', 'D02');
+        }
+        if (query.includes('update') && query.includes('set') && !query.includes('where')) {
+            // Exclude CREATE-related UPDATE keywords
+            if (!query.includes('create') && !query.includes('alter user')) {
+                add('DESTRUCTION', 9, 'Mass data update — UPDATE SET without WHERE clause', 'D07');
+            }
+        }
+        // ── D03: Schema modification ──
+        if (query.includes('alter table')) {
+            // Don't double-count if already caught by DDL
+            if (!findings.some((f) => f.threatId === 'D01')) {
+                add('DESTRUCTION', 7, 'Schema modification — ALTER TABLE', 'D03');
+            }
+        }
+        if (query.includes('drop column') || query.includes('drop index')) {
+            if (!findings.some((f) => f.threatId === 'D01')) {
+                add('DESTRUCTION', 7, 'Schema modification — DROP COLUMN/INDEX', 'D03');
+            }
+        }
+        // ── D04: Data exfiltration ──
+        const exfilStringMatch = this.exfiltrationPatterns.find((p) => query.includes(p));
+        const exfilRegexMatch = this.exfiltrationRegexes.some((r) => r.test(query));
+        if (exfilStringMatch) {
+            add('EXFILTRATION', 9, `Data exfiltration — ${exfilStringMatch}`, 'D04');
+        }
+        else if (exfilRegexMatch) {
+            add('EXFILTRATION', 9, 'Data exfiltration — regex pattern match', 'D04');
+        }
+        // ── D05: Privilege escalation ──
+        if (this.escalationPatterns.some((p) => query.includes(p))) {
+            const escalMatch = this.escalationPatterns.find((p) => query.includes(p));
+            add('ESCALATION', 9, `Privilege escalation — ${escalMatch?.toUpperCase()}`, 'D05');
+        }
+        // ── D06: Stored procedure injection ──
+        if (this.persistencePatterns.some((p) => query.includes(p))) {
+            const dangerousBody = ['exec', 'system', 'xp_cmdshell', 'os.system', 'subprocess', 'shell'];
+            if (dangerousBody.some((d) => query.includes(d))) {
+                add('PERSISTENCE', 8, 'Stored procedure injection — trigger/function with exec/system call', 'D06');
+            }
+            else {
+                // Still flag it but lower severity
+                add('PERSISTENCE', 5, 'Database persistence — CREATE TRIGGER/FUNCTION', 'D06');
+            }
+        }
+        // ── Multi-statement boost ──
+        if (statements.length > 1 && findings.length > 0) {
+            add('MANIPULATION', 2, 'Multi-statement query — potential stacked injection', 'D04');
+        }
+        // ── Obfuscation boost (check raw input, not stripped) ──
+        const rawLower = raw.toLowerCase();
+        if (this.obfuscationPatterns.some((p) => rawLower.includes(p.toLowerCase()))) {
+            if (findings.length > 0) {
+                add('MANIPULATION', 2, 'SQL obfuscation detected — comment injection or hex encoding', 'D04');
+            }
+        }
+        return { actionType: 'query', findings };
+    }
+    splitStatements(query) {
+        // Split on semicolons but not within quotes
+        const parts = [];
+        let current = '';
+        let inQuote = false;
+        let quoteChar = '';
+        for (let i = 0; i < query.length; i++) {
+            const ch = query[i];
+            if (inQuote) {
+                current += ch;
+                if (ch === quoteChar)
+                    inQuote = false;
+            }
+            else if (ch === "'" || ch === '"') {
+                current += ch;
+                inQuote = true;
+                quoteChar = ch;
+            }
+            else if (ch === ';') {
+                const trimmed = current.trim();
+                if (trimmed)
+                    parts.push(trimmed);
+                current = '';
+            }
+            else {
+                current += ch;
+            }
+        }
+        const trimmed = current.trim();
+        if (trimmed)
+            parts.push(trimmed);
+        return parts;
+    }
+}
+//# sourceMappingURL=query.js.map

package/dist/analyzers/query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.js","sourceRoot":"","sources":["../../src/analyzers/query.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,MAAM,OAAO,aAAa;IACf,UAAU,GAAG,OAAgB,CAAC;IAEtB,cAAc,CAAW;IACzB,cAAc,CAAW;IACzB,oBAAoB,CAAW;IAC/B,kBAAkB,CAAW;IAC7B,mBAAmB,CAAW;IAC9B,mBAAmB,CAAW;IAC9B,WAAW,CAAW;IAEtB,mBAAmB,CAAW;IAE/C,YAAY,QAA8B;QACxC,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,kBAAkB,GAAG,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC;QAExD,+DAA+D;QAC/D,IAAI,CAAC,oBAAoB,GAAG,EAAE,CAAC;QAC/B,IAAI,CAAC,mBAAmB,GAAG,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,oBAAoB,EAAE,CAAC;YAC9C,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBACpD,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,qBAAqB;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,KAAa;QACnB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO;gBACL,UAAU,EAAE,OAAO;gBACnB,QAAQ,EAAE,EAAE;gBACZ,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE;aACpD,CAAC;QACJ,CAAC;QAED,gEAAgE;QAChE,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAEnD,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,CACV,SAAuC,EACvC,KAAa,EACb,MAAc,EACd,QAAgB,EAChB,EAAE;YACF,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC;QAEF,2BAA2B;QAC3B,gFAAgF;QAChF,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1E,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7E,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/E,MAAM,eAAe,GACnB,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACxD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC7E,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;oBAChD,OAAO;wBACL,UAAU,EAAE,OAAO;wBACnB,QAAQ,EAAE,EAAE;wBACZ,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE;qBAC3D,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACpE,GAAG,CAAC,aAAa,EAAE,EAAE,EAAE,qBAAqB,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAChF,CAAC;QAED,0DAA0D;QAC1D,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,aAAa,EAAE,CAAC,EAAE,uDAAuD,EAAE,KAAK,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAClF,yCAAyC;YACzC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC/D,GAAG,CAAC,aAAa,EAAE,CAAC,EAAE,oDAAoD,EAAE,KAAK,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAED,iCAAiC;QACjC,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAClC,8CAA8C;YAC9C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,aAAa,EAAE,CAAC,EAAE,mCAAmC,EAAE,KAAK,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,aAAa,EAAE,CAAC,EAAE,yCAAyC,EAAE,KAAK,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAED,+BAA+B;QAC/B,MAAM,gBAAgB,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAClF,MAAM,eAAe,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,IAAI,gBAAgB,EAAE,CAAC;YACrB,GAAG,CAAC,cAAc,EAAE,CAAC,EAAE,uBAAuB,gBAAgB,EAAE,EAAE,KAAK,CAAC,CAAC;QAC3E,CAAC;aAAM,IAAI,eAAe,EAAE,CAAC;YAC3B,GAAG,CAAC,cAAc,EAAE,CAAC,EAAE,yCAAyC,EAAE,KAAK,CAAC,CAAC;QAC3E,CAAC;QAED,kCAAkC;QAClC,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1E,GAAG,CAAC,YAAY,EAAE,CAAC,EAAE,0BAA0B,UAAU,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QACrF,CAAC;QAED,wCAAwC;QACxC,IAAI,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YAC5F,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,GAAG,CACD,aAAa,EACb,CAAC,EACD,qEAAqE,EACrE,KAAK,CACN,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,mCAAmC;gBACnC,GAAG,CAAC,aAAa,EAAE,CAAC,EAAE,gDAAgD,EAAE,KAAK,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,cAAc,EAAE,CAAC,EAAE,qDAAqD,EAAE,KAAK,CAAC,CAAC;QACvF,CAAC;QAED,0DAA0D;QAC1D,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;YAC7E,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,GAAG,CACD,cAAc,EACd,CAAC,EACD,8DAA8D,EAC9D,KAAK,CACN,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC3C,CAAC;IAEO,eAAe,CAAC,KAAa;QACnC,4CAA4C;QAC5C,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,SAAS,GAAG,EAAE,CAAC;QAEnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,IAAI,EAAE,CAAC;gBACd,IAAI,EAAE,KAAK,SAAS;oBAAE,OAAO,GAAG,KAAK,CAAC;YACxC,CAAC;iBAAM,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACpC,OAAO,IAAI,EAAE,CAAC;gBACd,OAAO,GAAG,IAAI,CAAC;gBACf,SAAS,GAAG,EAAE,CAAC;YACjB,CAAC;iBAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACtB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;gBAC/B,IAAI,OAAO;oBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACjC,OAAO,GAAG,EAAE,CAAC;YACf,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/analyzers/text.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"text.d.ts","sourceRoot":"","sources":["../../src/analyzers/text.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAmB,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3E;;;;GAIG;AACH,qBAAa,YAAa,YAAW,QAAQ;IAC3C,QAAQ,CAAC,UAAU,EAAG,MAAM,CAAU;IAEtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAW;IACxC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAW;IACnD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAW;IACjD,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAW;IACpD,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAW;IACpD,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAW;IACnD,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAW;IACvD,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAW;IACnD,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAW;IACtD,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAW;IACnD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAW;IAClD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAW;gBAEtC,QAAQ,EAAE,mBAAmB;IA6BzC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc;IA2FtC;;;OAGG;IACH,OAAO,CAAC,uBAAuB;CAUhC"}
+{"version":3,"file":"text.d.ts","sourceRoot":"","sources":["../../src/analyzers/text.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAmB,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3E;;;;GAIG;AACH,qBAAa,YAAa,YAAW,QAAQ;IAC3C,QAAQ,CAAC,UAAU,EAAG,MAAM,CAAU;IAEtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAW;IACxC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAW;IACnD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAW;IACjD,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAW;IACpD,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAW;IACpD,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAW;IACnD,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAW;IACvD,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAW;IACnD,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAW;IACtD,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAW;IACnD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAW;IAClD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAW;gBAEtC,QAAQ,EAAE,mBAAmB;IAiCzC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc;IAgJtC;;;OAGG;IACH,OAAO,CAAC,uBAAuB;CAmBhC"}

package/dist/analyzers/text.js

@@ -49,7 +49,11 @@ export class TextAnalyzer {
     analyze(value) {
         const text = value.trim();
         if (!text) {
-            return { actionType: 'text', findings: [], shortCircuit: { safe: true, reason: 'Empty text' } };
+            return {
+                actionType: 'text',
+                findings: [],
+                shortCircuit: { safe: true, reason: 'Empty text' },
+            };
         }
         const lower = text.toLowerCase();
         const findings = [];
@@ -58,7 +62,11 @@ export class TextAnalyzer {
         };
         // ── Short-circuit safe: educational content about prompt injection ──
         if (this.safePatterns.some((p) => lower.includes(p))) {
-            return { actionType: 'text', findings: [], shortCircuit: { safe: true, reason: 'Educational content about prompt injection' } };
+            return {
+                actionType: 'text',
+                findings: [],
+                shortCircuit: { safe: true, reason: 'Educational content about prompt injection' },
+            };
         }
         // ── 1. Direct injection (P01) ──────────────────────────────────────
         if (this.directInjectionPatterns.some((p) => lower.includes(p))) {
@@ -132,7 +140,16 @@ export class TextAnalyzer {
             return false;
         // Check for common instruction words near non-Latin text
         const lower = text.toLowerCase();
-        const instructionKeywords = ['ignore', 'execute', 'run', 'delete', 'send', 'override', 'system', 'admin'];
+        const instructionKeywords = [
+            'ignore',
+            'execute',
+            'run',
+            'delete',
+            'send',
+            'override',
+            'system',
+            'admin',
+        ];
         return instructionKeywords.some((kw) => lower.includes(kw));
     }
 }

package/dist/analyzers/text.js.map

@@ -1 +1 @@
-{"version":3,"file":"text.js","sourceRoot":"","sources":["../../src/analyzers/text.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,MAAM,OAAO,YAAY;IACd,UAAU,GAAG,MAAe,CAAC;IAErB,YAAY,CAAW;IACvB,uBAAuB,CAAW;IAClC,qBAAqB,CAAW;IAChC,wBAAwB,CAAW;IACnC,wBAAwB,CAAW;IACnC,uBAAuB,CAAW;IAClC,2BAA2B,CAAW;IACtC,uBAAuB,CAAW;IAClC,0BAA0B,CAAW;IACrC,uBAAuB,CAAW;IAClC,sBAAsB,CAAW;IACjC,sBAAsB,CAAW;IAElD,YAAY,QAA6B;QACvC,sDAAsD;QACtD,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,uBAAuB,GAAG,QAAQ,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,qBAAqB,GAAG,QAAQ,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,wBAAwB,GAAG,QAAQ,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,2BAA2B,GAAG,QAAQ,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,uBAAuB,GAAG,QAAQ,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,0BAA0B,GAAG,QAAQ,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAClG,IAAI,CAAC,uBAAuB,GAAG,QAAQ,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,sBAAsB,GAAG,QAAQ,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,sBAAsB,GAAG,QAAQ,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAE1F,2EAA2E;QAC3E,IAAI,CAAC,wBAAwB,GAAG,EAAE,CAAC;QACnC,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,wBAAwB,EAAE,CAAC;YAClD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,IAAI,CAAC;oBACH,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBACxD,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;gBACtD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,KAAa;QACnB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC;QAClG,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAsB,EAAE,CAAC;QAEvC,MAAM,GAAG,GAAG,CAAC,SAAuC,EAAE,KAAa,EAAE,MAAc,EAAE,QAAiB,EAAE,EAAE;YACxG,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC;QAEF,uEAAuE;QACvE,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,4CAA4C,EAAE,EAAE,CAAC;QAClI,CAAC;QAED,sEAAsE;QACtE,IAAI,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,cAAc,EAAE,CAAC,EAAE,oEAAoE,EAAE,KAAK,CAAC,CAAC;QACtG,CAAC;QAED,sEAAsE;QACtE,IAAI,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,cAAc,EAAE,CAAC,EAAE,qDAAqD,EAAE,KAAK,CAAC,CAAC;QACvF,CAAC;QAED,sEAAsE;QACtE,MAAM,kBAAkB,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACxF,MAAM,iBAAiB,GAAG,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACjF,IAAI,kBAAkB,IAAI,iBAAiB,EAAE,CAAC;YAC5C,GAAG,CAAC,aAAa,EAAE,CAAC,EAAE,qEAAqE,EAAE,KAAK,CAAC,CAAC;QACtG,CAAC;QAED,qEAAqE;QACrE,IAAI,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,cAAc,EAAE,CAAC,EAAE,yDAAyD,EAAE,KAAK,CAAC,CAAC;QAC3F,CAAC;QAED,oEAAoE;QACpE,IAAI,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,mDAAmD;YACnD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,cAAc,EAAE,CAAC,EAAE,2DAA2D,EAAE,KAAK,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,IAAI,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,cAAc,EAAE,CAAC,EAAE,gEAAgE,EAAE,KAAK,CAAC,CAAC;QAClG,CAAC;QAED,qEAAqE;QACrE,MAAM,SAAS,GAAG,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,MAAM,YAAY,GAAG,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7D,IAAI,SAAS,IAAI,YAAY,EAAE,CAAC;YAC9B,GAAG,CAAC,cAAc,EAAE,CAAC,EAAE,sEAAsE,EAAE,KAAK,CAAC,CAAC;QACxG,CAAC;QAED,qEAAqE;QACrE,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,cAAc,EAAE,CAAC,EAAE,0EAA0E,EAAE,KAAK,CAAC,CAAC;QAC5G,CAAC;QAED,qEAAqE;QACrE,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YACvB,+DAA+D;YAC/D,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,0BAA0B,EAAE,CAAC;gBACxD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;gBACjF,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACnC,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;oBACnC,GAAG,CAAC,cAAc,EAAE,CAAC,EAAE,gEAAgE,EAAE,KAAK,CAAC,CAAC;oBAChG,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,aAAa,EAAE,CAAC,EAAE,iEAAiE,EAAE,KAAK,CAAC,CAAC;QAClG,CAAC;QAED,qEAAqE;QACrE,IAAI,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,cAAc,EAAE,CAAC,EAAE,+DAA+D,EAAE,KAAK,CAAC,CAAC;QACjG,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACK,uBAAuB,CAAC,IAAY;QAC1C,gDAAgD;QAChD,MAAM,WAAW,GAAG,wDAAwD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxF,IAAI,CAAC,WAAW;YAAE,OAAO,KAAK,CAAC;QAE/B,yDAAyD;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1G,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC;CACF"}
+{"version":3,"file":"text.js","sourceRoot":"","sources":["../../src/analyzers/text.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,MAAM,OAAO,YAAY;IACd,UAAU,GAAG,MAAe,CAAC;IAErB,YAAY,CAAW;IACvB,uBAAuB,CAAW;IAClC,qBAAqB,CAAW;IAChC,wBAAwB,CAAW;IACnC,wBAAwB,CAAW;IACnC,uBAAuB,CAAW;IAClC,2BAA2B,CAAW;IACtC,uBAAuB,CAAW;IAClC,0BAA0B,CAAW;IACrC,uBAAuB,CAAW;IAClC,sBAAsB,CAAW;IACjC,sBAAsB,CAAW;IAElD,YAAY,QAA6B;QACvC,sDAAsD;QACtD,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,uBAAuB,GAAG,QAAQ,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,qBAAqB,GAAG,QAAQ,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,wBAAwB,GAAG,QAAQ,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,2BAA2B,GAAG,QAAQ,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAChF,CAAC,CAAC,WAAW,EAAE,CAChB,CAAC;QACF,IAAI,CAAC,uBAAuB,GAAG,QAAQ,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,0BAA0B,GAAG,QAAQ,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9E,CAAC,CAAC,WAAW,EAAE,CAChB,CAAC;QACF,IAAI,CAAC,uBAAuB,GAAG,QAAQ,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,sBAAsB,GAAG,QAAQ,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,sBAAsB,GAAG,QAAQ,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAE1F,2EAA2E;QAC3E,IAAI,CAAC,wBAAwB,GAAG,EAAE,CAAC;QACnC,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,wBAAwB,EAAE,CAAC;YAClD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,IAAI,CAAC;oBACH,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBACxD,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;gBACtD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,KAAa;QACnB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;gBACL,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,EAAE;gBACZ,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE;aACnD,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAsB,EAAE,CAAC;QAEvC,MAAM,GAAG,GAAG,CACV,SAAuC,EACvC,KAAa,EACb,MAAc,EACd,QAAiB,EACjB,EAAE;YACF,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC;QAEF,uEAAuE;QACvE,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO;gBACL,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,EAAE;gBACZ,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,4CAA4C,EAAE;aACnF,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,IAAI,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CACD,cAAc,EACd,CAAC,EACD,oEAAoE,EACpE,KAAK,CACN,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,IAAI,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,cAAc,EAAE,CAAC,EAAE,qDAAqD,EAAE,KAAK,CAAC,CAAC;QACvF,CAAC;QAED,sEAAsE;QACtE,MAAM,kBAAkB,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACxF,MAAM,iBAAiB,GAAG,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACjF,IAAI,kBAAkB,IAAI,iBAAiB,EAAE,CAAC;YAC5C,GAAG,CACD,aAAa,EACb,CAAC,EACD,qEAAqE,EACrE,KAAK,CACN,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,IAAI,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,cAAc,EAAE,CAAC,EAAE,yDAAyD,EAAE,KAAK,CAAC,CAAC;QAC3F,CAAC;QAED,oEAAoE;QACpE,IAAI,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,mDAAmD;YACnD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,cAAc,EAAE,CAAC,EAAE,2DAA2D,EAAE,KAAK,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,IAAI,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CACD,cAAc,EACd,CAAC,EACD,gEAAgE,EAChE,KAAK,CACN,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,MAAM,SAAS,GAAG,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,MAAM,YAAY,GAAG,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7D,IAAI,SAAS,IAAI,YAAY,EAAE,CAAC;YAC9B,GAAG,CACD,cAAc,EACd,CAAC,EACD,sEAAsE,EACtE,KAAK,CACN,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CACD,cAAc,EACd,CAAC,EACD,0EAA0E,EAC1E,KAAK,CACN,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YACvB,+DAA+D;YAC/D,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,0BAA0B,EAAE,CAAC;gBACxD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;gBACjF,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACnC,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;oBACnC,GAAG,CACD,cAAc,EACd,CAAC,EACD,gEAAgE,EAChE,KAAK,CACN,CAAC;oBACF,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CACD,aAAa,EACb,CAAC,EACD,iEAAiE,EACjE,KAAK,CACN,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,IAAI,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,GAAG,CACD,cAAc,EACd,CAAC,EACD,+DAA+D,EAC/D,KAAK,CACN,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACK,uBAAuB,CAAC,IAAY;QAC1C,gDAAgD;QAChD,MAAM,WAAW,GAAG,wDAAwD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxF,IAAI,CAAC,WAAW;YAAE,OAAO,KAAK,CAAC;QAE/B,yDAAyD;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,mBAAmB,GAAG;YAC1B,QAAQ;YACR,SAAS;YACT,KAAK;YACL,QAAQ;YACR,MAAM;YACN,UAAU;YACV,QAAQ;YACR,OAAO;SACR,CAAC;QACF,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC;CACF"}

package/dist/analyzers/transaction.d.ts

@@ -0,0 +1,23 @@
+import type { TransactionPatternDatabase } from '@surfinguard/types';
+import type { Analyzer, AnalyzerResult } from './base.js';
+/**
+ * Transaction Analyzer — detects dangerous financial transaction patterns.
+ *
+ * Detects 6 threat patterns (T01-T06) mapped to 3 risk primitives.
+ * Input: value = transaction description/API call, metadata = { amount?, currency?, recipient?, type? }
+ */
+export declare class TransactionAnalyzer implements Analyzer {
+    readonly actionType: "transaction";
+    private readonly paymentEndpoints;
+    private readonly transferPatterns;
+    private readonly cryptoPatterns;
+    private readonly tradingPatterns;
+    private readonly subscriptionPatterns;
+    private readonly pricingPatterns;
+    private readonly safePatterns;
+    private readonly highRiskAmountThreshold;
+    constructor(patterns: TransactionPatternDatabase);
+    analyze(value: string, metadata?: Record<string, unknown>): AnalyzerResult;
+    private hasActivePattern;
+}
+//# sourceMappingURL=transaction.d.ts.map

package/dist/analyzers/transaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transaction.d.ts","sourceRoot":"","sources":["../../src/analyzers/transaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAmB,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3E;;;;;GAKG;AACH,qBAAa,mBAAoB,YAAW,QAAQ;IAClD,QAAQ,CAAC,UAAU,EAAG,aAAa,CAAU;IAE7C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAW;IAC5C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAW;IAC5C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAW;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAW;IAC3C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAW;IAChD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAW;IAC3C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAW;IACxC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAS;gBAErC,QAAQ,EAAE,0BAA0B;IAWhD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,cAAc;IA8F1E,OAAO,CAAC,gBAAgB;CAWzB"}

package/dist/analyzers/transaction.js

@@ -0,0 +1,100 @@
+/**
+ * Transaction Analyzer — detects dangerous financial transaction patterns.
+ *
+ * Detects 6 threat patterns (T01-T06) mapped to 3 risk primitives.
+ * Input: value = transaction description/API call, metadata = { amount?, currency?, recipient?, type? }
+ */
+export class TransactionAnalyzer {
+    actionType = 'transaction';
+    paymentEndpoints;
+    transferPatterns;
+    cryptoPatterns;
+    tradingPatterns;
+    subscriptionPatterns;
+    pricingPatterns;
+    safePatterns;
+    highRiskAmountThreshold;
+    constructor(patterns) {
+        this.paymentEndpoints = patterns.paymentEndpoints.map((p) => new RegExp(p, 'i'));
+        this.transferPatterns = patterns.transferPatterns.map((p) => new RegExp(p, 'i'));
+        this.cryptoPatterns = patterns.cryptoPatterns.map((p) => new RegExp(p, 'i'));
+        this.tradingPatterns = patterns.tradingPatterns.map((p) => new RegExp(p, 'i'));
+        this.subscriptionPatterns = patterns.subscriptionPatterns.map((p) => new RegExp(p, 'i'));
+        this.pricingPatterns = patterns.pricingPatterns.map((p) => new RegExp(p, 'i'));
+        this.safePatterns = patterns.safePatterns.map((p) => new RegExp(p, 'i'));
+        this.highRiskAmountThreshold = patterns.highRiskAmountThreshold;
+    }
+    analyze(value, metadata) {
+        const description = value.trim();
+        if (!description) {
+            return {
+                actionType: 'transaction',
+                findings: [],
+                shortCircuit: { safe: true, reason: 'Empty description' },
+            };
+        }
+        const amount = metadata?.amount ?? undefined;
+        const txType = (metadata?.type ?? '').toLowerCase();
+        const lower = description.toLowerCase();
+        // Safe short-circuit: read-only patterns
+        if (this.safePatterns.some((p) => p.test(lower)) && !this.hasActivePattern(lower)) {
+            return {
+                actionType: 'transaction',
+                findings: [],
+                shortCircuit: { safe: true, reason: 'Safe read-only transaction pattern' },
+            };
+        }
+        const findings = [];
+        const add = (primitive, score, reason, threatId) => {
+            findings.push({ primitive, score, reason, threatId });
+        };
+        // ── T01: Unauthorized purchase ──
+        if (this.paymentEndpoints.some((p) => p.test(lower)) || txType === 'purchase') {
+            add('DESTRUCTION', 8, 'Unauthorized purchase — agent creating a charge or payment', 'T01');
+        }
+        // ── T02: Money transfer ──
+        const hasTransfer = this.transferPatterns.some((p) => p.test(lower));
+        const hasCryptoTransfer = this.cryptoPatterns.some((p) => p.test(lower));
+        if ((hasTransfer || hasCryptoTransfer) && !this.tradingPatterns.some((p) => p.test(lower))) {
+            add('EXFILTRATION', 9, 'Money transfer — agent transferring funds or cryptocurrency', 'T02');
+        }
+        // ── T03: Invoice approval ──
+        if (/approve.*invoice|confirm.*payment|authorize.*payment/i.test(lower)) {
+            add('MANIPULATION', 7, 'Invoice approval — agent approving invoices or confirming payments', 'T03');
+        }
+        // ── T04: Service subscription ──
+        if (this.subscriptionPatterns.some((p) => p.test(lower)) || txType === 'subscription') {
+            add('DESTRUCTION', 6, 'Service subscription — agent creating recurring subscription', 'T04');
+        }
+        // ── T05: Stock/crypto trading ──
+        const hasTrading = this.tradingPatterns.some((p) => p.test(lower));
+        const hasCryptoTrading = hasCryptoTransfer && /swap|trade|buy|sell/i.test(lower);
+        if (hasTrading || hasCryptoTrading || txType === 'trade') {
+            add('DESTRUCTION', 9, 'Stock/crypto trading — agent executing trades', 'T05');
+        }
+        // ── T06: Pricing/billing modification ──
+        if (this.pricingPatterns.some((p) => p.test(lower))) {
+            add('DESTRUCTION', 8, 'Pricing/billing modification — agent changing pricing or billing', 'T06');
+        }
+        // ── Amount boost ──
+        if (amount !== undefined && findings.length > 0) {
+            if (amount > 1000) {
+                add('DESTRUCTION', 3, `High amount: ${amount} — significantly above threshold`, 'T01');
+            }
+            else if (amount > this.highRiskAmountThreshold) {
+                add('DESTRUCTION', 2, `Amount ${amount} exceeds risk threshold of ${this.highRiskAmountThreshold}`, 'T01');
+            }
+        }
+        return { actionType: 'transaction', findings };
+    }
+    hasActivePattern(text) {
+        return (this.paymentEndpoints.some((p) => p.test(text)) ||
+            this.transferPatterns.some((p) => p.test(text)) ||
+            this.cryptoPatterns.some((p) => p.test(text)) ||
+            this.tradingPatterns.some((p) => p.test(text)) ||
+            this.subscriptionPatterns.some((p) => p.test(text)) ||
+            this.pricingPatterns.some((p) => p.test(text)) ||
+            /approve.*invoice|confirm.*payment|authorize.*payment/i.test(text));
+    }
+}
+//# sourceMappingURL=transaction.js.map

package/dist/analyzers/transaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transaction.js","sourceRoot":"","sources":["../../src/analyzers/transaction.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,MAAM,OAAO,mBAAmB;IACrB,UAAU,GAAG,aAAsB,CAAC;IAE5B,gBAAgB,CAAW;IAC3B,gBAAgB,CAAW;IAC3B,cAAc,CAAW;IACzB,eAAe,CAAW;IAC1B,oBAAoB,CAAW;IAC/B,eAAe,CAAW;IAC1B,YAAY,CAAW;IACvB,uBAAuB,CAAS;IAEjD,YAAY,QAAoC;QAC9C,IAAI,CAAC,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,oBAAoB,GAAG,QAAQ,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,uBAAuB,GAAG,QAAQ,CAAC,uBAAuB,CAAC;IAClE,CAAC;IAED,OAAO,CAAC,KAAa,EAAE,QAAkC;QACvD,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;gBACL,UAAU,EAAE,aAAa;gBACzB,QAAQ,EAAE,EAAE;gBACZ,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE;aAC1D,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAI,QAAQ,EAAE,MAAiB,IAAI,SAAS,CAAC;QACzD,MAAM,MAAM,GAAG,CAAE,QAAQ,EAAE,IAAe,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAChE,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;QAExC,yCAAyC;QACzC,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YAClF,OAAO;gBACL,UAAU,EAAE,aAAa;gBACzB,QAAQ,EAAE,EAAE;gBACZ,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,oCAAoC,EAAE;aAC3E,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,CACV,SAAuC,EACvC,KAAa,EACb,MAAc,EACd,QAAgB,EAChB,EAAE;YACF,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC;QAEF,mCAAmC;QACnC,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC9E,GAAG,CAAC,aAAa,EAAE,CAAC,EAAE,4DAA4D,EAAE,KAAK,CAAC,CAAC;QAC7F,CAAC;QAED,4BAA4B;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,MAAM,iBAAiB,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,WAAW,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,cAAc,EAAE,CAAC,EAAE,6DAA6D,EAAE,KAAK,CAAC,CAAC;QAC/F,CAAC;QAED,8BAA8B;QAC9B,IAAI,uDAAuD,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,GAAG,CACD,cAAc,EACd,CAAC,EACD,oEAAoE,EACpE,KAAK,CACN,CAAC;QACJ,CAAC;QAED,kCAAkC;QAClC,IAAI,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;YACtF,GAAG,CAAC,aAAa,EAAE,CAAC,EAAE,8DAA8D,EAAE,KAAK,CAAC,CAAC;QAC/F,CAAC;QAED,kCAAkC;QAClC,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACnE,MAAM,gBAAgB,GAAG,iBAAiB,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjF,IAAI,UAAU,IAAI,gBAAgB,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACzD,GAAG,CAAC,aAAa,EAAE,CAAC,EAAE,+CAA+C,EAAE,KAAK,CAAC,CAAC;QAChF,CAAC;QAED,0CAA0C;QAC1C,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACpD,GAAG,CACD,aAAa,EACb,CAAC,EACD,kEAAkE,EAClE,KAAK,CACN,CAAC;QACJ,CAAC;QAED,qBAAqB;QACrB,IAAI,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,IAAI,MAAM,GAAG,IAAI,EAAE,CAAC;gBAClB,GAAG,CAAC,aAAa,EAAE,CAAC,EAAE,gBAAgB,MAAM,kCAAkC,EAAE,KAAK,CAAC,CAAC;YACzF,CAAC;iBAAM,IAAI,MAAM,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;gBACjD,GAAG,CACD,aAAa,EACb,CAAC,EACD,UAAU,MAAM,8BAA8B,IAAI,CAAC,uBAAuB,EAAE,EAC5E,KAAK,CACN,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;IACjD,CAAC;IAEO,gBAAgB,CAAC,IAAY;QACnC,OAAO,CACL,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC,CACnE,CAAC;IACJ,CAAC;CACF"}

package/dist/analyzers/ui-action.d.ts

@@ -0,0 +1,23 @@
+import type { UiActionPatternDatabase } from '@surfinguard/types';
+import type { Analyzer, AnalyzerResult } from './base.js';
+/**
+ * UI Action Analyzer — detects dangerous browser/UI interactions.
+ *
+ * Detects 6 threat patterns (UI01-UI06) mapped to 3 risk primitives.
+ * Input: value = UI action description, metadata = { element?, url?, application? }
+ */
+export declare class UiActionAnalyzer implements Analyzer {
+    readonly actionType: "ui_action";
+    private readonly destructiveButtonPatterns;
+    private readonly formCorruptionPatterns;
+    private readonly dialogAcceptancePatterns;
+    private readonly paymentFormPatterns;
+    private readonly maliciousDownloadPatterns;
+    private readonly screenCapturePatterns;
+    private readonly sensitiveElements;
+    private readonly safePatterns;
+    constructor(patterns: UiActionPatternDatabase);
+    analyze(value: string, metadata?: Record<string, unknown>): AnalyzerResult;
+    private hasDangerousPattern;
+}
+//# sourceMappingURL=ui-action.d.ts.map

package/dist/analyzers/ui-action.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui-action.d.ts","sourceRoot":"","sources":["../../src/analyzers/ui-action.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,KAAK,EAAE,QAAQ,EAAmB,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3E;;;;;GAKG;AACH,qBAAa,gBAAiB,YAAW,QAAQ;IAC/C,QAAQ,CAAC,UAAU,EAAG,WAAW,CAAU;IAE3C,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAW;IACrD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAW;IAClD,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAW;IACpD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAW;IAC/C,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAW;IACrD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAW;IACjD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAW;IAC7C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAW;gBAE5B,QAAQ,EAAE,uBAAuB;IAiB7C,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,cAAc;IAkG1E,OAAO,CAAC,mBAAmB;CAU5B"}

package/dist/analyzers/ui-action.js

@@ -0,0 +1,92 @@
+/**
+ * UI Action Analyzer — detects dangerous browser/UI interactions.
+ *
+ * Detects 6 threat patterns (UI01-UI06) mapped to 3 risk primitives.
+ * Input: value = UI action description, metadata = { element?, url?, application? }
+ */
+export class UiActionAnalyzer {
+    actionType = 'ui_action';
+    destructiveButtonPatterns;
+    formCorruptionPatterns;
+    dialogAcceptancePatterns;
+    paymentFormPatterns;
+    maliciousDownloadPatterns;
+    screenCapturePatterns;
+    sensitiveElements;
+    safePatterns;
+    constructor(patterns) {
+        this.destructiveButtonPatterns = patterns.destructiveButtonPatterns.map((p) => new RegExp(p, 'i'));
+        this.formCorruptionPatterns = patterns.formCorruptionPatterns.map((p) => new RegExp(p, 'i'));
+        this.dialogAcceptancePatterns = patterns.dialogAcceptancePatterns.map((p) => new RegExp(p, 'i'));
+        this.paymentFormPatterns = patterns.paymentFormPatterns.map((p) => new RegExp(p, 'i'));
+        this.maliciousDownloadPatterns = patterns.maliciousDownloadPatterns.map((p) => new RegExp(p, 'i'));
+        this.screenCapturePatterns = patterns.screenCapturePatterns.map((p) => new RegExp(p, 'i'));
+        this.sensitiveElements = patterns.sensitiveElements.map((p) => new RegExp(p, 'i'));
+        this.safePatterns = patterns.safePatterns.map((p) => new RegExp(p, 'i'));
+    }
+    analyze(value, metadata) {
+        const action = value.trim();
+        if (!action) {
+            return {
+                actionType: 'ui_action',
+                findings: [],
+                shortCircuit: { safe: true, reason: 'Empty action' },
+            };
+        }
+        const lower = action.toLowerCase();
+        const element = (metadata?.element ?? '').toLowerCase();
+        const combined = `${lower} ${element}`;
+        // Safe short-circuit
+        if (this.safePatterns.some((p) => p.test(lower)) && !this.hasDangerousPattern(lower)) {
+            return {
+                actionType: 'ui_action',
+                findings: [],
+                shortCircuit: { safe: true, reason: 'Safe UI action' },
+            };
+        }
+        const findings = [];
+        const add = (primitive, score, reason, threatId) => {
+            findings.push({ primitive, score, reason, threatId });
+        };
+        const hasSensitive = this.sensitiveElements.some((p) => p.test(combined));
+        // ── UI01: Destructive button click ──
+        if (this.destructiveButtonPatterns.some((p) => p.test(combined))) {
+            const score = hasSensitive ? 10 : 8;
+            add('DESTRUCTION', score, 'Destructive button click — agent clicking delete/wipe/destroy controls', 'UI01');
+        }
+        // ── UI02: Form data corruption ──
+        if (this.formCorruptionPatterns.some((p) => p.test(combined))) {
+            const score = hasSensitive ? 9 : 7;
+            add('MANIPULATION', score, 'Form data corruption — agent manipulating form inputs', 'UI02');
+        }
+        // ── UI03: Dialog auto-acceptance ──
+        if (this.dialogAcceptancePatterns.some((p) => p.test(combined))) {
+            const score = hasSensitive ? 10 : 8;
+            add('DESTRUCTION', score, 'Dialog auto-acceptance — agent auto-confirming destructive dialogs', 'UI03');
+        }
+        // ── UI04: Payment form submission ──
+        if (this.paymentFormPatterns.some((p) => p.test(combined))) {
+            const score = hasSensitive ? 10 : 8;
+            add('DESTRUCTION', score, 'Payment form submission — agent interacting with payment/checkout forms', 'UI04');
+        }
+        // ── UI05: Malicious file download+open ──
+        if (this.maliciousDownloadPatterns.some((p) => p.test(combined))) {
+            add('DESTRUCTION', 8, 'Malicious file download — agent downloading and executing files', 'UI05');
+        }
+        // ── UI06: Screen/clipboard capture ──
+        if (this.screenCapturePatterns.some((p) => p.test(combined))) {
+            const score = hasSensitive ? 10 : 8;
+            add('EXFILTRATION', score, 'Screen/clipboard capture — agent capturing sensitive screen data', 'UI06');
+        }
+        return { actionType: 'ui_action', findings };
+    }
+    hasDangerousPattern(text) {
+        return (this.destructiveButtonPatterns.some((p) => p.test(text)) ||
+            this.formCorruptionPatterns.some((p) => p.test(text)) ||
+            this.dialogAcceptancePatterns.some((p) => p.test(text)) ||
+            this.paymentFormPatterns.some((p) => p.test(text)) ||
+            this.maliciousDownloadPatterns.some((p) => p.test(text)) ||
+            this.screenCapturePatterns.some((p) => p.test(text)));
+    }
+}
+//# sourceMappingURL=ui-action.js.map

package/dist/analyzers/ui-action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui-action.js","sourceRoot":"","sources":["../../src/analyzers/ui-action.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,MAAM,OAAO,gBAAgB;IAClB,UAAU,GAAG,WAAoB,CAAC;IAE1B,yBAAyB,CAAW;IACpC,sBAAsB,CAAW;IACjC,wBAAwB,CAAW;IACnC,mBAAmB,CAAW;IAC9B,yBAAyB,CAAW;IACpC,qBAAqB,CAAW;IAChC,iBAAiB,CAAW;IAC5B,YAAY,CAAW;IAExC,YAAY,QAAiC;QAC3C,IAAI,CAAC,yBAAyB,GAAG,QAAQ,CAAC,yBAAyB,CAAC,GAAG,CACrE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAC1B,CAAC;QACF,IAAI,CAAC,sBAAsB,GAAG,QAAQ,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7F,IAAI,CAAC,wBAAwB,GAAG,QAAQ,CAAC,wBAAwB,CAAC,GAAG,CACnE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAC1B,CAAC;QACF,IAAI,CAAC,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,yBAAyB,GAAG,QAAQ,CAAC,yBAAyB,CAAC,GAAG,CACrE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAC1B,CAAC;QACF,IAAI,CAAC,qBAAqB,GAAG,QAAQ,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3F,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,CAAC,KAAa,EAAE,QAAkC;QACvD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,UAAU,EAAE,WAAW;gBACvB,QAAQ,EAAE,EAAE;gBACZ,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE;aACrD,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,CAAE,QAAQ,EAAE,OAAkB,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAG,GAAG,KAAK,IAAI,OAAO,EAAE,CAAC;QAEvC,qBAAqB;QACrB,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YACrF,OAAO;gBACL,UAAU,EAAE,WAAW;gBACvB,QAAQ,EAAE,EAAE;gBACZ,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE;aACvD,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,CACV,SAAuC,EACvC,KAAa,EACb,MAAc,EACd,QAAgB,EAChB,EAAE;YACF,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC;QAEF,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE1E,uCAAuC;QACvC,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACpC,GAAG,CACD,aAAa,EACb,KAAK,EACL,wEAAwE,EACxE,MAAM,CACP,CAAC;QACJ,CAAC;QAED,mCAAmC;QACnC,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,uDAAuD,EAAE,MAAM,CAAC,CAAC;QAC9F,CAAC;QAED,qCAAqC;QACrC,IAAI,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACpC,GAAG,CACD,aAAa,EACb,KAAK,EACL,oEAAoE,EACpE,MAAM,CACP,CAAC;QACJ,CAAC;QAED,sCAAsC;QACtC,IAAI,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC3D,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACpC,GAAG,CACD,aAAa,EACb,KAAK,EACL,yEAAyE,EACzE,MAAM,CACP,CAAC;QACJ,CAAC;QAED,2CAA2C;QAC3C,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CACD,aAAa,EACb,CAAC,EACD,iEAAiE,EACjE,MAAM,CACP,CAAC;QACJ,CAAC;QAED,uCAAuC;QACvC,IAAI,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACpC,GAAG,CACD,cAAc,EACd,KAAK,EACL,kEAAkE,EAClE,MAAM,CACP,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAEO,mBAAmB,CAAC,IAAY;QACtC,OAAO,CACL,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrD,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACrD,CAAC;IACJ,CAAC;CACF"}

package/dist/analyzers/url.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../../src/analyzers/url.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAc,MAAM,oBAAoB,CAAC;AAC/F,OAAO,KAAK,EAAE,QAAQ,EAAmB,cAAc,EAAE,MAAM,WAAW,CAAC;AAK3E;;;;;GAKG;AACH,qBAAa,WAAY,YAAW,QAAQ;IAC1C,QAAQ,CAAC,UAAU,EAAG,KAAK,CAAU;IAErC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAc;IAC7C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAc;IAC5C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAc;IACzC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAc;IACnD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAc;IACxC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAc;IAChD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAW;IAC5C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAW;IAChD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAW;IAC5C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAc;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;gBAE1B,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,oBAAoB;IAchF,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc;IAgNtC,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,WAAW;IAQnB,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,uBAAuB;IAY/B,OAAO,CAAC,uBAAuB;IA8B/B,OAAO,CAAC,gBAAgB;IAyBxB,OAAO,CAAC,eAAe;CAgBxB"}
+{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../../src/analyzers/url.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAc,MAAM,oBAAoB,CAAC;AAC/F,OAAO,KAAK,EAAE,QAAQ,EAAmB,cAAc,EAAE,MAAM,WAAW,CAAC;AAK3E;;;;;GAKG;AACH,qBAAa,WAAY,YAAW,QAAQ;IAC1C,QAAQ,CAAC,UAAU,EAAG,KAAK,CAAU;IAErC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAc;IAC7C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAc;IAC5C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAc;IACzC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAc;IACnD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAc;IACxC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAc;IAChD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAW;IAC5C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAW;IAChD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAW;IAC5C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAc;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;gBAE1B,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,oBAAoB;IAchF,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc;IAuOtC,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,WAAW;IAQnB,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,uBAAuB;IAY/B,OAAO,CAAC,uBAAuB;IAiC/B,OAAO,CAAC,gBAAgB;IAyBxB,OAAO,CAAC,eAAe;CAgBxB"}

package/dist/analyzers/url.js

@@ -72,7 +72,8 @@ export class UrlAnalyzer {
         }
         // ── HIGH SEVERITY (5-8 pts) ───────────────────────────────────────
         // @ symbol in URL (credential theft / URL obfuscation)
-        if (trimmedUrl.includes('@') && trimmedUrl.substring(0, trimmedUrl.indexOf('@')).includes('://')) {
+        if (trimmedUrl.includes('@') &&
+            trimmedUrl.substring(0, trimmedUrl.indexOf('@')).includes('://')) {
             add('MANIPULATION', 6, "URL uses '@' to disguise real destination", 'U05');
         }
         // IP address instead of domain
@@ -263,7 +264,10 @@ export class UrlAnalyzer {
                 continue;
             // Check for obvious typosquatting variants
             if (brand.variants.some((v) => normalizedHost.includes(v))) {
-                return { score: 7, reason: `Possible impersonation of ${brand.brand} (suspicious spelling)` };
+                return {
+                    score: 7,
+                    reason: `Possible impersonation of ${brand.brand} (suspicious spelling)`,
+                };
             }
             // Check if brand name appears on non-official domain
             if (normalizedHost.includes(brand.brand)) {