@tokenoftrust/storefront-runner 1.4.2-rc.0 → 2.0.0

package/packages/public-runtime/src/integration/lifecycle-runtime.ts

@@ -0,0 +1,393 @@
+/**
+ * The browser-side integration lifecycle RUNTIME (ADR 0014 invariant 9, S1/S2;
+ * ext-kernel-05). This is the orchestrator that fulfils the {@link IntegrationLifecycleModule}
+ * contract at runtime: it initializes every integration exactly once per traditional
+ * document, delivers in-place `update`s (consent change, config change, rollback),
+ * disposes on teardown, isolates one integration's error from the others and from the
+ * page, and owns the reserved completed-navigation event — the single semantic seam a
+ * FUTURE client router must emit through, gated by the event contract before any router
+ * exists.
+ *
+ * The core is DOM-free and dependency-injected (a module loader, an event sink, a clock,
+ * an id factory, an observer), so it is edge-safe and fully testable in node; the thin
+ * browser binding that wires it to `window`/`document` lives in
+ * `./lifecycle-boot.ts` and is a guarded no-op off the browser.
+ */
+import type {
+  IntegrationLifecycleModule,
+  LifecycleUpdateReason,
+  IntegrationLifecycleContext,
+  IntegrationEventSubscribe,
+} from "./lifecycle.js";
+import { LIFECYCLE_UPDATE_REASONS } from "./lifecycle.js";
+import type { CommerceEventType } from "./events.js";
+import type { CommerceEventBroker } from "./commerce-broker.js";
+import type { IntegrationBootDescriptor, BootDescriptorIntegration } from "./render-phases.js";
+import type { NavigationCompletedEvent, NavigationKind } from "./events.js";
+import { validateNavigationCompletedEvent } from "./events.js";
+import { COMMERCE_EVENT_STOREFRONT_SCHEMA_VERSION, ENVIRONMENT_SCHEMA_VERSION } from "./version.js";
+import type { BrowserEnvironment } from "./environment.js";
+import type { ConsentSnapshot } from "./consent-broker.js";
+import { defaultConsentSnapshot } from "./consent-broker.js";
+
+/**
+ * A fail-closed {@link BrowserEnvironment} to hand `init`/`update` contexts when
+ * no environment was injected (a DOM-free test, or a document whose
+ * `__TOT_INTEGRATION_ENV__` global is absent/tampered): reuse the descriptor's
+ * own resolved stage/surface — already server-derived fail-closed (never
+ * spuriously `live`) — with an empty host/revision.
+ */
+export function defaultBrowserEnvironment(descriptor: IntegrationBootDescriptor): BrowserEnvironment {
+  return Object.freeze({
+    schemaVersion: ENVIRONMENT_SCHEMA_VERSION,
+    siteSurface: descriptor.siteSurface,
+    environment: descriptor.environment,
+    canonicalHost: "",
+    revision: "",
+  });
+}
+
+/** Loads the entry module for one integration. Injected so the core stays DOM/asset free. */
+export type IntegrationModuleLoader = (
+  integration: BootDescriptorIntegration,
+) => Promise<IntegrationLifecycleModule>;
+
+/**
+ * The lifecycle stage an observation belongs to. `load` is the module-fetch step
+ * before `init`; `gate` is a consent deferral — a non-essential integration held
+ * back because its declared purposes are not yet eligible (it never loaded).
+ */
+export type LifecycleStage = "gate" | "load" | "init" | "update" | "dispose";
+
+/**
+ * A structured, non-sensitive lifecycle signal for observability. It names WHICH
+ * integration and WHAT happened — never a payload, stack, or secret: `error` is a
+ * message string only, so an observation can never leak candidate wrappers or tokens.
+ */
+export interface LifecycleObservation {
+  stage: LifecycleStage;
+  integration: BootDescriptorIntegration;
+  ok: boolean;
+  reason?: LifecycleUpdateReason;
+  error?: string;
+}
+
+export type LifecycleObserver = (observation: LifecycleObservation) => void;
+
+/** The completed-navigation the runtime is told about — the seam a future router calls. */
+export interface NavigationInput {
+  from: string;
+  to: string;
+  kind: NavigationKind;
+  /** An aborted navigation never completed, so it emits no event (fail closed). */
+  aborted?: boolean;
+}
+
+export interface IntegrationLifecycleOptions {
+  descriptor: IntegrationBootDescriptor;
+  loadModule: IntegrationModuleLoader;
+  /**
+   * The consent gate consulted BEFORE an integration's entry is loaded: `false`
+   * holds it back until its declared purposes become eligible, so a non-essential
+   * loader never runs under the default-deny snapshot (ext-policy-03). Absent ⇒ no
+   * gate (every integration loads) — the injection the browser binding always
+   * supplies, kept optional only so the DOM-free core stays testable in isolation.
+   * A held-back integration is (re-)evaluated on the next `update` and loads then.
+   */
+  isEligible?: (integration: BootDescriptorIntegration) => boolean;
+  /**
+   * Emits the reserved completed-navigation event. This is the ONLY navigation seam;
+   * the runtime hands it a CONTRACT-VALIDATED {@link NavigationCompletedEvent} and never
+   * an ad-hoc bus message, so a future router cannot ship an untyped navigation signal.
+   */
+  emitNavigation?: (event: NavigationCompletedEvent) => void;
+  observe?: LifecycleObserver;
+  /**
+   * The renderer-owned four-stage browser environment for this document — handed
+   * to every integration's `init`/`update` {@link IntegrationLifecycleContext} verbatim.
+   * Absent ⇒ {@link defaultBrowserEnvironment} (fail closed), the injection the
+   * browser binding always supplies from `__TOT_INTEGRATION_ENV__`.
+   */
+  environment?: BrowserEnvironment;
+  /**
+   * Reads the CURRENT consent snapshot, called fresh for every `init`/`update` so a
+   * consent change is reflected immediately in the handed {@link IntegrationLifecycleContext}.
+   * Absent ⇒ the default-deny snapshot (fail closed) — the injection the browser
+   * binding always supplies, kept optional only so the DOM-free core stays testable.
+   */
+  getConsentSnapshot?: () => ConsentSnapshot;
+  /**
+   * The platform-owned commerce-event broker whose scoped, receive-only subscribe
+   * handle is placed on every integration's {@link IntegrationLifecycleContext} (F2
+   * wire). When present, an entry that declared at least one browser-deliverable event
+   * can subscribe to it — bounded to its declared set and consent-filtered by the
+   * broker. Absent ⇒ no `subscribe` on the context (fail closed to no delivery), the
+   * shape a DOM-free unit test uses when it wires no broker.
+   */
+  commerceBroker?: CommerceEventBroker;
+  /** ISO-8601 timestamp source for the navigation event; defaults to wall clock. */
+  now?: () => string;
+  /** Opaque per-event id source; defaults to a monotonic, non-secret local counter. */
+  nextEventId?: () => string;
+}
+
+/** The document-scoped state machine. Init is exactly-once; dispose is terminal. */
+type LifecycleState = "idle" | "initializing" | "initialized" | "disposing" | "disposed";
+
+/** A live, initialized integration and the module handle its update/dispose route to. */
+interface ActiveIntegration {
+  integration: BootDescriptorIntegration;
+  module: IntegrationLifecycleModule;
+}
+
+function messageOf(error: unknown): string {
+  if (error instanceof Error) return error.message;
+  return typeof error === "string" ? error : "unknown error";
+}
+
+/**
+ * Reduce a navigation URL to the PUBLIC surface a completed-navigation event may carry:
+ * the pathname only (plus the fragment for a hash navigation, where the fragment IS the
+ * destination). The query string is dropped entirely — that is where preview/candidate
+ * wrappers and tokens live — and the origin is dropped as non-identifying. The result is
+ * still secret-scanned by {@link validateNavigationCompletedEvent} as defense in depth.
+ */
+export function sanitizeNavigationUrl(raw: string, keepHash: boolean): string {
+  let pathname = raw;
+  let hash = "";
+  try {
+    const url = new URL(raw, "https://storefront.invalid");
+    pathname = url.pathname;
+    hash = url.hash;
+  } catch {
+    // A non-URL string: strip any query/fragment tail by hand, keep the leading path.
+    const q = raw.indexOf("?");
+    const h = raw.indexOf("#");
+    const cut = [q, h].filter((i) => i >= 0).sort((a, b) => a - b)[0];
+    if (h >= 0) hash = raw.slice(h);
+    pathname = cut === undefined ? raw : raw.slice(0, cut);
+  }
+  return keepHash ? pathname + hash : pathname;
+}
+
+export class IntegrationLifecycle {
+  private state: LifecycleState = "idle";
+  private readonly active: ActiveIntegration[] = [];
+  /** Integrations held back by the consent gate; re-evaluated on each `update`. */
+  private deferred: BootDescriptorIntegration[] = [];
+  private eventCounter = 0;
+  private readonly opts: IntegrationLifecycleOptions;
+
+  constructor(options: IntegrationLifecycleOptions) {
+    this.opts = options;
+  }
+
+  /** True once init has completed and dispose has not yet run. */
+  get isInitialized(): boolean {
+    return this.state === "initialized";
+  }
+
+  /**
+   * Initialize every integration EXACTLY ONCE per document, in the plan's resolved order.
+   * A second call — including one from a nested layout that re-runs the boot island — is a
+   * no-op, and a call after dispose is a no-op. Each integration's load+init is isolated:
+   * a thrown loader or a thrown `init()` is caught, observed, and does not stop the
+   * remaining integrations or surface to the page.
+   */
+  async init(): Promise<void> {
+    if (this.state !== "idle") return;
+    this.state = "initializing";
+    for (const integration of this.opts.descriptor.integrations) {
+      if (!this.eligible(integration)) {
+        // Consent precedes the loader: hold it back, do not load, and record why.
+        this.deferred.push(integration);
+        this.observe({ stage: "gate", integration, ok: false });
+        continue;
+      }
+      await this.initOne(integration);
+    }
+    // A dispose that raced in during an await leaves us terminal; otherwise we are live.
+    if (this.state === "initializing") this.state = "initialized";
+  }
+
+  /** Whether the consent gate (when injected) permits loading this integration now. */
+  private eligible(integration: BootDescriptorIntegration): boolean {
+    return this.opts.isEligible ? this.opts.isEligible(integration) : true;
+  }
+
+  /**
+   * Load any consent-deferred integration that has since become eligible, in the
+   * plan's resolved order. Called from `update` so a consent grant loads the
+   * previously-gated entry (once), rather than re-initializing anything already live.
+   */
+  private async loadNewlyEligible(): Promise<void> {
+    if (this.deferred.length === 0) return;
+    const stillDeferred: BootDescriptorIntegration[] = [];
+    for (const integration of this.deferred) {
+      if (this.eligible(integration)) await this.initOne(integration);
+      else stillDeferred.push(integration);
+    }
+    this.deferred = stillDeferred;
+  }
+
+  private async initOne(integration: BootDescriptorIntegration): Promise<void> {
+    let module: IntegrationLifecycleModule;
+    try {
+      module = await this.opts.loadModule(integration);
+    } catch (error) {
+      this.observe({ stage: "load", integration, ok: false, error: messageOf(error) });
+      return;
+    }
+    if (this.state === "disposing" || this.state === "disposed") return; // torn down mid-load: do not init.
+    try {
+      await module.init(this.buildContext(integration));
+      this.active.push({ integration, module });
+      this.observe({ stage: "init", integration, ok: true });
+    } catch (error) {
+      this.observe({ stage: "init", integration, ok: false, error: messageOf(error) });
+    }
+  }
+
+  /**
+   * Build the typed context handed to `init`/`update`: this integration's own
+   * resolved public config (never another integration's), the document's
+   * environment, and the current consent snapshot (read fresh so `update`
+   * reflects the latest state). Frozen so no entry can mutate what the runtime
+   * or any other integration observes.
+   */
+  private buildContext(integration: BootDescriptorIntegration): IntegrationLifecycleContext {
+    return Object.freeze({
+      appId: integration.appId,
+      tenantPublicId: this.opts.descriptor.tenantPublicId,
+      config: { ...(this.opts.descriptor.publicConfig[integration.appId] ?? {}) },
+      environment: this.opts.environment ?? defaultBrowserEnvironment(this.opts.descriptor),
+      consent: this.opts.getConsentSnapshot ? this.opts.getConsentSnapshot() : defaultConsentSnapshot(),
+      subscribe: this.buildSubscribe(integration),
+    });
+  }
+
+  /**
+   * Build this integration's scoped, receive-only commerce-event subscribe handle
+   * (F2 wire). Returns `undefined` — no `subscribe` on the context — when no broker is
+   * wired or the integration declared no events, so an entry that cannot legitimately
+   * receive anything is handed no handle at all (fail closed).
+   *
+   * The handle CANNOT emit and CANNOT widen scope: the runtime clamps every requested
+   * type to the intersection with the integration's validated declared set, and pins
+   * the subscription to one stable, per-entry id so a re-subscribe REPLACES rather than
+   * stacks. Consent filtering and server-owned stamping stay entirely inside the broker.
+   */
+  private buildSubscribe(integration: BootDescriptorIntegration): IntegrationEventSubscribe | undefined {
+    const broker = this.opts.commerceBroker;
+    const declared = integration.events ?? [];
+    if (!broker || declared.length === 0) return undefined;
+    const declaredSet = new Set<CommerceEventType>(declared);
+    return (request) => {
+      const scoped: CommerceEventType[] = request.types
+        ? request.types.filter((type) => declaredSet.has(type))
+        : [...declared];
+      return broker.subscribe({
+        // One stable slot per entry — a re-subscribe replaces it (broker semantics),
+        // so a vendor cannot register unbounded listeners.
+        id: `entry:${integration.appId}`,
+        types: scoped,
+        consentPurpose: request.consentPurpose,
+        sink: request.sink,
+      });
+    };
+  }
+
+  /**
+   * Deliver an in-place `update(reason)` to every initialized integration that implements
+   * it. Used for a consent change, a config change, or a rollback — never a re-init. A no-op
+   * before init or after dispose. One integration's throwing `update` is isolated.
+   */
+  async update(reason: LifecycleUpdateReason): Promise<void> {
+    if (!LIFECYCLE_UPDATE_REASONS.includes(reason)) return;
+    if (this.state !== "initialized") return;
+    // A consent/config change may make a gated integration eligible: load it now
+    // (init), then deliver the update only to integrations that were already live —
+    // a just-loaded entry gets `init`, not an immediate redundant `update`.
+    const alreadyActive = [...this.active];
+    await this.loadNewlyEligible();
+    for (const { integration, module } of alreadyActive) {
+      if (!module.update) continue;
+      try {
+        await module.update(reason, this.buildContext(integration));
+        this.observe({ stage: "update", integration, ok: true, reason });
+      } catch (error) {
+        this.observe({ stage: "update", integration, ok: false, reason, error: messageOf(error) });
+      }
+    }
+  }
+
+  /**
+   * Dispose every initialized integration on teardown. Idempotent — a second dispose is a
+   * no-op — and terminal: after it, `update` and a late `init` do nothing. One integration's
+   * throwing `dispose` is isolated; every other integration is still disposed.
+   */
+  async dispose(): Promise<void> {
+    if (this.state === "disposed" || this.state === "disposing") return;
+    this.state = "disposing";
+    for (const { integration, module } of this.active) {
+      if (!module.dispose) continue;
+      try {
+        await module.dispose();
+        this.observe({ stage: "dispose", integration, ok: true });
+      } catch (error) {
+        this.observe({ stage: "dispose", integration, ok: false, error: messageOf(error) });
+      }
+    }
+    this.active.length = 0;
+    this.deferred = []; // gated integrations never loaded — nothing to dispose.
+    this.state = "disposed";
+  }
+
+  /**
+   * Announce a completed navigation through the reserved event contract. This is the
+   * router seam: it BUILDS a {@link NavigationCompletedEvent}, VALIDATES it against the
+   * versioned contract (which strips nothing but rejects any candidate wrapper/token that
+   * slipped through), and only then emits. An aborted navigation, or one that fails
+   * validation, emits nothing (fail closed). It never re-initializes integrations — in an
+   * MPA a real document load re-inits by construction; a same-document navigation does not.
+   */
+  notifyNavigationCompleted(nav: NavigationInput): NavigationCompletedEvent | null {
+    if (nav.aborted) return null;
+    const keepHash = nav.kind === "hash";
+    const event: NavigationCompletedEvent = {
+      specversion: "1.0",
+      id: this.newEventId(),
+      source: `//${this.opts.descriptor.tenantPublicId}`,
+      type: "storefront.navigation.completed.v1",
+      time: this.now(),
+      storefront: {
+        schemaVersion: COMMERCE_EVENT_STOREFRONT_SCHEMA_VERSION,
+        environment: this.opts.descriptor.environment,
+        siteSurface: this.opts.descriptor.siteSurface,
+      },
+      data: {
+        from: sanitizeNavigationUrl(nav.from, keepHash),
+        to: sanitizeNavigationUrl(nav.to, keepHash),
+        kind: nav.kind,
+      },
+    };
+    const result = validateNavigationCompletedEvent(event);
+    if (!result.ok) return null;
+    this.opts.emitNavigation?.(result.value);
+    return result.value;
+  }
+
+  private now(): string {
+    return this.opts.now ? this.opts.now() : new Date().toISOString();
+  }
+
+  private newEventId(): string {
+    if (this.opts.nextEventId) return this.opts.nextEventId();
+    this.eventCounter += 1;
+    return `nav-${this.opts.descriptor.planRevision}-${this.eventCounter}`;
+  }
+
+  private observe(observation: LifecycleObservation): void {
+    this.opts.observe?.(observation);
+  }
+}

package/packages/public-runtime/src/integration/lifecycle.ts

@@ -0,0 +1,94 @@
+/**
+ * The MPA integration lifecycle contract (ADR 0014 invariant 9, S1/S2).
+ *
+ * Existing multi-page-app behavior is the baseline: an integration entry
+ * initializes exactly once per traditional document, may be updated (e.g. on a
+ * consent change or rollback), and is disposed on teardown. The reserved
+ * completed-navigation event (`storefront.navigation.completed.v1`, defined in
+ * ./events.ts) is the versioned contract that must ship before any client
+ * router is enabled — this file names the lifecycle hooks and update reasons
+ * that engine (ext-kernel-05) implements against.
+ */
+import type { BrowserEnvironment } from "./environment.js";
+import type { ConsentSnapshot } from "./consent-broker.js";
+import type { CommerceEventType } from "./events.js";
+import type { CommerceEventSink } from "./commerce-broker.js";
+import type { ConsentPurpose } from "../integration-capabilities.js";
+
+/** The three lifecycle hooks an integration entry module fulfills. */
+export const LIFECYCLE_HOOKS = ["init", "update", "dispose"] as const;
+export type LifecycleHook = (typeof LIFECYCLE_HOOKS)[number];
+
+/** Why an already-initialized integration is updated in place rather than re-initialized. */
+export const LIFECYCLE_UPDATE_REASONS = [
+  "consent-changed",
+  "config-changed",
+  "rollback",
+] as const;
+export type LifecycleUpdateReason = (typeof LIFECYCLE_UPDATE_REASONS)[number];
+
+/**
+ * What an entry hands its scoped subscribe handle: the delivery sink, an optional
+ * narrowing to a SUBSET of the events its manifest declared, and the consent purpose
+ * its destination depends on. The handle is RECEIVE-ONLY — an entry gets no `emit`
+ * power — and the runtime clamps `types` to the integration's validated declared set,
+ * so a vendor can neither widen its subscription nor author an event.
+ */
+export interface IntegrationEventSubscribeRequest {
+  /** Where the delivered, contract-validated events go (in-page callback or a sandboxed iframe). */
+  sink: CommerceEventSink;
+  /** Narrow to a subset of this integration's declared events; omitted ⇒ every declared event. A type outside the declared set is dropped, never widened to. */
+  types?: readonly CommerceEventType[];
+  /** The consent purpose the destination requires; the broker withholds delivery until it is eligible (default-deny). */
+  consentPurpose?: ConsentPurpose;
+}
+
+/**
+ * The scoped commerce-event subscribe handle on the lifecycle context (design-partner
+ * finding F2 wire): register a receive-only subscription bounded to this integration's
+ * declared events, returning an unsubscribe. A re-subscribe REPLACES the prior
+ * registration (broker semantics), so an entry cannot stack unbounded listeners.
+ * Absent from the context when the host wired no broker (e.g. a DOM-free unit test).
+ */
+export type IntegrationEventSubscribe = (
+  request: IntegrationEventSubscribeRequest,
+) => () => void;
+
+/**
+ * The typed, frozen context `init`/`update` receive — sourced from the SAME
+ * renderer-published globals (`__TOT_INTEGRATION_PLAN__`, `__TOT_INTEGRATION_ENV__`,
+ * `__TOT_INTEGRATION_CONSENT__`) an entry previously had to reach into by hand, so
+ * an integration never string-matches a `window` global. Carries public values
+ * only — no candidate wrapper, token, nonce, or secret — consistent with the plan
+ * and event contracts.
+ */
+export interface IntegrationLifecycleContext {
+  /** This integration's own id, matching its manifest/plan `appId`. */
+  appId: string;
+  /** Server-resolved tenant identity from the validated boot descriptor. */
+  tenantPublicId: string;
+  /** This integration's own resolved public config (the plan's `publicConfig[appId]`). */
+  config: Record<string, unknown>;
+  /** The renderer-owned four-stage browser environment for this document. */
+  environment: BrowserEnvironment;
+  /** The current consent snapshot; read fresh for every `init`/`update` call. */
+  consent: ConsentSnapshot;
+  /**
+   * A receive-only, declared-scoped commerce-event subscribe handle (F2 wire). Present
+   * when the host wired a broker AND this integration declared at least one event; a
+   * vendor subscribes to its post-purchase (or other declared) signal through this,
+   * instead of reaching for raw emit power. Absent otherwise (fail closed to no delivery).
+   */
+  subscribe?: IntegrationEventSubscribe;
+}
+
+/**
+ * The shape of the module an entry asset exports. Init runs once per document;
+ * update/dispose are optional. Handlers receive only browser-safe context — no
+ * candidate wrapper or token — consistent with the plan and event contracts.
+ */
+export interface IntegrationLifecycleModule {
+  init(ctx: IntegrationLifecycleContext): void | Promise<void>;
+  update?(reason: LifecycleUpdateReason, ctx: IntegrationLifecycleContext): void | Promise<void>;
+  dispose?(): void | Promise<void>;
+}

package/packages/public-runtime/src/integration/managed-analytics-api-v1-safety.d.mts

@@ -0,0 +1,2 @@
+export const MANAGED_ANALYTICS_SECRET_VALUE_PATTERN: string;
+export const MANAGED_ANALYTICS_PII_VALUE_PATTERN: string;

package/packages/public-runtime/src/integration/managed-analytics-api-v1-safety.mjs

@@ -0,0 +1,10 @@
+/**
+ * Shared value-canary sources for the managed analytics runtime and JSON Schema.
+ * Plain JavaScript lets the TypeScript runtime and the Node schema generator
+ * consume one flag-free ECMAScript pattern without mirroring definitions.
+ */
+export const MANAGED_ANALYTICS_SECRET_VALUE_PATTERN =
+  "(?:-----BEGIN(?: [A-Z]+)? PRIVATE KEY-----|\\bAKIA[0-9A-Z]{16}\\b|\\bsk-proj-[A-Za-z0-9_-]{8,}\\b|\\bsk-[A-Za-z0-9_-]{20,}\\b|\\b(?:sk|rk)_(?:live|test|prod)_[A-Za-z0-9_-]{8,}\\b|\\b(?:gh[pousr]_|github_pat_)[A-Za-z0-9_]{20,}\\b|\\b(?:npm_|glpat-)[A-Za-z0-9_.-]{8,}\\b|\\bxox[baprs]-[A-Za-z0-9-]{10,}\\b|\\bAIza[A-Za-z0-9_-]{20,}\\b|\\bSG\\.[A-Za-z0-9_.-]{8,}\\b|\\b(?:[Ss]ecret|[Pp]assword|[Cc]redential)[_-][A-Za-z0-9_-]{4,}\\b|\\b[Bb]earer\\s+[A-Za-z0-9._~+/-]{12,}={0,2}\\b|\\beyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]+\\b|\\b(?:api[_ -]?[Kk]ey|client[_ -]?[Ss]ecret|[Pp]assword|[Cc]redential|private[_ -]?[Kk]ey)\\s*[:=]\\s*\\S+)";
+
+export const MANAGED_ANALYTICS_PII_VALUE_PATTERN =
+  "(?:[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}|\\b[0-9]{3}-[0-9]{2}-[0-9]{4}\\b|\\b(?:[0-9][ -]?){13,19}\\b|(?:^|[^0-9])(?:\\+?1[ .-]?)?(?:\\([2-9][0-9]{2}\\)|[2-9][0-9]{2})[ .-]?[0-9]{3}[ .-]?[0-9]{4}(?=$|[^0-9]))";