@develler/remediation-agent 1.0.2

package/dist/types/instructions.d.ts

@@ -0,0 +1,58 @@
+import type { MaskStrategy, MatchType, WireKeyPattern, WireRuntimeInstructionPayload } from './wireProtocol.js';
+import type { Request } from 'express';
+export declare class MaskRule {
+    readonly ruleId: string;
+    readonly key: string;
+    readonly matchType: MatchType;
+    readonly maskStrategy: MaskStrategy;
+    readonly pattern: string | null;
+    readonly maskChar: string;
+    readonly separator: string;
+    constructor(ruleId: string, key: string, matchType: MatchType, maskStrategy: MaskStrategy, pattern: string | null, maskChar: string, separator: string);
+    static fromWire(kp: WireKeyPattern, ruleId: string): MaskRule;
+    matchesKey(key: string): boolean;
+}
+export interface RouteBlock {
+    readonly blockedRoutes: Array<{
+        method: string;
+        path: string;
+    }>;
+    readonly responseStatus: number;
+    readonly responseBody: Record<string, unknown>;
+}
+export declare class RuntimeInstruction {
+    readonly instructionId: string;
+    readonly instructionType: string;
+    readonly priority: number;
+    readonly effectiveAt: number;
+    readonly expiresAt: number;
+    readonly includeRoutes: string[];
+    readonly excludeRoutes: string[];
+    readonly httpMethods: string[];
+    readonly maskRules: MaskRule[];
+    readonly routeBlocks: RouteBlock[];
+    readonly injectHeaders: Record<string, string>;
+    readonly rulesChecksum: string;
+    constructor(instructionId: string, instructionType: string, priority: number, effectiveAt: number, expiresAt: number, includeRoutes: string[], excludeRoutes: string[], httpMethods: string[], maskRules: MaskRule[], routeBlocks: RouteBlock[], injectHeaders: Record<string, string>, rulesChecksum: string);
+    static fromWirePayload(payload: WireRuntimeInstructionPayload): RuntimeInstruction;
+    private static extractRule;
+    isExpired(): boolean;
+    isEffective(): boolean;
+    toJSON(): Record<string, unknown>;
+    static fromJSON(raw: Record<string, unknown>): RuntimeInstruction;
+}
+export declare class InstructionCollection {
+    private readonly instructions;
+    constructor(instructions: RuntimeInstruction[]);
+    static empty(): InstructionCollection;
+    isEmpty(): boolean;
+    maskRules(): MaskRule[];
+    hasMaskRules(): boolean;
+    /** Merged headers; lower priority number wins on key conflict. */
+    injectHeaders(): Record<string, string>;
+    /** First matching route-block config, or null. */
+    matchingRouteBlock(req: Request): RouteBlock | null;
+    private sortedByPriority;
+    private routeMatches;
+}
+//# sourceMappingURL=instructions.d.ts.map

package/dist/types/instructions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instructions.d.ts","sourceRoot":"","sources":["../../src/types/instructions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,6BAA6B,EAAY,MAAM,mBAAmB,CAAC;AAC1H,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAMvC,qBAAa,QAAQ;aAED,MAAM,EAAQ,MAAM;aACpB,GAAG,EAAW,MAAM;aACpB,SAAS,EAAK,SAAS;aACvB,YAAY,EAAE,YAAY;aAC1B,OAAO,EAAO,MAAM,GAAG,IAAI;aAC3B,QAAQ,EAAM,MAAM;aACpB,SAAS,EAAK,MAAM;gBANpB,MAAM,EAAQ,MAAM,EACpB,GAAG,EAAW,MAAM,EACpB,SAAS,EAAK,SAAS,EACvB,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAO,MAAM,GAAG,IAAI,EAC3B,QAAQ,EAAM,MAAM,EACpB,SAAS,EAAK,MAAM;IAGtC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ;IAY7D,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;CAajC;AAMD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,aAAa,EAAI,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,QAAQ,CAAC,cAAc,EAAG,MAAM,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnD;AAMD,qBAAa,kBAAkB;aAEX,aAAa,EAAI,MAAM;aACvB,eAAe,EAAE,MAAM;aACvB,QAAQ,EAAS,MAAM;aACvB,WAAW,EAAM,MAAM;aACvB,SAAS,EAAQ,MAAM;aACvB,aAAa,EAAI,MAAM,EAAE;aACzB,aAAa,EAAI,MAAM,EAAE;aACzB,WAAW,EAAM,MAAM,EAAE;aACzB,SAAS,EAAQ,QAAQ,EAAE;aAC3B,WAAW,EAAM,UAAU,EAAE;aAC7B,aAAa,EAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;aACvC,aAAa,EAAI,MAAM;gBAXvB,aAAa,EAAI,MAAM,EACvB,eAAe,EAAE,MAAM,EACvB,QAAQ,EAAS,MAAM,EACvB,WAAW,EAAM,MAAM,EACvB,SAAS,EAAQ,MAAM,EACvB,aAAa,EAAI,MAAM,EAAE,EACzB,aAAa,EAAI,MAAM,EAAE,EACzB,WAAW,EAAM,MAAM,EAAE,EACzB,SAAS,EAAQ,QAAQ,EAAE,EAC3B,WAAW,EAAM,UAAU,EAAE,EAC7B,aAAa,EAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACvC,aAAa,EAAI,MAAM;IAGzC,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,6BAA6B,GAAG,kBAAkB;IA2BlF,OAAO,CAAC,MAAM,CAAC,WAAW;IA+B1B,SAAS,IAAI,OAAO;IAIpB,WAAW,IAAI,OAAO;IAKtB,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAyBjC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,kBAAkB;CA6BlE;AAMD,qBAAa,qBAAqB;IACpB,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAAZ,YAAY,EAAE,kBAAkB,EAAE;IAE/D,MAAM,CAAC,KAAK,IAAI,qBAAqB;IAIrC,OAAO,IAAI,OAAO;IAIlB,SAAS,IAAI,QAAQ,EAAE;IAIvB,YAAY,IAAI,OAAO;IAIvB,kEAAkE;IAClE,aAAa,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAQvC,kDAAkD;IAClD,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,GAAG,IAAI;IAanD,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,YAAY;CAQrB"}

package/dist/types/instructions.js

@@ -0,0 +1,203 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InstructionCollection = exports.RuntimeInstruction = exports.MaskRule = void 0;
+// ---------------------------------------------------------------------------
+// MaskRule — parsed, strongly typed version of WireKeyPattern
+// ---------------------------------------------------------------------------
+class MaskRule {
+    ruleId;
+    key;
+    matchType;
+    maskStrategy;
+    pattern;
+    maskChar;
+    separator;
+    constructor(ruleId, key, matchType, maskStrategy, pattern, maskChar, separator) {
+        this.ruleId = ruleId;
+        this.key = key;
+        this.matchType = matchType;
+        this.maskStrategy = maskStrategy;
+        this.pattern = pattern;
+        this.maskChar = maskChar;
+        this.separator = separator;
+    }
+    static fromWire(kp, ruleId) {
+        return new MaskRule(ruleId, kp.key, kp.match_type, kp.mask_strategy, kp.pattern, kp.mask_char, kp.separator);
+    }
+    matchesKey(key) {
+        if (this.matchType === 'exact') {
+            return this.key === key;
+        }
+        if (this.matchType === 'regex' && this.pattern !== null) {
+            try {
+                return new RegExp(this.pattern).test(key);
+            }
+            catch {
+                return false;
+            }
+        }
+        return false;
+    }
+}
+exports.MaskRule = MaskRule;
+// ---------------------------------------------------------------------------
+// RuntimeInstruction — parsed, validated, serialisable
+// ---------------------------------------------------------------------------
+class RuntimeInstruction {
+    instructionId;
+    instructionType;
+    priority;
+    effectiveAt;
+    expiresAt;
+    includeRoutes;
+    excludeRoutes;
+    httpMethods;
+    maskRules;
+    routeBlocks;
+    injectHeaders;
+    rulesChecksum;
+    constructor(instructionId, instructionType, priority, effectiveAt, expiresAt, includeRoutes, excludeRoutes, httpMethods, maskRules, routeBlocks, injectHeaders, rulesChecksum) {
+        this.instructionId = instructionId;
+        this.instructionType = instructionType;
+        this.priority = priority;
+        this.effectiveAt = effectiveAt;
+        this.expiresAt = expiresAt;
+        this.includeRoutes = includeRoutes;
+        this.excludeRoutes = excludeRoutes;
+        this.httpMethods = httpMethods;
+        this.maskRules = maskRules;
+        this.routeBlocks = routeBlocks;
+        this.injectHeaders = injectHeaders;
+        this.rulesChecksum = rulesChecksum;
+    }
+    static fromWirePayload(payload) {
+        const maskRules = [];
+        const routeBlocks = [];
+        let injectHeaders = {};
+        for (const rule of payload.rules) {
+            RuntimeInstruction.extractRule(rule, maskRules, routeBlocks, (h) => {
+                injectHeaders = { ...injectHeaders, ...h };
+            });
+        }
+        return new RuntimeInstruction(payload.instruction_id, payload.instruction_type, payload.priority, payload.effective_at, payload.expires_at, payload.targets.routes.include, payload.targets.routes.exclude, payload.targets.http_methods, maskRules, routeBlocks, injectHeaders, payload.checksum);
+    }
+    static extractRule(rule, maskRules, routeBlocks, onHeaders) {
+        const config = rule.config;
+        switch (rule.rule_type) {
+            case 'pii_mask': {
+                const patterns = config['key_patterns'] ?? [];
+                for (const kp of patterns) {
+                    maskRules.push(MaskRule.fromWire(kp, rule.rule_id));
+                }
+                break;
+            }
+            case 'route_block': {
+                routeBlocks.push({
+                    blockedRoutes: config['blocked_routes'] ?? [],
+                    responseStatus: config['response_status'] ?? 503,
+                    responseBody: config['response_body'] ?? { error: 'Service temporarily unavailable.' },
+                });
+                break;
+            }
+            case 'header_inject': {
+                onHeaders(config['headers'] ?? {});
+                break;
+            }
+        }
+    }
+    isExpired() {
+        return Date.now() / 1000 > this.expiresAt;
+    }
+    isEffective() {
+        const now = Date.now() / 1000;
+        return now >= this.effectiveAt && !this.isExpired();
+    }
+    toJSON() {
+        return {
+            instruction_id: this.instructionId,
+            instruction_type: this.instructionType,
+            priority: this.priority,
+            effective_at: this.effectiveAt,
+            expires_at: this.expiresAt,
+            include_routes: this.includeRoutes,
+            exclude_routes: this.excludeRoutes,
+            http_methods: this.httpMethods,
+            mask_rules: this.maskRules.map((r) => ({
+                rule_id: r.ruleId,
+                key: r.key,
+                match_type: r.matchType,
+                mask_strategy: r.maskStrategy,
+                pattern: r.pattern,
+                mask_char: r.maskChar,
+                separator: r.separator,
+            })),
+            route_blocks: this.routeBlocks,
+            inject_headers: this.injectHeaders,
+            checksum: this.rulesChecksum,
+        };
+    }
+    static fromJSON(raw) {
+        const maskRules = (raw['mask_rules'] ?? []).map((r) => {
+            const m = r;
+            return new MaskRule(String(m['rule_id'] ?? ''), String(m['key'] ?? ''), (m['match_type'] ?? 'exact'), (m['mask_strategy'] ?? 'full_redact'), m['pattern'] != null ? String(m['pattern']) : null, String(m['mask_char'] ?? 'X'), String(m['separator'] ?? '-'));
+        });
+        return new RuntimeInstruction(String(raw['instruction_id'] ?? ''), String(raw['instruction_type'] ?? ''), Number(raw['priority'] ?? 100), Number(raw['effective_at'] ?? 0), Number(raw['expires_at'] ?? 0), raw['include_routes'] ?? ['*'], raw['exclude_routes'] ?? [], raw['http_methods'] ?? [], maskRules, raw['route_blocks'] ?? [], raw['inject_headers'] ?? {}, String(raw['checksum'] ?? ''));
+    }
+}
+exports.RuntimeInstruction = RuntimeInstruction;
+// ---------------------------------------------------------------------------
+// InstructionCollection — the aggregate queried by the middleware on every request
+// ---------------------------------------------------------------------------
+class InstructionCollection {
+    instructions;
+    constructor(instructions) {
+        this.instructions = instructions;
+    }
+    static empty() {
+        return new InstructionCollection([]);
+    }
+    isEmpty() {
+        return this.instructions.length === 0;
+    }
+    maskRules() {
+        return this.sortedByPriority().flatMap((i) => i.maskRules);
+    }
+    hasMaskRules() {
+        return this.maskRules().length > 0;
+    }
+    /** Merged headers; lower priority number wins on key conflict. */
+    injectHeaders() {
+        const headers = {};
+        for (const instruction of this.sortedByPriority()) {
+            Object.assign(headers, instruction.injectHeaders);
+        }
+        return headers;
+    }
+    /** First matching route-block config, or null. */
+    matchingRouteBlock(req) {
+        for (const instruction of this.sortedByPriority()) {
+            for (const block of instruction.routeBlocks) {
+                for (const route of block.blockedRoutes) {
+                    if (this.routeMatches(req, route.method, route.path)) {
+                        return block;
+                    }
+                }
+            }
+        }
+        return null;
+    }
+    sortedByPriority() {
+        return [...this.instructions].sort((a, b) => a.priority - b.priority);
+    }
+    routeMatches(req, method, pattern) {
+        if (req.method.toUpperCase() !== method.toUpperCase())
+            return false;
+        // Simple glob-style matching via regex conversion
+        const regexStr = pattern
+            .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+            .replace(/\*/g, '.*');
+        return new RegExp(`^${regexStr}$`).test(req.path.replace(/^\//, ''));
+    }
+}
+exports.InstructionCollection = InstructionCollection;
+//# sourceMappingURL=instructions.js.map

package/dist/types/instructions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instructions.js","sourceRoot":"","sources":["../../src/types/instructions.ts"],"names":[],"mappings":";;;AAGA,8EAA8E;AAC9E,8DAA8D;AAC9D,8EAA8E;AAE9E,MAAa,QAAQ;IAED;IACA;IACA;IACA;IACA;IACA;IACA;IAPlB,YACkB,MAAoB,EACpB,GAAoB,EACpB,SAAuB,EACvB,YAA0B,EAC1B,OAA2B,EAC3B,QAAoB,EACpB,SAAoB;QANpB,WAAM,GAAN,MAAM,CAAc;QACpB,QAAG,GAAH,GAAG,CAAiB;QACpB,cAAS,GAAT,SAAS,CAAc;QACvB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,YAAO,GAAP,OAAO,CAAoB;QAC3B,aAAQ,GAAR,QAAQ,CAAY;QACpB,cAAS,GAAT,SAAS,CAAW;IACnC,CAAC;IAEJ,MAAM,CAAC,QAAQ,CAAC,EAAkB,EAAE,MAAc;QAChD,OAAO,IAAI,QAAQ,CACjB,MAAM,EACN,EAAE,CAAC,GAAG,EACN,EAAE,CAAC,UAAU,EACb,EAAE,CAAC,aAAa,EAChB,EAAE,CAAC,OAAO,EACV,EAAE,CAAC,SAAS,EACZ,EAAE,CAAC,SAAS,CACb,CAAC;IACJ,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,IAAI,IAAI,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC;QAC1B,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACxD,IAAI,CAAC;gBACH,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AApCD,4BAoCC;AAYD,8EAA8E;AAC9E,uDAAuD;AACvD,8EAA8E;AAE9E,MAAa,kBAAkB;IAEX;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IAZlB,YACkB,aAAuB,EACvB,eAAuB,EACvB,QAAuB,EACvB,WAAuB,EACvB,SAAuB,EACvB,aAAyB,EACzB,aAAyB,EACzB,WAAyB,EACzB,SAA2B,EAC3B,WAA6B,EAC7B,aAAuC,EACvC,aAAuB;QAXvB,kBAAa,GAAb,aAAa,CAAU;QACvB,oBAAe,GAAf,eAAe,CAAQ;QACvB,aAAQ,GAAR,QAAQ,CAAe;QACvB,gBAAW,GAAX,WAAW,CAAY;QACvB,cAAS,GAAT,SAAS,CAAc;QACvB,kBAAa,GAAb,aAAa,CAAY;QACzB,kBAAa,GAAb,aAAa,CAAY;QACzB,gBAAW,GAAX,WAAW,CAAc;QACzB,cAAS,GAAT,SAAS,CAAkB;QAC3B,gBAAW,GAAX,WAAW,CAAkB;QAC7B,kBAAa,GAAb,aAAa,CAA0B;QACvC,kBAAa,GAAb,aAAa,CAAU;IACtC,CAAC;IAEJ,MAAM,CAAC,eAAe,CAAC,OAAsC;QAC3D,MAAM,SAAS,GAAoB,EAAE,CAAC;QACtC,MAAM,WAAW,GAAkB,EAAE,CAAC;QACtC,IAAM,aAAa,GAA2B,EAAE,CAAC;QAEjD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,kBAAkB,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE;gBACjE,aAAa,GAAG,EAAE,GAAG,aAAa,EAAE,GAAG,CAAC,EAAE,CAAC;YAC7C,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,kBAAkB,CAC3B,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,gBAAgB,EACxB,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAC9B,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAC9B,OAAO,CAAC,OAAO,CAAC,YAAY,EAC5B,SAAS,EACT,WAAW,EACX,aAAa,EACb,OAAO,CAAC,QAAQ,CACjB,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,WAAW,CACxB,IAAc,EACd,SAAwB,EACxB,WAA0B,EAC1B,SAAiD;QAEjD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAiC,CAAC;QAEtD,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;YACvB,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,QAAQ,GAAI,MAAM,CAAC,cAAc,CAAkC,IAAI,EAAE,CAAC;gBAChF,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;oBAC1B,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,WAAW,CAAC,IAAI,CAAC;oBACf,aAAa,EAAI,MAAM,CAAC,gBAAgB,CAAyD,IAAI,EAAE;oBACvG,cAAc,EAAG,MAAM,CAAC,iBAAiB,CAAwB,IAAI,GAAG;oBACxE,YAAY,EAAK,MAAM,CAAC,eAAe,CAA2C,IAAI,EAAE,KAAK,EAAE,kCAAkC,EAAE;iBACpI,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;YACD,KAAK,eAAe,CAAC,CAAC,CAAC;gBACrB,SAAS,CAAE,MAAM,CAAC,SAAS,CAAwC,IAAI,EAAE,CAAC,CAAC;gBAC3E,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;IAC5C,CAAC;IAED,WAAW;QACT,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAC9B,OAAO,GAAG,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACtD,CAAC;IAED,MAAM;QACJ,OAAO;YACL,cAAc,EAAI,IAAI,CAAC,aAAa;YACpC,gBAAgB,EAAE,IAAI,CAAC,eAAe;YACtC,QAAQ,EAAU,IAAI,CAAC,QAAQ;YAC/B,YAAY,EAAM,IAAI,CAAC,WAAW;YAClC,UAAU,EAAQ,IAAI,CAAC,SAAS;YAChC,cAAc,EAAI,IAAI,CAAC,aAAa;YACpC,cAAc,EAAI,IAAI,CAAC,aAAa;YACpC,YAAY,EAAM,IAAI,CAAC,WAAW;YAClC,UAAU,EAAQ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3C,OAAO,EAAQ,CAAC,CAAC,MAAM;gBACvB,GAAG,EAAY,CAAC,CAAC,GAAG;gBACpB,UAAU,EAAK,CAAC,CAAC,SAAS;gBAC1B,aAAa,EAAE,CAAC,CAAC,YAAY;gBAC7B,OAAO,EAAQ,CAAC,CAAC,OAAO;gBACxB,SAAS,EAAM,CAAC,CAAC,QAAQ;gBACzB,SAAS,EAAM,CAAC,CAAC,SAAS;aAC3B,CAAC,CAAC;YACH,YAAY,EAAK,IAAI,CAAC,WAAW;YACjC,cAAc,EAAG,IAAI,CAAC,aAAa;YACnC,QAAQ,EAAS,IAAI,CAAC,aAAa;SACpC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,GAA4B;QAC1C,MAAM,SAAS,GAAG,CAAE,GAAG,CAAC,YAAY,CAA2B,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC/E,MAAM,CAAC,GAAG,CAA4B,CAAC;YACvC,OAAO,IAAI,QAAQ,CACjB,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAU,EAAE,CAAC,EAChC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAc,EAAE,CAAC,EAChC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAa,OAAO,CAAiB,EACrD,CAAC,CAAC,CAAC,eAAe,CAAC,IAAU,aAAa,CAAiB,EAC3D,CAAC,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAClD,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,IAAQ,GAAG,CAAC,EACjC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,IAAQ,GAAG,CAAC,CAClC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,kBAAkB,CAC3B,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAM,EAAE,CAAC,EACrC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,EACrC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAY,GAAG,CAAC,EACtC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAQ,CAAC,CAAC,EACpC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAU,CAAC,CAAC,EACnC,GAAG,CAAC,gBAAgB,CAA0B,IAAI,CAAC,GAAG,CAAC,EACvD,GAAG,CAAC,gBAAgB,CAA0B,IAAI,EAAE,EACpD,GAAG,CAAC,cAAc,CAA4B,IAAI,EAAE,EACrD,SAAS,EACR,GAAG,CAAC,cAAc,CAAgC,IAAI,EAAE,EACxD,GAAG,CAAC,gBAAgB,CAAwC,IAAI,EAAE,EACnE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAC9B,CAAC;IACJ,CAAC;CACF;AAzID,gDAyIC;AAED,8EAA8E;AAC9E,mFAAmF;AACnF,8EAA8E;AAE9E,MAAa,qBAAqB;IACH;IAA7B,YAA6B,YAAkC;QAAlC,iBAAY,GAAZ,YAAY,CAAsB;IAAG,CAAC;IAEnE,MAAM,CAAC,KAAK;QACV,OAAO,IAAI,qBAAqB,CAAC,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7D,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IACrC,CAAC;IAED,kEAAkE;IAClE,aAAa;QACX,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;YAClD,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,kDAAkD;IAClD,kBAAkB,CAAC,GAAY;QAC7B,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;YAClD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,WAAW,EAAE,CAAC;gBAC5C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;oBACxC,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;wBACrD,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,gBAAgB;QACtB,OAAO,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxE,CAAC;IAEO,YAAY,CAAC,GAAY,EAAE,MAAc,EAAE,OAAe;QAChE,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE;YAAE,OAAO,KAAK,CAAC;QACpE,kDAAkD;QAClD,MAAM,QAAQ,GAAG,OAAO;aACrB,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC;aACpC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACxB,OAAO,IAAI,MAAM,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;CACF;AAtDD,sDAsDC"}

package/dist/types/wireProtocol.d.ts

@@ -0,0 +1,117 @@
+/**
+ * Strict types for every object that crosses the SaaS <-> Agent wire boundary.
+ * These mirror the JSON wire protocol defined in ARCHITECTURE_PLAN.md §3.
+ * No optional fields — every absent value must be explicitly typed as | null.
+ */
+export type MessageType = 'handshake' | 'runtime_instruction' | 'extraction_request' | 'extraction_response';
+export type MaskStrategy = 'partial_last4' | 'email_domain_only' | 'last4_only' | 'full_redact' | 'hash_stable';
+export type MatchType = 'exact' | 'regex';
+export type RuleType = 'pii_mask' | 'route_block' | 'header_inject' | 'circuit_breaker_test';
+export interface WireEnvelope {
+    readonly protocol_version: string;
+    readonly message_id: string;
+    readonly message_type: MessageType;
+    readonly client_id: string;
+    readonly issued_at: number;
+    readonly nonce: string;
+    readonly hmac_sha256: string;
+    readonly payload: WireRuntimeInstructionPayload | WireExtractionRequestPayload | Record<string, unknown>;
+}
+export interface WireKeyPattern {
+    readonly key: string;
+    readonly match_type: MatchType;
+    readonly mask_strategy: MaskStrategy;
+    readonly pattern: string | null;
+    readonly mask_char: string;
+    readonly separator: string;
+}
+export interface WirePiiMaskConfig {
+    readonly scan_depth: string;
+    readonly key_patterns: WireKeyPattern[];
+}
+export interface WireRouteEntry {
+    readonly method: string;
+    readonly path: string;
+    readonly reason: string | null;
+}
+export interface WireRouteBlockConfig {
+    readonly blocked_routes: WireRouteEntry[];
+    readonly response_status: number;
+    readonly response_body: Record<string, unknown>;
+}
+export interface WireHeaderInjectConfig {
+    readonly headers: Record<string, string>;
+}
+export interface WireRule {
+    readonly rule_id: string;
+    readonly rule_type: RuleType;
+    readonly config: WirePiiMaskConfig | WireRouteBlockConfig | WireHeaderInjectConfig | Record<string, unknown>;
+}
+export interface WireTargets {
+    readonly routes: {
+        readonly include: string[];
+        readonly exclude: string[];
+    };
+    readonly http_methods: string[];
+}
+export interface WireRuntimeInstructionPayload {
+    readonly instruction_id: string;
+    readonly instruction_type: string;
+    readonly priority: number;
+    readonly ttl_seconds: number;
+    readonly effective_at: number;
+    readonly expires_at: number;
+    readonly targets: WireTargets;
+    readonly rules: WireRule[];
+    readonly checksum: string;
+}
+export interface WireExtractionRequestPayload {
+    readonly extraction_id: string;
+    readonly extraction_type: string;
+    readonly repository: Record<string, string>;
+    readonly targets: unknown[];
+    readonly include_ast: boolean;
+    readonly include_docblock: boolean;
+    readonly include_line_numbers: boolean;
+    readonly max_lines_per_symbol: number;
+    readonly callback_url: string;
+}
+export interface HandshakeRequest {
+    readonly connection_key: string;
+    readonly site_url: string;
+    readonly site_name: string | null;
+    readonly language_runtime: 'node';
+    readonly runtime_version: string;
+    readonly framework: string | null;
+    readonly framework_version: string | null;
+    readonly agent_version: string | null;
+    readonly environment: 'local' | 'staging' | 'production';
+    readonly capabilities: AgentCapabilities;
+    readonly webhook_url: string | null;
+}
+export interface AgentCapabilities {
+    readonly mode_a_ast: boolean;
+    readonly mode_b_interceptor: boolean;
+    readonly redis_available: boolean;
+    readonly git_access: boolean;
+}
+export interface HandshakeResponse {
+    readonly status: 'accepted';
+    readonly client_id: string;
+    readonly token: string;
+    readonly instruction_channel: {
+        readonly type: 'webhook' | 'polling';
+        readonly poll_url: string;
+        readonly poll_interval_seconds: number;
+    };
+}
+export interface ConnectionConfig {
+    readonly client_id: string;
+    readonly token: string;
+    readonly saas_url: string;
+    readonly channel_type: 'webhook' | 'polling';
+    readonly poll_url: string;
+    readonly poll_interval_seconds: number;
+    readonly connected_at: string;
+}
+//# sourceMappingURL=wireProtocol.d.ts.map

package/dist/types/wireProtocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wireProtocol.d.ts","sourceRoot":"","sources":["../../src/types/wireProtocol.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,MAAM,WAAW,GACnB,WAAW,GACX,qBAAqB,GACrB,oBAAoB,GACpB,qBAAqB,CAAC;AAE1B,MAAM,MAAM,YAAY,GACpB,eAAe,GACf,mBAAmB,GACnB,YAAY,GACZ,aAAa,GACb,aAAa,CAAC;AAElB,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;AAE1C,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,aAAa,GAAG,eAAe,GAAG,sBAAsB,CAAC;AAM7F,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAQ,MAAM,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAM,WAAW,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAS,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAS,MAAM,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAa,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAO,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAW,6BAA6B,GAAG,4BAA4B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnH;AAMD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAW,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAI,SAAS,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,YAAY,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAO,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAK,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAK,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAI,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,cAAc,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAI,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,cAAc,EAAI,cAAc,EAAE,CAAC;IAC5C,QAAQ,CAAC,eAAe,EAAG,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAI,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAK,iBAAiB,GAAG,oBAAoB,GAAG,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjH;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;KAC5B,CAAC;IACF,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,cAAc,EAAI,MAAM,CAAC;IAClC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAU,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAO,MAAM,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAM,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAQ,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAW,WAAW,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAa,QAAQ,EAAE,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAU,MAAM,CAAC;CACnC;AAMD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,aAAa,EAAW,MAAM,CAAC;IACxC,QAAQ,CAAC,eAAe,EAAS,MAAM,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAc,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxD,QAAQ,CAAC,OAAO,EAAiB,OAAO,EAAE,CAAC;IAC3C,QAAQ,CAAC,WAAW,EAAa,OAAO,CAAC;IACzC,QAAQ,CAAC,gBAAgB,EAAQ,OAAO,CAAC;IACzC,QAAQ,CAAC,oBAAoB,EAAI,OAAO,CAAC;IACzC,QAAQ,CAAC,oBAAoB,EAAI,MAAM,CAAC;IACxC,QAAQ,CAAC,YAAY,EAAY,MAAM,CAAC;CACzC;AAMD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,cAAc,EAAK,MAAM,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAW,MAAM,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAU,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,gBAAgB,EAAG,MAAM,CAAC;IACnC,QAAQ,CAAC,eAAe,EAAI,MAAM,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAU,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,aAAa,EAAM,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAQ,OAAO,GAAG,SAAS,GAAG,YAAY,CAAC;IAC/D,QAAQ,CAAC,YAAY,EAAO,iBAAiB,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAQ,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAU,OAAO,CAAC;IACrC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAK,OAAO,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAU,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAK,UAAU,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAM,MAAM,CAAC;IAC3B,QAAQ,CAAC,mBAAmB,EAAE;QAC5B,QAAQ,CAAC,IAAI,EAAoB,SAAS,GAAG,SAAS,CAAC;QACvD,QAAQ,CAAC,QAAQ,EAAgB,MAAM,CAAC;QACxC,QAAQ,CAAC,qBAAqB,EAAG,MAAM,CAAC;KACzC,CAAC;CACH;AAMD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAa,MAAM,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAiB,MAAM,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAc,MAAM,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAU,SAAS,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,QAAQ,EAAc,MAAM,CAAC;IACtC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,YAAY,EAAU,MAAM,CAAC;CACvC"}

package/dist/types/wireProtocol.js

@@ -0,0 +1,8 @@
+"use strict";
+/**
+ * Strict types for every object that crosses the SaaS <-> Agent wire boundary.
+ * These mirror the JSON wire protocol defined in ARCHITECTURE_PLAN.md §3.
+ * No optional fields — every absent value must be explicitly typed as | null.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=wireProtocol.js.map

package/dist/types/wireProtocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wireProtocol.js","sourceRoot":"","sources":["../../src/types/wireProtocol.ts"],"names":[],"mappings":";AAAA;;;;GAIG"}

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@develler/remediation-agent",
+  "version": "1.0.2",
+  "description": "Remediation agent for Node.js/Express — real-time PII masking and automated code-fix pipeline",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist/**/*",
+    "README.md"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Sabs19/remediation-node-package.git"
+  },
+  "publishConfig": {
+    "access": "public",
+    "scope": "@develler"
+  },
+  "license": "MIT",
+  "scripts": {
+    "build": "tsc",
+    "build:watch": "tsc --watch",
+    "prepublishOnly": "npm run build",
+    "connect": "node dist/commands/connect.js",
+    "test": "tsc --noEmit && node --test dist/tests/**/*.test.js",
+    "test:compile": "tsc --project tsconfig.test.json"
+  },
+  "dependencies": {
+    "axios": "^1.7.0",
+    "ioredis": "^5.3.0",
+    "winston": "^3.13.0"
+  },
+  "peerDependencies": {
+    "express": "^4.18.0 || ^5.0.0"
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.0",
+    "@types/node": "^20.0.0",
+    "typescript": "^5.4.0"
+  },
+  "peerDependenciesMeta": {
+    "typescript": {
+      "optional": true
+    }
+  }
+}