@od-oneapp/ai-platform 0.1.0

package/dist/redaction-utils-DcQwsiNh.mjs

@@ -0,0 +1,438 @@
+import { n as hashInput } from "./crypto-8ABhc3TD.mjs";
+import { createHash } from "node:crypto";
+
+//#region src/governance/compliance/abac/policy-engine.ts
+/**
+* Global policy registry
+*/
+const policyRegistry = /* @__PURE__ */ new Map();
+/**
+* Register a policy
+*/
+function registerPolicy(policy) {
+	policyRegistry.set(policy.id, policy);
+}
+/**
+* Unregister a policy
+*/
+function unregisterPolicy(policyId) {
+	policyRegistry.delete(policyId);
+}
+/**
+* Get all registered policies
+*/
+function getPolicies() {
+	return [...policyRegistry.values()].sort((a, b) => b.priority - a.priority);
+}
+/**
+* Evaluate access decision using all registered policies
+* Policies are evaluated in priority order (highest first)
+* First DENY wins, otherwise all must ALLOW
+*/
+async function evaluatePolicy(context, resource, action) {
+	const startTime = Date.now();
+	const policiesEvaluated = [];
+	const policies = getPolicies();
+	if (policies.length === 0) return {
+		decision: {
+			allowed: false,
+			reason: "No policies configured",
+			policyId: "default-deny"
+		},
+		policiesEvaluated: [],
+		evaluationTimeMs: Date.now() - startTime
+	};
+	for (const policy of policies) {
+		policiesEvaluated.push(policy.id);
+		try {
+			const decision = await policy.evaluate(context, resource, action);
+			if (!decision.allowed) return {
+				decision,
+				policiesEvaluated,
+				evaluationTimeMs: Date.now() - startTime
+			};
+		} catch (error) {
+			return {
+				decision: {
+					allowed: false,
+					reason: `Policy evaluation error: ${error instanceof Error ? error.message : "Unknown error"}`,
+					policyId: policy.id
+				},
+				policiesEvaluated,
+				evaluationTimeMs: Date.now() - startTime
+			};
+		}
+	}
+	return {
+		decision: {
+			allowed: true,
+			policyId: "all-policies-allowed"
+		},
+		policiesEvaluated,
+		evaluationTimeMs: Date.now() - startTime
+	};
+}
+/**
+* Create ABAC context from request metadata
+*/
+function createABACContext(actorId, roles, purpose, attributes = {}, environment = {}) {
+	return {
+		actor: {
+			id: actorId,
+			roles,
+			attributes
+		},
+		environment: {
+			timestamp: /* @__PURE__ */ new Date(),
+			...environment
+		},
+		purpose
+	};
+}
+/**
+* Helper: Check if actor has role
+*/
+function hasRole(context, role) {
+	return context.actor.roles.includes(role);
+}
+/**
+* Helper: Check if actor has any of the roles
+*/
+function hasAnyRole(context, roles) {
+	return roles.some((role) => context.actor.roles.includes(role));
+}
+/**
+* Helper: Check if actor has all of the roles
+*/
+function hasAllRoles(context, roles) {
+	return roles.every((role) => context.actor.roles.includes(role));
+}
+/**
+* Helper: Check resource sensitivity level
+*/
+function isResourceSensitive(resource) {
+	return resource.sensitivity === "confidential" || resource.sensitivity === "restricted";
+}
+/**
+* Helper: Create ALLOW decision
+*/
+function allow(policyId, conditions) {
+	return {
+		allowed: true,
+		policyId,
+		conditions
+	};
+}
+/**
+* Helper: Create DENY decision
+*/
+function deny(policyId, reason) {
+	return {
+		allowed: false,
+		policyId,
+		reason
+	};
+}
+
+//#endregion
+//#region src/server/cache/performance.ts
+/**
+* @fileoverview Performance optimization helper functions
+* Provides caching for expensive operations like PHI detection
+*/
+/**
+* In-memory cache for detection results
+* In production, consider using Redis or another distributed cache
+*/
+const detectionCache = /* @__PURE__ */ new Map();
+/**
+* Cache detection results for a given input
+* @param input - Input data that was analyzed
+* @param result - Detection results to cache
+* @param ttl - Time to live in milliseconds (default: 1 hour)
+*/
+function cacheDetections(input, result, ttl = 36e5) {
+	const key = hashInput(input);
+	detectionCache.set(key, {
+		result,
+		timestamp: Date.now(),
+		ttl
+	});
+	setTimeout(() => {
+		detectionCache.delete(key);
+	}, ttl);
+}
+/**
+* Get cached detection results for a given input
+* @param input - Input data to look up
+* @returns Cached results if available and not expired, otherwise undefined
+*/
+function getCachedDetections(input) {
+	const key = hashInput(input);
+	const cached = detectionCache.get(key);
+	if (!cached) return;
+	const entry = cached;
+	if (Date.now() - entry.timestamp > entry.ttl) {
+		detectionCache.delete(key);
+		return;
+	}
+	return entry.result;
+}
+
+//#endregion
+//#region src/governance/compliance/validators/safe-harbor.ts
+/**
+* Regex patterns for detecting HIPAA Safe Harbor identifiers
+* Note: These are basic patterns and should be enhanced with NER for production
+*
+* Security note: Some patterns below use eslint-disable for detect-unsafe-regex.
+* These patterns have been reviewed and are safe in this context because:
+* 1. Input text is validated and length-limited before processing
+* 2. The patterns match specific, bounded structures (phone numbers, IPs, etc.)
+* 3. The nested quantifiers are necessary for real-world format variations
+*/
+const SAFE_HARBOR_PATTERNS = {
+	ssn: /\b\d{3}-\d{2}-\d{4}\b|\b\d{9}\b/g,
+	mrn: /\b(?:mrn|medical record|patient id)[\s#:]*([\da-z]{6,10})\b/gi,
+	phone: /\b(?:\+?1[\s.-]?)?\(?(\d{3})\)?[\s.-]?(\d{3})[\s.-]?(\d{4})\b/g,
+	fax: /\b(?:fax|facsimile)[\s:]*(?:\+?1[\s.-]?)?\(?(\d{3})\)?[\s.-]?(\d{3})[\s.-]?(\d{4})\b/gi,
+	email: /\b[\w%+.-]+@[\d.A-Za-z-]+\.[A-Za-z|]{2,}\b/g,
+	ip_address: /\b(?:(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d{1,2})\b|(?:[\da-f]{1,4}:){7}[\da-f]{1,4}/gi,
+	url: /\bhttps?:\/\/(?:w{3}\.)?[\w#%+.:=@~-]{1,256}\.[\d()a-z]{1,6}\b[\w#%&()+./:=?@~-]*/gi,
+	date: /\b(?:0?[1-9]|1[0-2])[./\-](?:0?[1-9]|[12]\d|3[01])[./\-](?:19|20)\d{2}\b|\b(?:19|20)\d{2}[./\-](?:0?[1-9]|1[0-2])[./\-](?:0?[1-9]|[12]\d|3[01])\b/g,
+	name: /\b(?:mr\.|mrs\.|ms\.|dr\.|prof\.)(?:\s+[A-Z][a-z]+)+\b/g,
+	geographic: /\b\d+\s+(?:[a-z]{2,}\s+){1,3}(?:street|st|avenue|ave|road|rd|drive|dr|lane|ln|court|ct|circle|cir|way|boulevard|blvd|parkway|pkwy|place|pl)\b/gi,
+	account_number: /\b(?:account|acct|policy)[\s#:]*(\d{8,16})\b/gi,
+	license_number: /\b(?:license|lic|dl)[\s#:]*([a-z]{2}\d{6,12})\b/gi,
+	vehicle_id: /\bvin[\s#:]*([\da-hj-npr-z]{17})\b/gi,
+	device_id: /\b(?:[\da-f]{2}[:-]){5}[\da-f]{2}\b|\b[\da-f]{8}(?:-[\da-f]{4}){3}-[\da-f]{12}\b/gi,
+	biometric: /\b(?:fingerprint|voiceprint|retina scan|iris scan|facial recognition|biometric)\b/gi,
+	photo: /\b(?:photo|photograph|image|picture)\s+(?:of|showing|depicting)\b/gi,
+	other_unique_id: /\b(?:id|identifier|code)[\s#:]*([\da-z\-]{8,})\b/gi
+};
+/**
+* High-confidence patterns that are almost certainly PHI
+*/
+const HIGH_CONFIDENCE_PATTERNS = {
+	ssn: SAFE_HARBOR_PATTERNS.ssn,
+	email: SAFE_HARBOR_PATTERNS.email,
+	phone: SAFE_HARBOR_PATTERNS.phone,
+	ip_address: SAFE_HARBOR_PATTERNS.ip_address,
+	url: SAFE_HARBOR_PATTERNS.url
+};
+/**
+* Get confidence score for a PHI type
+* Higher score = more certain it's actually PHI
+*/
+function getConfidenceScore(type, value) {
+	if (type in HIGH_CONFIDENCE_PATTERNS) return .95;
+	if (type === "name" || type === "geographic" || type === "date") return .6;
+	return .4;
+}
+/**
+* Check if a pattern match is likely a false positive
+*/
+function isFalsePositive(type, value) {
+	if (type === "date" && /^\d{4}$/.test(value.trim())) return true;
+	if (type === "name") return [
+		"The",
+		"This",
+		"That",
+		"These",
+		"Those"
+	].some((word) => value.includes(word));
+	if (type === "account_number" && /^(0+|1+|12345678)$/.test(value)) return true;
+	return false;
+}
+
+//#endregion
+//#region src/governance/compliance/validators/phi-detector.ts
+/**
+* @fileoverview PHI Detection Engine
+* PHI Detection Engine
+* Scans text for HIPAA Safe Harbor 18 identifiers
+* Includes performance caching for repeated detections
+*/
+/**
+* Detect PHI in text using regex patterns
+* Returns array of detections with positions and confidence scores
+* Results are cached for performance
+*/
+function detectPHI(text, options = {}) {
+	const { minConfidence = .5, excludeTypes = [], useCache = true } = options;
+	if (useCache) {
+		const cached = getCachedDetections(text);
+		if (cached) return cached.filter((d) => d.confidence >= minConfidence && !excludeTypes.includes(d.type));
+	}
+	const detections = [];
+	for (const [type, pattern] of Object.entries(SAFE_HARBOR_PATTERNS)) {
+		const phiType = type;
+		if (excludeTypes.includes(phiType)) continue;
+		pattern.lastIndex = 0;
+		let match;
+		while ((match = pattern.exec(text)) !== null) {
+			const value = match[0];
+			const start = match.index;
+			const end = start + value.length;
+			const confidence = getConfidenceScore(phiType, value);
+			if (confidence < minConfidence || isFalsePositive(phiType, value)) continue;
+			detections.push({
+				type: phiType,
+				value,
+				start,
+				end,
+				confidence
+			});
+		}
+	}
+	const sorted = detections.sort((a, b) => a.start - b.start);
+	if (useCache) cacheDetections(text, sorted);
+	return sorted;
+}
+/**
+* Check if text contains any PHI
+*/
+function containsPHI(text, options) {
+	return detectPHI(text, options).length > 0;
+}
+/**
+* Get PHI statistics for text
+*/
+function analyzePHI(text) {
+	const detections = detectPHI(text);
+	const byType = detections.reduce((acc, d) => {
+		acc[d.type] = (acc[d.type] || 0) + 1;
+		return acc;
+	}, {});
+	const averageConfidence = detections.length > 0 ? detections.reduce((sum, d) => sum + d.confidence, 0) / detections.length : 0;
+	return {
+		hasPHI: detections.length > 0,
+		totalDetections: detections.length,
+		byType,
+		averageConfidence
+	};
+}
+/**
+* Validate that text is Safe Harbor compliant
+* Returns true if no PHI detected above threshold
+*/
+function isSafeHarborCompliant(text, minConfidence = .7) {
+	const violations = detectPHI(text, { minConfidence });
+	return {
+		compliant: violations.length === 0,
+		violations
+	};
+}
+
+//#endregion
+//#region src/governance/compliance/validators/redaction-utils.ts
+/**
+* @fileoverview PHI Redaction Utilities
+* PHI Redaction Utilities
+* Implements different redaction strategies for HIPAA compliance
+*/
+/**
+* Redact PHI from text using specified strategy
+*/
+function redactPHI(text, strategy = "MASK", options = {}) {
+	const { customMask = "[REDACTED]", preserveLength = false, minConfidence } = options;
+	const detections = detectPHI(text, { minConfidence });
+	if (detections.length === 0) return {
+		redacted: text,
+		detections: []
+	};
+	let redacted = text;
+	const sortedDetections = [...detections].sort((a, b) => b.start - a.start);
+	for (const detection of sortedDetections) {
+		const { start, end, value, type } = detection;
+		const replacement = getRedactionReplacement(value, type, strategy, customMask, preserveLength);
+		redacted = redacted.slice(0, start) + replacement + redacted.slice(end);
+	}
+	return {
+		redacted,
+		detections
+	};
+}
+/**
+* Get replacement text for a detected PHI value
+*/
+function getRedactionReplacement(value, type, strategy, customMask, preserveLength) {
+	switch (strategy) {
+		case "MASK":
+			if (preserveLength) return "*".repeat(value.length);
+			return customMask;
+		case "HASH": return `[${type.toUpperCase()}_${hashString(value)}]`;
+		case "TOKENIZE": return `[TOKEN_${type.toUpperCase()}_${generateToken(value)}]`;
+		default: return customMask;
+	}
+}
+/**
+* Cryptographically hash a string for HASH strategy
+* Uses SHA-256 for consistent, secure hashing
+*/
+function hashString(value) {
+	return createHash("sha256").update(value).digest("hex").slice(0, 8).toUpperCase();
+}
+/**
+* Generate a reversible token (simplified - use proper tokenization in production)
+*/
+function generateToken(value) {
+	return Buffer.from(value).toString("base64").slice(0, 12);
+}
+/**
+* Redact specific PHI types only
+*/
+function redactSpecificTypes(text, types, strategy = "MASK") {
+	const filteredDetections = detectPHI(text).filter((d) => types.includes(d.type));
+	let redacted = text;
+	const sortedDetections = [...filteredDetections].sort((a, b) => b.start - a.start);
+	for (const detection of sortedDetections) {
+		const { start, end, value, type } = detection;
+		const replacement = getRedactionReplacement(value, type, strategy, "[REDACTED]", false);
+		redacted = redacted.slice(0, start) + replacement + redacted.slice(end);
+	}
+	return {
+		redacted,
+		detections: filteredDetections
+	};
+}
+/**
+* Preview redactions without applying them
+*/
+function previewRedactions(text) {
+	const detections = detectPHI(text);
+	let preview = text;
+	const sortedDetections = [...detections].sort((a, b) => b.start - a.start);
+	for (const detection of sortedDetections) {
+		const { start, end, type } = detection;
+		const replacement = `[${type.toUpperCase()}]`;
+		preview = preview.slice(0, start) + replacement + preview.slice(end);
+	}
+	const byType = detections.reduce((acc, d) => {
+		acc[d.type] = (acc[d.type] || 0) + 1;
+		return acc;
+	}, {});
+	return {
+		original: text,
+		preview,
+		detections,
+		stats: {
+			totalPHI: detections.length,
+			byType
+		}
+	};
+}
+/**
+* Sanitize text for logging (aggressive redaction)
+*/
+function sanitizeForLogging(text) {
+	const { redacted } = redactPHI(text, "MASK", {
+		customMask: "[REDACTED]",
+		minConfidence: .3
+	});
+	return redacted;
+}
+
+//#endregion
+export { unregisterPolicy as C, registerPolicy as S, getPolicies as _, analyzePHI as a, hasRole as b, isSafeHarborCompliant as c, getConfidenceScore as d, isFalsePositive as f, evaluatePolicy as g, deny as h, sanitizeForLogging as i, HIGH_CONFIDENCE_PATTERNS as l, createABACContext as m, redactPHI as n, containsPHI as o, allow as p, redactSpecificTypes as r, detectPHI as s, previewRedactions as t, SAFE_HARBOR_PATTERNS as u, hasAllRoles as v, isResourceSensitive as x, hasAnyRole as y };
+//# sourceMappingURL=redaction-utils-DcQwsiNh.mjs.map

package/dist/redaction-utils-DcQwsiNh.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction-utils-DcQwsiNh.mjs","names":[],"sources":["../src/governance/compliance/abac/policy-engine.ts","../src/server/cache/performance.ts","../src/governance/compliance/validators/safe-harbor.ts","../src/governance/compliance/validators/phi-detector.ts","../src/governance/compliance/validators/redaction-utils.ts"],"sourcesContent":["/**\n * @fileoverview ABAC Policy Engine\n * ABAC Policy Engine\n * Implements Attribute-Based Access Control for HIPAA minimum necessary\n */\n\nimport type { ABACContext, ABACDecision, Action, Resource } from '../types';\nimport type { ABACEvaluationResult, Policy, PolicyRegistry } from './types';\n\n/**\n * Global policy registry\n */\nconst policyRegistry: PolicyRegistry = new Map();\n\n/**\n * Register a policy\n */\nexport function registerPolicy(policy: Policy): void {\n  policyRegistry.set(policy.id, policy);\n}\n\n/**\n * Unregister a policy\n */\nexport function unregisterPolicy(policyId: string): void {\n  policyRegistry.delete(policyId);\n}\n\n/**\n * Get all registered policies\n */\nexport function getPolicies(): Policy[] {\n  return [...policyRegistry.values()].sort((a, b) => b.priority - a.priority);\n}\n\n/**\n * Evaluate access decision using all registered policies\n * Policies are evaluated in priority order (highest first)\n * First DENY wins, otherwise all must ALLOW\n */\nexport async function evaluatePolicy(\n  context: ABACContext,\n  resource: Resource,\n  action: Action,\n): Promise<ABACEvaluationResult> {\n  const startTime = Date.now();\n  const policiesEvaluated: string[] = [];\n  const policies = getPolicies();\n\n  // Default deny if no policies\n  if (policies.length === 0) {\n    return {\n      decision: {\n        allowed: false,\n        reason: 'No policies configured',\n        policyId: 'default-deny',\n      },\n      policiesEvaluated: [],\n      evaluationTimeMs: Date.now() - startTime,\n    };\n  }\n\n  // Evaluate each policy\n  for (const policy of policies) {\n    policiesEvaluated.push(policy.id);\n\n    try {\n      const decision = await policy.evaluate(context, resource, action);\n\n      // First explicit DENY wins\n      if (!decision.allowed) {\n        return {\n          decision,\n          policiesEvaluated,\n          evaluationTimeMs: Date.now() - startTime,\n        };\n      }\n    } catch (error) {\n      // Policy evaluation error = DENY\n      return {\n        decision: {\n          allowed: false,\n          reason: `Policy evaluation error: ${error instanceof Error ? error.message : 'Unknown error'}`,\n          policyId: policy.id,\n        },\n        policiesEvaluated,\n        evaluationTimeMs: Date.now() - startTime,\n      };\n    }\n  }\n\n  // All policies allowed\n  return {\n    decision: {\n      allowed: true,\n      policyId: 'all-policies-allowed',\n    },\n    policiesEvaluated,\n    evaluationTimeMs: Date.now() - startTime,\n  };\n}\n\n/**\n * Create ABAC context from request metadata\n */\nexport function createABACContext(\n  actorId: string,\n  roles: string[],\n  purpose: ABACContext['purpose'],\n  attributes: Record<string, unknown> = {},\n  environment: Partial<ABACContext['environment']> = {},\n): ABACContext {\n  return {\n    actor: {\n      id: actorId,\n      roles,\n      attributes,\n    },\n    environment: {\n      timestamp: new Date(),\n      ...environment,\n    },\n    purpose,\n  };\n}\n\n/**\n * Helper: Check if actor has role\n */\nexport function hasRole(context: ABACContext, role: string): boolean {\n  return context.actor.roles.includes(role);\n}\n\n/**\n * Helper: Check if actor has any of the roles\n */\nexport function hasAnyRole(context: ABACContext, roles: string[]): boolean {\n  return roles.some(role => context.actor.roles.includes(role));\n}\n\n/**\n * Helper: Check if actor has all of the roles\n */\nexport function hasAllRoles(context: ABACContext, roles: string[]): boolean {\n  return roles.every(role => context.actor.roles.includes(role));\n}\n\n/**\n * Helper: Check resource sensitivity level\n */\nexport function isResourceSensitive(resource: Resource): boolean {\n  return resource.sensitivity === 'confidential' || resource.sensitivity === 'restricted';\n}\n\n/**\n * Helper: Create ALLOW decision\n */\nexport function allow(policyId: string, conditions?: string[]): ABACDecision {\n  return {\n    allowed: true,\n    policyId,\n    conditions,\n  };\n}\n\n/**\n * Helper: Create DENY decision\n */\nexport function deny(policyId: string, reason: string): ABACDecision {\n  return {\n    allowed: false,\n    policyId,\n    reason,\n  };\n}\n","/**\n * @fileoverview Performance optimization helper functions\n * Provides caching for expensive operations like PHI detection\n */\n\nimport { hashInput } from './crypto';\n\n/**\n * In-memory cache for detection results\n * In production, consider using Redis or another distributed cache\n */\nconst detectionCache = new Map<string, unknown>();\n\n/**\n * Cache detection results for a given input\n * @param input - Input data that was analyzed\n * @param result - Detection results to cache\n * @param ttl - Time to live in milliseconds (default: 1 hour)\n */\nexport function cacheDetections<T>(\n  input: string | Record<string, unknown>,\n  result: T,\n  ttl: number = 3600000,\n): void {\n  const key = hashInput(input);\n  detectionCache.set(key, {\n    result,\n    timestamp: Date.now(),\n    ttl,\n  });\n\n  // Auto-cleanup expired entries\n  setTimeout(() => {\n    detectionCache.delete(key);\n  }, ttl);\n}\n\n/**\n * Get cached detection results for a given input\n * @param input - Input data to look up\n * @returns Cached results if available and not expired, otherwise undefined\n */\nexport function getCachedDetections<T>(input: string | Record<string, unknown>): T | undefined {\n  const key = hashInput(input);\n  const cached = detectionCache.get(key);\n\n  if (!cached) {\n    return undefined;\n  }\n\n  const entry = cached as { result: T; timestamp: number; ttl: number };\n  const isExpired = Date.now() - entry.timestamp > entry.ttl;\n\n  if (isExpired) {\n    detectionCache.delete(key);\n    return undefined;\n  }\n\n  return entry.result;\n}\n\n/**\n * Clear all cached detections\n * Useful for testing or memory management\n */\nexport function clearDetectionCache(): void {\n  detectionCache.clear();\n}\n\n/**\n * Get cache statistics\n * @returns Object with cache size and entries\n */\nexport function getCacheStats() {\n  return {\n    size: detectionCache.size,\n    keys: Array.from(detectionCache.keys()),\n  };\n}\n","/**\n * @fileoverview HIPAA Safe Harbor 18 - Regex patterns for PHI detection\n * HIPAA Safe Harbor 18 - Regex patterns for PHI detection\n * Reference: 45 CFR § 164.514(b)(2)\n */\n\nimport type { PHIType } from '../types';\n\n/**\n * Regex patterns for detecting HIPAA Safe Harbor identifiers\n * Note: These are basic patterns and should be enhanced with NER for production\n *\n * Security note: Some patterns below use eslint-disable for detect-unsafe-regex.\n * These patterns have been reviewed and are safe in this context because:\n * 1. Input text is validated and length-limited before processing\n * 2. The patterns match specific, bounded structures (phone numbers, IPs, etc.)\n * 3. The nested quantifiers are necessary for real-world format variations\n */\nexport const SAFE_HARBOR_PATTERNS: Record<PHIType, RegExp> = {\n  // SSN: xxx-xx-xxxx or xxxxxxxxx\n  ssn: /\\b\\d{3}-\\d{2}-\\d{4}\\b|\\b\\d{9}\\b/g,\n\n  // MRN: Common medical record number formats (6-10 digits, sometimes with prefix)\n  mrn: /\\b(?:mrn|medical record|patient id)[\\s#:]*([\\da-z]{6,10})\\b/gi,\n\n  // Phone: (xxx) xxx-xxxx, xxx-xxx-xxxx, xxx.xxx.xxxx\n  // eslint-disable-next-line security/detect-unsafe-regex -- Pattern is bounded by digit groups, safe for phone number matching\n  phone: /\\b(?:\\+?1[\\s.-]?)?\\(?(\\d{3})\\)?[\\s.-]?(\\d{3})[\\s.-]?(\\d{4})\\b/g,\n\n  // Fax: Similar to phone\n  // eslint-disable-next-line security/detect-unsafe-regex -- Pattern is bounded by digit groups, safe for fax number matching\n  fax: /\\b(?:fax|facsimile)[\\s:]*(?:\\+?1[\\s.-]?)?\\(?(\\d{3})\\)?[\\s.-]?(\\d{3})[\\s.-]?(\\d{4})\\b/gi,\n\n  // Email: Basic email pattern\n  email: /\\b[\\w%+.-]+@[\\d.A-Za-z-]+\\.[A-Za-z|]{2,}\\b/g,\n\n  // IP Address: IPv4 and basic IPv6\n  // Pattern matches fixed-structure IP addresses with bounded repetitions\n  ip_address:\n    /\\b(?:(?:25[0-5]|2[0-4]\\d|[01]?\\d{1,2})\\.){3}(?:25[0-5]|2[0-4]\\d|[01]?\\d{1,2})\\b|(?:[\\da-f]{1,4}:){7}[\\da-f]{1,4}/gi, // eslint-disable-line security/detect-unsafe-regex\n\n  // URL: Web URLs\n  // eslint-disable-next-line security/detect-unsafe-regex -- URL pattern has explicit length limits (1,256 and 1,6) preventing ReDoS\n  url: /\\bhttps?:\\/\\/(?:w{3}\\.)?[\\w#%+.:=@~-]{1,256}\\.[\\d()a-z]{1,6}\\b[\\w#%&()+./:=?@~-]*/gi,\n\n  // Dates: MM/DD/YYYY, MM-DD-YYYY, YYYY-MM-DD, etc. (except standalone years)\n  date: /\\b(?:0?[1-9]|1[0-2])[./\\-](?:0?[1-9]|[12]\\d|3[01])[./\\-](?:19|20)\\d{2}\\b|\\b(?:19|20)\\d{2}[./\\-](?:0?[1-9]|1[0-2])[./\\-](?:0?[1-9]|[12]\\d|3[01])\\b/g,\n\n  // Names: Capitalized words (simple heuristic, should use NER in production)\n  // This is a simplified pattern - in production, use Named Entity Recognition\n  // eslint-disable-next-line security/detect-unsafe-regex -- Pattern matches title + name format with bounded word repetition (1-5 words typical)\n  name: /\\b(?:mr\\.|mrs\\.|ms\\.|dr\\.|prof\\.)(?:\\s+[A-Z][a-z]+)+\\b/g,\n\n  // Geographic: Specific addresses (simplified - requires NER for accuracy)\n  // Matches: 123 Main St, 456 Oak Avenue, etc.\n\n  geographic:\n    /\\b\\d+\\s+(?:[a-z]{2,}\\s+){1,3}(?:street|st|avenue|ave|road|rd|drive|dr|lane|ln|court|ct|circle|cir|way|boulevard|blvd|parkway|pkwy|place|pl)\\b/gi, // eslint-disable-line security/detect-unsafe-regex\n\n  // Account numbers: 8-16 digit sequences\n  account_number: /\\b(?:account|acct|policy)[\\s#:]*(\\d{8,16})\\b/gi,\n\n  // License numbers: State + digits (e.g., CA123456789)\n  license_number: /\\b(?:license|lic|dl)[\\s#:]*([a-z]{2}\\d{6,12})\\b/gi,\n\n  // Vehicle identifiers: VIN (17 characters)\n  vehicle_id: /\\bvin[\\s#:]*([\\da-hj-npr-z]{17})\\b/gi,\n\n  // Device identifiers: MAC addresses, UUIDs, serial numbers\n  // eslint-disable-next-line security/detect-unsafe-regex -- Pattern matches fixed-structure MAC (6 octets) and UUID (8-4-4-4-12) formats\n  device_id: /\\b(?:[\\da-f]{2}[:-]){5}[\\da-f]{2}\\b|\\b[\\da-f]{8}(?:-[\\da-f]{4}){3}-[\\da-f]{12}\\b/gi,\n\n  // Biometric: References to biometric data\n  biometric: /\\b(?:fingerprint|voiceprint|retina scan|iris scan|facial recognition|biometric)\\b/gi,\n\n  // Photo: References to photos\n  photo: /\\b(?:photo|photograph|image|picture)\\s+(?:of|showing|depicting)\\b/gi,\n\n  // Other unique identifiers: Generic patterns for IDs\n  other_unique_id: /\\b(?:id|identifier|code)[\\s#:]*([\\da-z\\-]{8,})\\b/gi,\n};\n\n/**\n * High-confidence patterns that are almost certainly PHI\n */\nexport const HIGH_CONFIDENCE_PATTERNS: Partial<Record<PHIType, RegExp>> = {\n  ssn: SAFE_HARBOR_PATTERNS.ssn,\n  email: SAFE_HARBOR_PATTERNS.email,\n  phone: SAFE_HARBOR_PATTERNS.phone,\n  ip_address: SAFE_HARBOR_PATTERNS.ip_address,\n  url: SAFE_HARBOR_PATTERNS.url,\n};\n\n/**\n * Get confidence score for a PHI type\n * Higher score = more certain it's actually PHI\n */\nexport function getConfidenceScore(type: PHIType, value: string): number {\n  void value;\n  // High confidence patterns\n  if (type in HIGH_CONFIDENCE_PATTERNS) {\n    return 0.95;\n  }\n\n  // Medium confidence patterns (require context)\n  if (type === 'name' || type === 'geographic' || type === 'date') {\n    return 0.6;\n  }\n\n  // Lower confidence - could be false positives\n  return 0.4;\n}\n\n/**\n * Check if a pattern match is likely a false positive\n */\nexport function isFalsePositive(type: PHIType, value: string): boolean {\n  // Dates: Allow standalone years\n  if (type === 'date' && /^\\d{4}$/.test(value.trim())) {\n    return true;\n  }\n\n  // Names: Filter out common words\n  if (type === 'name') {\n    const commonWords = ['The', 'This', 'That', 'These', 'Those'];\n    return commonWords.some(word => value.includes(word));\n  }\n\n  // Account numbers: Filter out common test values\n  if (type === 'account_number' && /^(0+|1+|12345678)$/.test(value)) {\n    return true;\n  }\n\n  return false;\n}\n","/**\n * @fileoverview PHI Detection Engine\n * PHI Detection Engine\n * Scans text for HIPAA Safe Harbor 18 identifiers\n * Includes performance caching for repeated detections\n */\n\nimport { cacheDetections, getCachedDetections } from '../../../server/cache/performance';\n\nimport { SAFE_HARBOR_PATTERNS, getConfidenceScore, isFalsePositive } from './safe-harbor';\n\nimport type { PHIDetection, PHIType } from '../types';\n\n/**\n * Detect PHI in text using regex patterns\n * Returns array of detections with positions and confidence scores\n * Results are cached for performance\n */\nexport function detectPHI(\n  text: string,\n  options: {\n    minConfidence?: number;\n    excludeTypes?: PHIType[];\n    useCache?: boolean;\n  } = {},\n): PHIDetection[] {\n  const { minConfidence = 0.5, excludeTypes = [], useCache = true } = options;\n\n  // Check cache first\n  if (useCache) {\n    const cached = getCachedDetections<PHIDetection[]>(text);\n    if (cached) {\n      // Filter cached results based on current options\n      return cached.filter(\n        (d: PHIDetection) => d.confidence >= minConfidence && !excludeTypes.includes(d.type),\n      );\n    }\n  }\n\n  const detections: PHIDetection[] = [];\n\n  // Scan text with each pattern\n  for (const [type, pattern] of Object.entries(SAFE_HARBOR_PATTERNS)) {\n    const phiType = type as PHIType;\n\n    // Skip excluded types\n    if (excludeTypes.includes(phiType)) {\n      continue;\n    }\n\n    // Reset regex lastIndex\n    pattern.lastIndex = 0;\n\n    let match;\n    while ((match = pattern.exec(text)) !== null) {\n      const value = match[0];\n      const start = match.index;\n      const end = start + value.length;\n\n      // Calculate confidence\n      const confidence = getConfidenceScore(phiType, value);\n\n      // Filter low confidence and false positives\n      if (confidence < minConfidence || isFalsePositive(phiType, value)) {\n        continue;\n      }\n\n      detections.push({\n        type: phiType,\n        value,\n        start,\n        end,\n        confidence,\n      });\n    }\n  }\n\n  // Sort by position in text\n  const sorted = detections.sort((a, b) => a.start - b.start);\n\n  // Cache results\n  if (useCache) {\n    cacheDetections(text, sorted);\n  }\n\n  return sorted;\n}\n\n/**\n * Check if text contains any PHI\n */\nexport function containsPHI(text: string, options?: Parameters<typeof detectPHI>[1]): boolean {\n  return detectPHI(text, options).length > 0;\n}\n\n/**\n * Get PHI statistics for text\n */\nexport function analyzePHI(text: string): {\n  hasPHI: boolean;\n  totalDetections: number;\n  byType: Record<PHIType, number>;\n  averageConfidence: number;\n} {\n  const detections = detectPHI(text);\n\n  const byType = detections.reduce(\n    (acc, d) => {\n      acc[d.type] = (acc[d.type] || 0) + 1;\n      return acc;\n    },\n    {} as Record<PHIType, number>,\n  );\n\n  const averageConfidence =\n    detections.length > 0\n      ? detections.reduce((sum, d) => sum + d.confidence, 0) / detections.length\n      : 0;\n\n  return {\n    hasPHI: detections.length > 0,\n    totalDetections: detections.length,\n    byType,\n    averageConfidence,\n  };\n}\n\n/**\n * Validate that text is Safe Harbor compliant\n * Returns true if no PHI detected above threshold\n */\nexport function isSafeHarborCompliant(\n  text: string,\n  minConfidence: number = 0.7,\n): {\n  compliant: boolean;\n  violations: PHIDetection[];\n} {\n  const violations = detectPHI(text, { minConfidence });\n\n  return {\n    compliant: violations.length === 0,\n    violations,\n  };\n}\n","/**\n * @fileoverview PHI Redaction Utilities\n * PHI Redaction Utilities\n * Implements different redaction strategies for HIPAA compliance\n */\n\nimport { createHash } from 'node:crypto';\n\nimport { detectPHI } from './phi-detector';\n\nimport type { PHIDetection, RedactionStrategy } from '../types';\n\n/**\n * Redact PHI from text using specified strategy\n */\nexport function redactPHI(\n  text: string,\n  strategy: RedactionStrategy = 'MASK',\n  options: {\n    customMask?: string;\n    preserveLength?: boolean;\n    minConfidence?: number;\n  } = {},\n): {\n  redacted: string;\n  detections: PHIDetection[];\n} {\n  const { customMask = '[REDACTED]', preserveLength = false, minConfidence } = options;\n\n  // Detect PHI\n  const detections = detectPHI(text, { minConfidence });\n\n  if (detections.length === 0) {\n    return { redacted: text, detections: [] };\n  }\n\n  // Build redacted text by replacing from end to start (preserves indices)\n  let redacted = text;\n  const sortedDetections = [...detections].sort((a, b) => b.start - a.start);\n\n  for (const detection of sortedDetections) {\n    const { start, end, value, type } = detection;\n    const replacement = getRedactionReplacement(value, type, strategy, customMask, preserveLength);\n\n    redacted = redacted.slice(0, start) + replacement + redacted.slice(end);\n  }\n\n  return { redacted, detections };\n}\n\n/**\n * Get replacement text for a detected PHI value\n */\nfunction getRedactionReplacement(\n  value: string,\n  type: string,\n  strategy: RedactionStrategy,\n  customMask: string,\n  preserveLength: boolean,\n): string {\n  switch (strategy) {\n    case 'MASK':\n      if (preserveLength) {\n        return '*'.repeat(value.length);\n      }\n      return customMask;\n\n    case 'HASH':\n      // Use crypto-safe hash for consistency\n      return `[${type.toUpperCase()}_${hashString(value)}]`;\n\n    case 'TOKENIZE':\n      // Reversible tokenization (requires key management)\n      return `[TOKEN_${type.toUpperCase()}_${generateToken(value)}]`;\n\n    default:\n      return customMask;\n  }\n}\n\n/**\n * Cryptographically hash a string for HASH strategy\n * Uses SHA-256 for consistent, secure hashing\n */\nfunction hashString(value: string): string {\n  const hash = createHash('sha256').update(value).digest('hex');\n  return hash.slice(0, 8).toUpperCase();\n}\n\n/**\n * Generate a reversible token (simplified - use proper tokenization in production)\n */\nfunction generateToken(value: string): string {\n  // In production, use a proper tokenization service with key management\n  // Using base64 encoding for reversible tokenization\n  return Buffer.from(value).toString('base64').slice(0, 12);\n}\n\n/**\n * Redact specific PHI types only\n */\nexport function redactSpecificTypes(\n  text: string,\n  types: string[],\n  strategy: RedactionStrategy = 'MASK',\n): {\n  redacted: string;\n  detections: PHIDetection[];\n} {\n  const allDetections = detectPHI(text);\n  const filteredDetections = allDetections.filter(d => types.includes(d.type));\n\n  let redacted = text;\n  const sortedDetections = [...filteredDetections].sort((a, b) => b.start - a.start);\n\n  for (const detection of sortedDetections) {\n    const { start, end, value, type } = detection;\n    const replacement = getRedactionReplacement(value, type, strategy, '[REDACTED]', false);\n    redacted = redacted.slice(0, start) + replacement + redacted.slice(end);\n  }\n\n  return { redacted, detections: filteredDetections };\n}\n\n/**\n * Preview redactions without applying them\n */\nexport function previewRedactions(text: string): {\n  original: string;\n  preview: string;\n  detections: PHIDetection[];\n  stats: {\n    totalPHI: number;\n    byType: Record<string, number>;\n  };\n} {\n  const detections = detectPHI(text);\n\n  let preview = text;\n  const sortedDetections = [...detections].sort((a, b) => b.start - a.start);\n\n  for (const detection of sortedDetections) {\n    const { start, end, type } = detection;\n    const replacement = `[${type.toUpperCase()}]`;\n    preview = preview.slice(0, start) + replacement + preview.slice(end);\n  }\n\n  const byType = detections.reduce(\n    (acc, d) => {\n      acc[d.type] = (acc[d.type] || 0) + 1;\n      return acc;\n    },\n    {} as Record<string, number>,\n  );\n\n  return {\n    original: text,\n    preview,\n    detections,\n    stats: {\n      totalPHI: detections.length,\n      byType,\n    },\n  };\n}\n\n/**\n * Sanitize text for logging (aggressive redaction)\n */\nexport function sanitizeForLogging(text: string): string {\n  const { redacted } = redactPHI(text, 'MASK', {\n    customMask: '[REDACTED]',\n    minConfidence: 0.3, // Lower threshold for logging\n  });\n  return redacted;\n}\n"],"mappings":";;;;;;;AAYA,MAAM,iCAAiC,IAAI,KAAK;;;;AAKhD,SAAgB,eAAe,QAAsB;AACnD,gBAAe,IAAI,OAAO,IAAI,OAAO;;;;;AAMvC,SAAgB,iBAAiB,UAAwB;AACvD,gBAAe,OAAO,SAAS;;;;;AAMjC,SAAgB,cAAwB;AACtC,QAAO,CAAC,GAAG,eAAe,QAAQ,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,WAAW,EAAE,SAAS;;;;;;;AAQ7E,eAAsB,eACpB,SACA,UACA,QAC+B;CAC/B,MAAM,YAAY,KAAK,KAAK;CAC5B,MAAM,oBAA8B,EAAE;CACtC,MAAM,WAAW,aAAa;AAG9B,KAAI,SAAS,WAAW,EACtB,QAAO;EACL,UAAU;GACR,SAAS;GACT,QAAQ;GACR,UAAU;GACX;EACD,mBAAmB,EAAE;EACrB,kBAAkB,KAAK,KAAK,GAAG;EAChC;AAIH,MAAK,MAAM,UAAU,UAAU;AAC7B,oBAAkB,KAAK,OAAO,GAAG;AAEjC,MAAI;GACF,MAAM,WAAW,MAAM,OAAO,SAAS,SAAS,UAAU,OAAO;AAGjE,OAAI,CAAC,SAAS,QACZ,QAAO;IACL;IACA;IACA,kBAAkB,KAAK,KAAK,GAAG;IAChC;WAEI,OAAO;AAEd,UAAO;IACL,UAAU;KACR,SAAS;KACT,QAAQ,4BAA4B,iBAAiB,QAAQ,MAAM,UAAU;KAC7E,UAAU,OAAO;KAClB;IACD;IACA,kBAAkB,KAAK,KAAK,GAAG;IAChC;;;AAKL,QAAO;EACL,UAAU;GACR,SAAS;GACT,UAAU;GACX;EACD;EACA,kBAAkB,KAAK,KAAK,GAAG;EAChC;;;;;AAMH,SAAgB,kBACd,SACA,OACA,SACA,aAAsC,EAAE,EACxC,cAAmD,EAAE,EACxC;AACb,QAAO;EACL,OAAO;GACL,IAAI;GACJ;GACA;GACD;EACD,aAAa;GACX,2BAAW,IAAI,MAAM;GACrB,GAAG;GACJ;EACD;EACD;;;;;AAMH,SAAgB,QAAQ,SAAsB,MAAuB;AACnE,QAAO,QAAQ,MAAM,MAAM,SAAS,KAAK;;;;;AAM3C,SAAgB,WAAW,SAAsB,OAA0B;AACzE,QAAO,MAAM,MAAK,SAAQ,QAAQ,MAAM,MAAM,SAAS,KAAK,CAAC;;;;;AAM/D,SAAgB,YAAY,SAAsB,OAA0B;AAC1E,QAAO,MAAM,OAAM,SAAQ,QAAQ,MAAM,MAAM,SAAS,KAAK,CAAC;;;;;AAMhE,SAAgB,oBAAoB,UAA6B;AAC/D,QAAO,SAAS,gBAAgB,kBAAkB,SAAS,gBAAgB;;;;;AAM7E,SAAgB,MAAM,UAAkB,YAAqC;AAC3E,QAAO;EACL,SAAS;EACT;EACA;EACD;;;;;AAMH,SAAgB,KAAK,UAAkB,QAA8B;AACnE,QAAO;EACL,SAAS;EACT;EACA;EACD;;;;;;;;;;;;;AClKH,MAAM,iCAAiB,IAAI,KAAsB;;;;;;;AAQjD,SAAgB,gBACd,OACA,QACA,MAAc,MACR;CACN,MAAM,MAAM,UAAU,MAAM;AAC5B,gBAAe,IAAI,KAAK;EACtB;EACA,WAAW,KAAK,KAAK;EACrB;EACD,CAAC;AAGF,kBAAiB;AACf,iBAAe,OAAO,IAAI;IACzB,IAAI;;;;;;;AAQT,SAAgB,oBAAuB,OAAwD;CAC7F,MAAM,MAAM,UAAU,MAAM;CAC5B,MAAM,SAAS,eAAe,IAAI,IAAI;AAEtC,KAAI,CAAC,OACH;CAGF,MAAM,QAAQ;AAGd,KAFkB,KAAK,KAAK,GAAG,MAAM,YAAY,MAAM,KAExC;AACb,iBAAe,OAAO,IAAI;AAC1B;;AAGF,QAAO,MAAM;;;;;;;;;;;;;;;ACxCf,MAAa,uBAAgD;CAE3D,KAAK;CAGL,KAAK;CAIL,OAAO;CAIP,KAAK;CAGL,OAAO;CAIP,YACE;CAIF,KAAK;CAGL,MAAM;CAKN,MAAM;CAKN,YACE;CAGF,gBAAgB;CAGhB,gBAAgB;CAGhB,YAAY;CAIZ,WAAW;CAGX,WAAW;CAGX,OAAO;CAGP,iBAAiB;CAClB;;;;AAKD,MAAa,2BAA6D;CACxE,KAAK,qBAAqB;CAC1B,OAAO,qBAAqB;CAC5B,OAAO,qBAAqB;CAC5B,YAAY,qBAAqB;CACjC,KAAK,qBAAqB;CAC3B;;;;;AAMD,SAAgB,mBAAmB,MAAe,OAAuB;AAGvE,KAAI,QAAQ,yBACV,QAAO;AAIT,KAAI,SAAS,UAAU,SAAS,gBAAgB,SAAS,OACvD,QAAO;AAIT,QAAO;;;;;AAMT,SAAgB,gBAAgB,MAAe,OAAwB;AAErE,KAAI,SAAS,UAAU,UAAU,KAAK,MAAM,MAAM,CAAC,CACjD,QAAO;AAIT,KAAI,SAAS,OAEX,QADoB;EAAC;EAAO;EAAQ;EAAQ;EAAS;EAAQ,CAC1C,MAAK,SAAQ,MAAM,SAAS,KAAK,CAAC;AAIvD,KAAI,SAAS,oBAAoB,qBAAqB,KAAK,MAAM,CAC/D,QAAO;AAGT,QAAO;;;;;;;;;;;;;;;;ACnHT,SAAgB,UACd,MACA,UAII,EAAE,EACU;CAChB,MAAM,EAAE,gBAAgB,IAAK,eAAe,EAAE,EAAE,WAAW,SAAS;AAGpE,KAAI,UAAU;EACZ,MAAM,SAAS,oBAAoC,KAAK;AACxD,MAAI,OAEF,QAAO,OAAO,QACX,MAAoB,EAAE,cAAc,iBAAiB,CAAC,aAAa,SAAS,EAAE,KAAK,CACrF;;CAIL,MAAM,aAA6B,EAAE;AAGrC,MAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,qBAAqB,EAAE;EAClE,MAAM,UAAU;AAGhB,MAAI,aAAa,SAAS,QAAQ,CAChC;AAIF,UAAQ,YAAY;EAEpB,IAAI;AACJ,UAAQ,QAAQ,QAAQ,KAAK,KAAK,MAAM,MAAM;GAC5C,MAAM,QAAQ,MAAM;GACpB,MAAM,QAAQ,MAAM;GACpB,MAAM,MAAM,QAAQ,MAAM;GAG1B,MAAM,aAAa,mBAAmB,SAAS,MAAM;AAGrD,OAAI,aAAa,iBAAiB,gBAAgB,SAAS,MAAM,CAC/D;AAGF,cAAW,KAAK;IACd,MAAM;IACN;IACA;IACA;IACA;IACD,CAAC;;;CAKN,MAAM,SAAS,WAAW,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM;AAG3D,KAAI,SACF,iBAAgB,MAAM,OAAO;AAG/B,QAAO;;;;;AAMT,SAAgB,YAAY,MAAc,SAAoD;AAC5F,QAAO,UAAU,MAAM,QAAQ,CAAC,SAAS;;;;;AAM3C,SAAgB,WAAW,MAKzB;CACA,MAAM,aAAa,UAAU,KAAK;CAElC,MAAM,SAAS,WAAW,QACvB,KAAK,MAAM;AACV,MAAI,EAAE,SAAS,IAAI,EAAE,SAAS,KAAK;AACnC,SAAO;IAET,EAAE,CACH;CAED,MAAM,oBACJ,WAAW,SAAS,IAChB,WAAW,QAAQ,KAAK,MAAM,MAAM,EAAE,YAAY,EAAE,GAAG,WAAW,SAClE;AAEN,QAAO;EACL,QAAQ,WAAW,SAAS;EAC5B,iBAAiB,WAAW;EAC5B;EACA;EACD;;;;;;AAOH,SAAgB,sBACd,MACA,gBAAwB,IAIxB;CACA,MAAM,aAAa,UAAU,MAAM,EAAE,eAAe,CAAC;AAErD,QAAO;EACL,WAAW,WAAW,WAAW;EACjC;EACD;;;;;;;;;;;;;AChIH,SAAgB,UACd,MACA,WAA8B,QAC9B,UAII,EAAE,EAIN;CACA,MAAM,EAAE,aAAa,cAAc,iBAAiB,OAAO,kBAAkB;CAG7E,MAAM,aAAa,UAAU,MAAM,EAAE,eAAe,CAAC;AAErD,KAAI,WAAW,WAAW,EACxB,QAAO;EAAE,UAAU;EAAM,YAAY,EAAE;EAAE;CAI3C,IAAI,WAAW;CACf,MAAM,mBAAmB,CAAC,GAAG,WAAW,CAAC,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM;AAE1E,MAAK,MAAM,aAAa,kBAAkB;EACxC,MAAM,EAAE,OAAO,KAAK,OAAO,SAAS;EACpC,MAAM,cAAc,wBAAwB,OAAO,MAAM,UAAU,YAAY,eAAe;AAE9F,aAAW,SAAS,MAAM,GAAG,MAAM,GAAG,cAAc,SAAS,MAAM,IAAI;;AAGzE,QAAO;EAAE;EAAU;EAAY;;;;;AAMjC,SAAS,wBACP,OACA,MACA,UACA,YACA,gBACQ;AACR,SAAQ,UAAR;EACE,KAAK;AACH,OAAI,eACF,QAAO,IAAI,OAAO,MAAM,OAAO;AAEjC,UAAO;EAET,KAAK,OAEH,QAAO,IAAI,KAAK,aAAa,CAAC,GAAG,WAAW,MAAM,CAAC;EAErD,KAAK,WAEH,QAAO,UAAU,KAAK,aAAa,CAAC,GAAG,cAAc,MAAM,CAAC;EAE9D,QACE,QAAO;;;;;;;AAQb,SAAS,WAAW,OAAuB;AAEzC,QADa,WAAW,SAAS,CAAC,OAAO,MAAM,CAAC,OAAO,MAAM,CACjD,MAAM,GAAG,EAAE,CAAC,aAAa;;;;;AAMvC,SAAS,cAAc,OAAuB;AAG5C,QAAO,OAAO,KAAK,MAAM,CAAC,SAAS,SAAS,CAAC,MAAM,GAAG,GAAG;;;;;AAM3D,SAAgB,oBACd,MACA,OACA,WAA8B,QAI9B;CAEA,MAAM,qBADgB,UAAU,KAAK,CACI,QAAO,MAAK,MAAM,SAAS,EAAE,KAAK,CAAC;CAE5E,IAAI,WAAW;CACf,MAAM,mBAAmB,CAAC,GAAG,mBAAmB,CAAC,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM;AAElF,MAAK,MAAM,aAAa,kBAAkB;EACxC,MAAM,EAAE,OAAO,KAAK,OAAO,SAAS;EACpC,MAAM,cAAc,wBAAwB,OAAO,MAAM,UAAU,cAAc,MAAM;AACvF,aAAW,SAAS,MAAM,GAAG,MAAM,GAAG,cAAc,SAAS,MAAM,IAAI;;AAGzE,QAAO;EAAE;EAAU,YAAY;EAAoB;;;;;AAMrD,SAAgB,kBAAkB,MAQhC;CACA,MAAM,aAAa,UAAU,KAAK;CAElC,IAAI,UAAU;CACd,MAAM,mBAAmB,CAAC,GAAG,WAAW,CAAC,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM;AAE1E,MAAK,MAAM,aAAa,kBAAkB;EACxC,MAAM,EAAE,OAAO,KAAK,SAAS;EAC7B,MAAM,cAAc,IAAI,KAAK,aAAa,CAAC;AAC3C,YAAU,QAAQ,MAAM,GAAG,MAAM,GAAG,cAAc,QAAQ,MAAM,IAAI;;CAGtE,MAAM,SAAS,WAAW,QACvB,KAAK,MAAM;AACV,MAAI,EAAE,SAAS,IAAI,EAAE,SAAS,KAAK;AACnC,SAAO;IAET,EAAE,CACH;AAED,QAAO;EACL,UAAU;EACV;EACA;EACA,OAAO;GACL,UAAU,WAAW;GACrB;GACD;EACF;;;;;AAMH,SAAgB,mBAAmB,MAAsB;CACvD,MAAM,EAAE,aAAa,UAAU,MAAM,QAAQ;EAC3C,YAAY;EACZ,eAAe;EAChB,CAAC;AACF,QAAO"}

package/dist/redis-CpsSrF8K.mjs

@@ -0,0 +1,102 @@
+import { logWarn } from "@od-oneapp/shared/logs";
+
+//#region src/caching/adapters/memory.ts
+/**
+* In-memory cache adapter
+* Suitable for development, testing, and single-instance deployments
+*
+* @example
+* ```ts
+* const adapter = new MemoryCacheAdapter({ maxSize: 1000 });
+* const caching = createCachingMiddleware({ adapter });
+* ```
+*/
+var MemoryCacheAdapter = class {
+	cache = /* @__PURE__ */ new Map();
+	maxSize;
+	constructor(options = {}) {
+		this.maxSize = options.maxSize ?? 1e4;
+	}
+	async get(key) {
+		const entry = this.cache.get(key);
+		if (!entry) return null;
+		if (Date.now() > entry.expiresAt) {
+			this.cache.delete(key);
+			return null;
+		}
+		this.cache.delete(key);
+		this.cache.set(key, entry);
+		return structuredClone(entry.value);
+	}
+	async set(key, value, ttl) {
+		if (this.cache.has(key)) this.cache.delete(key);
+		else if (this.cache.size >= this.maxSize) {
+			const oldestKey = this.cache.keys().next().value;
+			if (oldestKey !== void 0) this.cache.delete(oldestKey);
+		}
+		this.cache.set(key, {
+			value: structuredClone(value),
+			expiresAt: Date.now() + ttl * 1e3
+		});
+	}
+	async delete(key) {
+		this.cache.delete(key);
+	}
+	async clear() {
+		this.cache.clear();
+	}
+	/** Get current cache size */
+	get size() {
+		return this.cache.size;
+	}
+};
+
+//#endregion
+//#region src/caching/adapters/redis.ts
+/**
+* Redis cache adapter for distributed deployments
+*/
+/**
+* Redis cache adapter for distributed deployments
+*
+* @example
+* ```ts
+* import { createUpstashRedis } from '../../integrations/redis';
+* const redis = createUpstashRedis({ url: '...', token: '...' });
+* const adapter = new RedisCacheAdapter(redis, { prefix: "ai-cache:" });
+* ```
+*/
+var RedisCacheAdapter = class {
+	redis;
+	prefix;
+	constructor(redis, options = {}) {
+		this.redis = redis;
+		this.prefix = options.prefix ?? "ai-cache:";
+	}
+	getKey(key) {
+		return `${this.prefix}${key}`;
+	}
+	async get(key) {
+		const data = await this.redis.get(this.getKey(key));
+		if (!data) return null;
+		try {
+			return JSON.parse(data);
+		} catch (error) {
+			logWarn(`[RedisCacheAdapter] Failed to parse cached data for key "${key}"`, { error: error instanceof Error ? error : new Error(String(error)) });
+			return null;
+		}
+	}
+	async set(key, value, ttl) {
+		await this.redis.set(this.getKey(key), JSON.stringify(value), "EX", ttl);
+	}
+	async delete(key) {
+		await this.redis.del(this.getKey(key));
+	}
+	async clear() {
+		if (this.redis.flushdb) await this.redis.flushdb();
+	}
+};
+
+//#endregion
+export { MemoryCacheAdapter as n, RedisCacheAdapter as t };
+//# sourceMappingURL=redis-CpsSrF8K.mjs.map

package/dist/redis-CpsSrF8K.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-CpsSrF8K.mjs","names":[],"sources":["../src/caching/adapters/memory.ts","../src/caching/adapters/redis.ts"],"sourcesContent":["/**\n * In-memory cache adapter for development and testing\n */\n\nimport type { CacheAdapter, CachedResponse } from '../types';\n\ninterface CacheEntry {\n  value: CachedResponse;\n  expiresAt: number;\n}\n\n/**\n * In-memory cache adapter\n * Suitable for development, testing, and single-instance deployments\n *\n * @example\n * ```ts\n * const adapter = new MemoryCacheAdapter({ maxSize: 1000 });\n * const caching = createCachingMiddleware({ adapter });\n * ```\n */\nexport class MemoryCacheAdapter implements CacheAdapter {\n  private cache = new Map<string, CacheEntry>();\n  private maxSize: number;\n\n  constructor(options: { maxSize?: number } = {}) {\n    this.maxSize = options.maxSize ?? 10000;\n  }\n\n  async get(key: string): Promise<CachedResponse | null> {\n    const entry = this.cache.get(key);\n\n    if (!entry) return null;\n\n    if (Date.now() > entry.expiresAt) {\n      this.cache.delete(key);\n      return null;\n    }\n\n    // Refresh recency for LRU by re-inserting\n    this.cache.delete(key);\n    this.cache.set(key, entry);\n    // Return a clone to prevent external mutation of cached data\n    return structuredClone(entry.value);\n  }\n\n  async set(key: string, value: CachedResponse, ttl: number): Promise<void> {\n    // LRU eviction if at capacity\n    if (this.cache.has(key)) {\n      // Delete first to refresh position (move to end)\n      this.cache.delete(key);\n    } else if (this.cache.size >= this.maxSize) {\n      const oldestKey = this.cache.keys().next().value;\n      // Use !== undefined to handle empty-string keys correctly\n      if (oldestKey !== undefined) this.cache.delete(oldestKey);\n    }\n\n    // Clone value to prevent external mutation affecting cached data\n    this.cache.set(key, {\n      value: structuredClone(value),\n      expiresAt: Date.now() + ttl * 1000,\n    });\n  }\n\n  async delete(key: string): Promise<void> {\n    this.cache.delete(key);\n  }\n\n  async clear(): Promise<void> {\n    this.cache.clear();\n  }\n\n  /** Get current cache size */\n  get size(): number {\n    return this.cache.size;\n  }\n}\n","/**\n * Redis cache adapter for distributed deployments\n */\n\nimport { logWarn } from '@repo/shared/logs';\n\nimport type { RedisClient } from '../../integrations/redis';\nimport type { CacheAdapter, CachedResponse } from '../types';\n\n/**\n * Redis cache adapter for distributed deployments\n *\n * @example\n * ```ts\n * import { createUpstashRedis } from '../../integrations/redis';\n * const redis = createUpstashRedis({ url: '...', token: '...' });\n * const adapter = new RedisCacheAdapter(redis, { prefix: \"ai-cache:\" });\n * ```\n */\nexport class RedisCacheAdapter implements CacheAdapter {\n  private redis: RedisClient;\n  private prefix: string;\n\n  constructor(redis: RedisClient, options: { prefix?: string } = {}) {\n    this.redis = redis;\n    this.prefix = options.prefix ?? 'ai-cache:';\n  }\n\n  private getKey(key: string): string {\n    return `${this.prefix}${key}`;\n  }\n\n  async get(key: string): Promise<CachedResponse | null> {\n    const data = await this.redis.get(this.getKey(key));\n    if (!data) return null;\n\n    try {\n      return JSON.parse(data) as CachedResponse;\n    } catch (error) {\n      logWarn(`[RedisCacheAdapter] Failed to parse cached data for key \"${key}\"`, {\n        error: error instanceof Error ? error : new Error(String(error)),\n      });\n      return null;\n    }\n  }\n\n  async set(key: string, value: CachedResponse, ttl: number): Promise<void> {\n    await this.redis.set(this.getKey(key), JSON.stringify(value), 'EX', ttl);\n  }\n\n  async delete(key: string): Promise<void> {\n    await this.redis.del(this.getKey(key));\n  }\n\n  async clear(): Promise<void> {\n    if (this.redis.flushdb) {\n      await this.redis.flushdb();\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAqBA,IAAa,qBAAb,MAAwD;CACtD,AAAQ,wBAAQ,IAAI,KAAyB;CAC7C,AAAQ;CAER,YAAY,UAAgC,EAAE,EAAE;AAC9C,OAAK,UAAU,QAAQ,WAAW;;CAGpC,MAAM,IAAI,KAA6C;EACrD,MAAM,QAAQ,KAAK,MAAM,IAAI,IAAI;AAEjC,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI,KAAK,KAAK,GAAG,MAAM,WAAW;AAChC,QAAK,MAAM,OAAO,IAAI;AACtB,UAAO;;AAIT,OAAK,MAAM,OAAO,IAAI;AACtB,OAAK,MAAM,IAAI,KAAK,MAAM;AAE1B,SAAO,gBAAgB,MAAM,MAAM;;CAGrC,MAAM,IAAI,KAAa,OAAuB,KAA4B;AAExE,MAAI,KAAK,MAAM,IAAI,IAAI,CAErB,MAAK,MAAM,OAAO,IAAI;WACb,KAAK,MAAM,QAAQ,KAAK,SAAS;GAC1C,MAAM,YAAY,KAAK,MAAM,MAAM,CAAC,MAAM,CAAC;AAE3C,OAAI,cAAc,OAAW,MAAK,MAAM,OAAO,UAAU;;AAI3D,OAAK,MAAM,IAAI,KAAK;GAClB,OAAO,gBAAgB,MAAM;GAC7B,WAAW,KAAK,KAAK,GAAG,MAAM;GAC/B,CAAC;;CAGJ,MAAM,OAAO,KAA4B;AACvC,OAAK,MAAM,OAAO,IAAI;;CAGxB,MAAM,QAAuB;AAC3B,OAAK,MAAM,OAAO;;;CAIpB,IAAI,OAAe;AACjB,SAAO,KAAK,MAAM;;;;;;;;;;;;;;;;;;;ACvDtB,IAAa,oBAAb,MAAuD;CACrD,AAAQ;CACR,AAAQ;CAER,YAAY,OAAoB,UAA+B,EAAE,EAAE;AACjE,OAAK,QAAQ;AACb,OAAK,SAAS,QAAQ,UAAU;;CAGlC,AAAQ,OAAO,KAAqB;AAClC,SAAO,GAAG,KAAK,SAAS;;CAG1B,MAAM,IAAI,KAA6C;EACrD,MAAM,OAAO,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,IAAI,CAAC;AACnD,MAAI,CAAC,KAAM,QAAO;AAElB,MAAI;AACF,UAAO,KAAK,MAAM,KAAK;WAChB,OAAO;AACd,WAAQ,4DAA4D,IAAI,IAAI,EAC1E,OAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,MAAM,CAAC,EACjE,CAAC;AACF,UAAO;;;CAIX,MAAM,IAAI,KAAa,OAAuB,KAA4B;AACxE,QAAM,KAAK,MAAM,IAAI,KAAK,OAAO,IAAI,EAAE,KAAK,UAAU,MAAM,EAAE,MAAM,IAAI;;CAG1E,MAAM,OAAO,KAA4B;AACvC,QAAM,KAAK,MAAM,IAAI,KAAK,OAAO,IAAI,CAAC;;CAGxC,MAAM,QAAuB;AAC3B,MAAI,KAAK,MAAM,QACb,OAAM,KAAK,MAAM,SAAS"}

package/dist/redis-CwguYFGh.d.mts

@@ -0,0 +1,33 @@
+import { t as RedisClient } from "./types-By-r93bE.mjs";
+import { r as CachedResponse, t as CacheAdapter } from "./types-BPnq3GQo.mjs";
+
+//#region src/caching/adapters/memory.d.ts
+declare class MemoryCacheAdapter implements CacheAdapter {
+  private cache;
+  private maxSize;
+  constructor(options?: {
+    maxSize?: number;
+  });
+  get(key: string): Promise<CachedResponse | null>;
+  set(key: string, value: CachedResponse, ttl: number): Promise<void>;
+  delete(key: string): Promise<void>;
+  clear(): Promise<void>;
+  get size(): number;
+}
+//#endregion
+//#region src/caching/adapters/redis.d.ts
+declare class RedisCacheAdapter implements CacheAdapter {
+  private redis;
+  private prefix;
+  constructor(redis: RedisClient, options?: {
+    prefix?: string;
+  });
+  private getKey;
+  get(key: string): Promise<CachedResponse | null>;
+  set(key: string, value: CachedResponse, ttl: number): Promise<void>;
+  delete(key: string): Promise<void>;
+  clear(): Promise<void>;
+}
+//#endregion
+export { MemoryCacheAdapter as n, RedisCacheAdapter as t };
+//# sourceMappingURL=redis-CwguYFGh.d.mts.map

package/dist/redis-CwguYFGh.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-CwguYFGh.d.mts","names":[],"sources":["../src/caching/adapters/memory.ts","../src/caching/adapters/redis.ts"],"mappings":";;;;cAqBa,kBAAA,YAA8B,YAAA;EAAA,QACjC,KAAA;EAAA,QACA,OAAA;cAEI,OAAA;IAAW,OAAA;EAAA;EAIjB,GAAA,CAAI,GAAA,WAAc,OAAA,CAAQ,cAAA;EAiB1B,GAAA,CAAI,GAAA,UAAa,KAAA,EAAO,cAAA,EAAgB,GAAA,WAAc,OAAA;EAkBtD,MAAA,CAAO,GAAA,WAAc,OAAA;EAIrB,KAAA,CAAA,GAAS,OAAA;EAAA,IAKX,IAAA,CAAA;AAAA;;;cCtDO,iBAAA,YAA6B,YAAA;EAAA,QAChC,KAAA;EAAA,QACA,MAAA;cAEI,KAAA,EAAO,WAAA,EAAa,OAAA;IAAW,MAAA;EAAA;EAAA,QAKnC,MAAA;EAIF,GAAA,CAAI,GAAA,WAAc,OAAA,CAAQ,cAAA;EAc1B,GAAA,CAAI,GAAA,UAAa,KAAA,EAAO,cAAA,EAAgB,GAAA,WAAc,OAAA;EAItD,MAAA,CAAO,GAAA,WAAc,OAAA;EAIrB,KAAA,CAAA,GAAS,OAAA;AAAA"}