atabey 0.0.16 → 0.0.18

package/framework-mcp/dist/src/shared/logger.js

@@ -1,126 +0,0 @@
-import chalk from "chalk";
-import path from "path";
-import { appendFile, ensureDir } from "./fs.js";
-import { containsPII, maskObject, maskText } from "./pii.js";
-export var LogLevel;
-(function (LogLevel) {
-    LogLevel[LogLevel["DEBUG"] = 0] = "DEBUG";
-    LogLevel[LogLevel["INFO"] = 1] = "INFO";
-    LogLevel[LogLevel["WARN"] = 2] = "WARN";
-    LogLevel[LogLevel["ERROR"] = 3] = "ERROR";
-    LogLevel[LogLevel["FATAL"] = 4] = "FATAL";
-})(LogLevel || (LogLevel = {}));
-export class EnterpriseLogger {
-    config;
-    static instance;
-    constructor() {
-        const isProd = process.env.NODE_ENV === "production";
-        this.config = {
-            minLevel: isProd ? LogLevel.INFO : LogLevel.DEBUG,
-            enableColors: !isProd,
-            jsonFormat: isProd,
-            enablePiiMasking: true, // KVKK: PII masking ON by default
-            piiWarning: true,
-        };
-    }
-    static getInstance() {
-        if (!EnterpriseLogger.instance) {
-            EnterpriseLogger.instance = new EnterpriseLogger();
-        }
-        return EnterpriseLogger.instance;
-    }
-    configure(config) {
-        this.config = { ...this.config, ...config };
-        if (this.config.logFile) {
-            try {
-                ensureDir(path.dirname(this.config.logFile));
-            }
-            catch (err) {
-                // Directly write to stderr — using console here would be circular
-                process.stderr.write(`[Logger] Failed to create log directory: ${err}\n`);
-            }
-        }
-    }
-    formatMessage(level, message, meta) {
-        const timestamp = new Date().toISOString();
-        const pid = process.pid;
-        // [KVKK] PII masking — mask sensitive data before logging
-        const safeMessage = this.config.enablePiiMasking ? maskText(message) : message;
-        const safeMeta = this.config.enablePiiMasking && meta ? maskObject(meta) : meta;
-        // [KVKK] Warn if PII detected in production
-        if (this.config.piiWarning && (containsPII(message) || (meta && containsPII(JSON.stringify(meta))))) {
-            process.stderr.write(`[PII WARNING] Potential PII detected in log at ${timestamp}\n`);
-        }
-        if (this.config.jsonFormat) {
-            return JSON.stringify({
-                timestamp,
-                level: LogLevel[level],
-                pid,
-                message: safeMessage,
-                meta: safeMeta,
-            });
-        }
-        const levelName = LogLevel[level].padEnd(5);
-        let coloredLevel = levelName;
-        if (this.config.enableColors) {
-            switch (level) {
-                case LogLevel.DEBUG:
-                    coloredLevel = chalk.blue(levelName);
-                    break;
-                case LogLevel.INFO:
-                    coloredLevel = chalk.green(levelName);
-                    break;
-                case LogLevel.WARN:
-                    coloredLevel = chalk.yellow(levelName);
-                    break;
-                case LogLevel.ERROR:
-                    coloredLevel = chalk.red(levelName);
-                    break;
-                case LogLevel.FATAL:
-                    coloredLevel = chalk.bgRed.white.bold(levelName);
-                    break;
-            }
-        }
-        const metaStr = safeMeta ? ` | Meta: ${JSON.stringify(safeMeta)}` : "";
-        return `[${timestamp}] [PID:${pid}] [${coloredLevel}]: ${safeMessage}${metaStr}`;
-    }
-    log(level, message, meta) {
-        if (level < this.config.minLevel)
-            return;
-        const formatted = this.formatMessage(level, message, meta);
-        // Route to stderr for ERROR/FATAL, stdout otherwise.
-        // Using process.write directly here is intentional — this IS the logger.
-        if (level >= LogLevel.ERROR) {
-            process.stderr.write(formatted + "\n");
-        }
-        else {
-            process.stdout.write(formatted + "\n");
-        }
-        // Output to file if configured
-        if (this.config.logFile) {
-            try {
-                appendFile(this.config.logFile, formatted + "\n");
-            }
-            catch (err) {
-                // Directly write to stderr — using console here would be circular
-                process.stderr.write(`[Logger] Failed to write to log file: ${err}\n`);
-            }
-        }
-    }
-    debug(message, meta) {
-        this.log(LogLevel.DEBUG, message, meta);
-    }
-    info(message, meta) {
-        this.log(LogLevel.INFO, message, meta);
-    }
-    warn(message, meta) {
-        this.log(LogLevel.WARN, message, meta);
-    }
-    error(message, meta) {
-        this.log(LogLevel.ERROR, message, meta);
-    }
-    fatal(message, meta) {
-        this.log(LogLevel.FATAL, message, meta);
-    }
-}
-export const logger = EnterpriseLogger.getInstance();

package/framework-mcp/dist/src/shared/pii.js

@@ -1,212 +0,0 @@
-/**
- * [PII] Personally Identifiable Information Masking Service
- *
- * Detects and masks sensitive data in compliance with KVKK/GDPR.
- * Used in audit log, logger, storage layers, and MCP middleware.
- *
- * Supported patterns:
- * - Email addresses
- * - Phone numbers (international, Turkish, US, UK)
- * - TC Identification number (11 digits)
- * - API keys / tokens (OpenAI, Anthropic, Google, GitHub, generic)
- * - Bearer tokens / JWTs
- * - IP addresses (IPv4, IPv6)
- * - Credit card numbers (AMEX, Visa, Mastercard, etc.)
- * - Password / secret fields in structured data
- * - Bank account / IBAN
- * - Date of birth / full address patterns
- * - Custom names (configurable)
- */
-// Sensitive patterns to detect and mask
-// IMPORTANT: More specific patterns MUST come before generic ones
-const SENSITIVE_PATTERNS = [
-    // JWT tokens (complete JWT format) - must be before Bearer
-    { pattern: /eyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+/g, replacement: "***-JWT-REDACTED-***" },
-    // Bearer tokens in Authorization headers
-    { pattern: /Bearer\s+[a-zA-Z0-9._-]+/g, replacement: "Bearer ***-REDACTED-***" },
-    // Basic auth in Authorization headers
-    { pattern: /Basic\s+[a-zA-Z0-9=+/]+/g, replacement: "Basic ***-REDACTED-***" },
-    // API keys (common formats) - must be before generic patterns
-    // Note: ghp_ tokens can contain digits that look like phone numbers, so we mask the entire prefix + suffix
-    { pattern: /\b(sk-[a-zA-Z0-9]{20,}|pk-[a-zA-Z0-9]{20,}|xai-[a-zA-Z0-9]{20,}|AIza[0-9A-Za-z_-]{35}|ghp_[a-zA-Z0-9]{36,}|gho_[a-zA-Z0-9]{36,}|ghu_[a-zA-Z0-9]{36,}|ghb_[a-zA-Z0-9]{36,}|github_pat_[a-zA-Z0-9]{36,}|sk-[a-zA-Z0-9_-]{32,}|sk-[a-zA-Z0-9]{48,}|whsec_[a-zA-Z0-9]{16,})\b/g, replacement: "***-REDACTED-***" },
-    // Social Security Number (US SSN: XXX-XX-XXXX) - must be before generic phone
-    { pattern: /\b(?!000|666|9[0-9]{2})\d{3}-(?!00)\d{2}-(?!0000)\d{4}\b/g, replacement: "***-**-****" },
-    // Date of birth patterns - must be before generic phone
-    { pattern: /\b(0[1-9]|[12][0-9]|3[01])[/.-](0[1-9]|1[0-2])[/.-](19[0-9]{2}|20[0-9]{2})\b/g, replacement: "**/**/****" },
-    // IBAN (international bank account) - must be before generic alphanumeric patterns
-    // Only matches valid IBAN format: 2 letters + 2 digits + 4-30 alphanumeric chars
-    // More specific: requires minimum 8 chars total, starts with country code
-    { pattern: /\b[A-Z]{2}[0-9]{2}[A-Z0-9]{4,30}\b/g, replacement: "****-IBAN-REDACTED-****" },
-    // TC Kimlik (11 digits starting with 1-9, isolated word boundary) - must be before phone
-    { pattern: /\b[1-9][0-9]{10}\b/g, replacement: "***********" },
-    // Email
-    { pattern: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g, replacement: "***@***" },
-    // Phone (Turkish: +90 5xx xxx xx xx) - specific before generic
-    { pattern: /(\+90|0)?\s?[0-9]{3}\s?[0-9]{3}\s?[0-9]{2}\s?[0-9]{2}/g, replacement: "***-***-****" },
-    // Phone (international: +90, +1, +44, +49, +33, etc.) - generic, keep last among phones
-    { pattern: /(\+\d{1,2}[\s-]?)?\(?\d{2,4}\)?[\s-]?\d{2,4}[\s-]?\d{2,4}[\s-]?\d{2,4}/g, replacement: "***-***-****" },
-    // IP addresses (IPv4)
-    { pattern: /\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/g, replacement: "***.***.***.***" },
-    // IP addresses (IPv6 - simplified)
-    { pattern: /\b(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}\b/g, replacement: "****:****:****:****" },
-    // IPv6 compressed
-    { pattern: /\b(?:[0-9a-fA-F]{0,4}:){2,7}[0-9a-fA-F]{0,4}\b/g, replacement: "****:****:****" },
-    // Credit card (16 digits, optional spaces/dashes)
-    { pattern: /\b(?:\d[ -]*?){13,16}\b/g, replacement: "****-****-****-****" },
-    // AMEX (15 digits, starts with 34/37)
-    { pattern: /\b3[47][0-9\s-]{13,14}\b/g, replacement: "****-****-***" },
-    // Password fields in JSON
-    { pattern: /"(password|passwd|secret|api_key|apiKey|apikey|auth_token|refresh_token|access_token)"\s*:\s*"[^"]+"/gi, replacement: "\"$1\": \"***-REDACTED-***\"" },
-    // Turkish address patterns (optional - sokak, cadde, mahalle, no:)
-    { pattern: /(?:no|no:|numara)[:\s]*\d+/gi, replacement: "no: ****" },
-];
-// Fields that are considered sensitive and should always be redacted in structured data
-const SENSITIVE_FIELDS = [
-    "password", "passwd", "secret", "apiKey", "api_key", "apikey",
-    "token", "accessToken", "access_token", "refreshToken", "refresh_token", "authToken", "auth_token",
-    "authorization", "Authorization", "bearer",
-    "email", "e_mail", "eMail",
-    "phone", "phoneNumber", "phone_number", "telephone", "telephoneNumber", "mobile", "mobilePhone", "cellPhone",
-    "creditCard", "credit_card", "ccNumber", "cc_number", "ccn", "cvv", "cvv2", "cvc",
-    "ssn", "socialSecurity", "social_security",
-    "tcKimlik", "tc_kimlik", "identityNumber", "identity_number", "idNumber", "id_number", "nationalId",
-    "ipAddress", "ip_address", "ip",
-    "dob", "dateOfBirth", "date_of_birth", "birthDate", "birth_date",
-    "iban", "IBAN", "bankAccount", "bank_account",
-    "address", "homeAddress", "workAddress", "billingAddress", "shippingAddress",
-    "fullName", "firstName", "lastName", "surname", "middleName",
-];
-/**
- * Mask sensitive data in a text string.
- */
-export function maskText(text) {
-    if (!text || typeof text !== "string")
-        return text;
-    let masked = text;
-    for (const { pattern, replacement } of SENSITIVE_PATTERNS) {
-        masked = masked.replace(pattern, replacement);
-    }
-    return masked;
-}
-/**
- * Recursively mask sensitive fields in an object.
- * Returns a new object with sensitive values redacted.
- * Strict mode: when true, also masks values in objects even if the key
- * is not a known sensitive field name (catches data passed to unknown schemas).
- */
-export function maskObject(obj, depth = 0, strictMode = false) {
-    if (depth > 10)
-        return obj; // Prevent infinite recursion
-    if (obj === null || obj === undefined)
-        return obj;
-    if (typeof obj === "string")
-        return maskText(obj);
-    if (typeof obj !== "object")
-        return obj;
-    if (Array.isArray(obj)) {
-        return obj.map(item => maskObject(item, depth + 1, strictMode));
-    }
-    const result = {};
-    for (const [key, value] of Object.entries(obj)) {
-        // Check if the key itself is a sensitive field
-        if (SENSITIVE_FIELDS.includes(key)) {
-            result[key] = typeof value === "string" ? "***-REDACTED-***" : maskObject(value, depth + 1, strictMode);
-        }
-        else if (typeof value === "string") {
-            result[key] = maskText(value);
-        }
-        else if (typeof value === "object") {
-            result[key] = maskObject(value, depth + 1, strictMode);
-        }
-        else {
-            result[key] = value;
-        }
-    }
-    return result;
-}
-/**
- * Check if a string contains potential PII.
- * Useful for warning before sending data to external APIs.
- */
-export function containsPII(text) {
-    for (const { pattern } of SENSITIVE_PATTERNS) {
-        if (pattern.test(text))
-            return true;
-    }
-    return false;
-}
-/**
- * Check if an object contains PII in any of its string values (recursive).
- */
-export function containsPIIInObject(obj, depth = 0) {
-    if (depth > 10)
-        return false;
-    if (obj === null || obj === undefined)
-        return false;
-    if (typeof obj === "string")
-        return containsPII(obj);
-    if (typeof obj !== "object")
-        return false;
-    if (Array.isArray(obj)) {
-        return obj.some(item => containsPIIInObject(item, depth + 1));
-    }
-    for (const [, value] of Object.entries(obj)) {
-        if (typeof value === "string") {
-            if (containsPII(value))
-                return true;
-        }
-        else if (typeof value === "object") {
-            if (containsPIIInObject(value, depth + 1))
-                return true;
-        }
-    }
-    return false;
-}
-/**
- * Classify a piece of data based on content analysis.
- */
-export function classifyData(text) {
-    if (!text)
-        return "public";
-    // Check for highly sensitive / critical data
-    if (/\b(sk-[a-zA-Z0-9]{20,}|Bearer\s+|eyJ[a-zA-Z0-9_-]+\.)/.test(text) ||
-        /\b[1-9][0-9]{10}\b/.test(text) ||
-        /"(password|secret|apiKey)"/i.test(text) ||
-        /\b[A-Z]{2}[0-9]{2}[A-Z0-9]{1,30}\b/.test(text) // IBAN
-    ) {
-        return "restricted";
-    }
-    // Check for personally identifiable / confidential data
-    if (/[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/.test(text) ||
-        /(\+90|0)?\s?[0-9]{3}\s?[0-9]{3}\s?[0-9]{2}\s?[0-9]{2}/.test(text) ||
-        /\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/.test(text) ||
-        /\b(0[1-9]|[12][0-9]|3[01])[/.-](0[1-9]|1[0-2])[/.-](19[0-9]{2}|20[0-9]{2})\b/.test(text)) {
-        return "confidential";
-    }
-    return "internal";
-}
-/**
- * Mask the content field of an MCP tool result.
- * This is used by the MCP middleware layer to automatically
- * sanitize all tool outputs before they reach the AI.
- */
-export function maskToolResult(result) {
-    if (!result || !result.content)
-        return result;
-    return {
-        ...result,
-        content: result.content.map(block => ({
-            ...block,
-            text: block.type === "text" ? maskText(block.text) : block.text,
-        })),
-    };
-}
-/**
- * Mask sensitive arguments in an MCP tool call.
- * This is applied BEFORE the tool handler executes, ensuring
- * PII never reaches any processing layer unnecessarily.
- */
-export function maskToolArgs(args) {
-    const masked = maskObject(args, 0, true);
-    return masked;
-}

package/framework-mcp/dist/src/shared/retention.js

@@ -1,170 +0,0 @@
-/**
- * [KVKK/GDPR] Data Retention & Privacy Service
- *
- * KVKK Art. 4, 5, 7, 11 and GDPR Art. 5, 17 compliant data retention management.
- *
- * Features:
- * - Automatic expired record cleanup
- * - Data categorization (operational, user_data, api_call, security, compliance)
- * - "Right to Erasure" support
- * - Configurable retention policies
- * - Periodic cleanup cron job
- */
-import { Audit } from "./audit.js";
-import { logger } from "./logger.js";
-import { Storage } from "./storage.js";
-/**
- * Data retention categories and default durations (days)
- */
-export const RETENTION_POLICIES = {
-    OPERATIONAL: 30, // Operational logs: 30 days
-    USER_DATA: 90, // User data: 90 days (KVKK Art. 5)
-    API_CALL: 180, // API call records: 180 days
-    SECURITY: 365, // Security logs: 1 year
-    COMPLIANCE: 730, // Compliance records: 2 years
-};
-/**
- * [KVKK/GDPR] Data Retention Manager
- */
-export class DataRetention {
-    static cleanupInterval = null;
-    /**
-   * Initialize data retention with automatic cleanup.
-   * Starts a periodic cleanup job.
-   *
-   * @param intervalMs Cleanup interval in milliseconds (default: 1 hour)
-   */
-    static initialize(intervalMs = 3600000) {
-        // Run initial cleanup
-        this.runCleanup();
-        // Schedule periodic cleanup
-        if (this.cleanupInterval) {
-            clearInterval(this.cleanupInterval);
-        }
-        this.cleanupInterval = setInterval(() => this.runCleanup(), intervalMs);
-        logger.info("[RETENTION] Data retention initialized. " +
-            `Cleanup interval: ${intervalMs / 60000}min. ` +
-            `Policies: ${Object.entries(RETENTION_POLICIES).map(([k, v]) => `${k}=${v}d`).join(", ")}`);
-    }
-    /**
-   * Run cleanup for all data stores.
-   * Cleans audit logs, messages, and logs based on retention policies.
-   */
-    static runCleanup() {
-        const result = { audit: 0, messages: 0, logs: 0 };
-        try {
-            // 1. Clean audit logs
-            result.audit = Audit.cleanExpired();
-            // 2. Clean old messages (Hermes message queue)
-            result.messages = this.cleanOldMessages();
-            // 3. Clean old logs
-            result.logs = this.cleanOldLogs();
-            if (result.audit > 0 || result.messages > 0 || result.logs > 0) {
-                logger.info("[RETENTION] Cleanup complete: " +
-                    `${result.audit} audit, ${result.messages} messages, ${result.logs} logs`);
-            }
-        }
-        catch (error) {
-            logger.error(`[RETENTION] Cleanup failed: ${error.message}`);
-        }
-        return result;
-    }
-    /**
-   * [KVKK Art. 7] "Right to Erasure" — Deletes all data for a given trace ID.
-   * Cleans audit records, messages, logs, and tasks.
-   *
-   * @param traceId Trace ID to erase
-   * @returns Total number of deleted records
-   */
-    static eraseTraceData(traceId) {
-        let total = 0;
-        // Audit logs
-        total += Audit.deleteByFilter({ traceId });
-        // Messages
-        const db = Storage.getDB();
-        const msgResult = db.prepare("DELETE FROM messages WHERE trace_id = ?").run(traceId);
-        total += msgResult.changes;
-        // Tasks
-        const taskResult = db.prepare("DELETE FROM tasks WHERE trace_id = ?").run(traceId);
-        total += taskResult.changes;
-        // Logs
-        const logResult = db.prepare("DELETE FROM logs WHERE trace_id = ?").run(traceId);
-        total += logResult.changes;
-        logger.info(`[RETENTION] Trace ${traceId} erased: ${total} records deleted (KVKK Article 7)`);
-        return total;
-    }
-    /**
-   * [KVKK Art. 11] Erases all data.
-   * Only works with the confirmation code.
-   */
-    static eraseAllData(confirmationCode) {
-        if (confirmationCode !== "KVKK-RIGHT-TO-ERASURE") {
-            throw new Error("[RETENTION] Invalid confirmation code. Use 'KVKK-RIGHT-TO-ERASURE'");
-        }
-        let total = 0;
-        const db = Storage.getDB();
-        total += Audit.clearAll(confirmationCode);
-        total += db.prepare("DELETE FROM messages").run().changes;
-        total += db.prepare("DELETE FROM tasks").run().changes;
-        total += db.prepare("DELETE FROM logs").run().changes;
-        total += db.prepare("DELETE FROM agents").run().changes;
-        total += db.prepare("DELETE FROM metadata").run().changes;
-        logger.warn(`[RETENTION] ALL DATA ERASED: ${total} records (KVKK Article 7 - Right to Erasure)`);
-        return total;
-    }
-    /**
-   * Get retention statistics.
-   */
-    static getStats() {
-        const db = Storage.getDB();
-        const auditExpired = db.prepare(`
-        SELECT COUNT(*) as count FROM audit_log
-        WHERE retentionDays IS NOT NULL
-        AND timestamp < datetime('now', '-' || retentionDays || ' days')
-      `).get().count;
-        const messageCount = db.prepare("SELECT COUNT(*) as count FROM messages").get().count;
-        const logCount = db.prepare("SELECT COUNT(*) as count FROM logs").get().count;
-        const taskCount = db.prepare("SELECT COUNT(*) as count FROM tasks").get().count;
-        return {
-            auditExpired,
-            messageCount,
-            logCount,
-            taskCount,
-            policies: { ...RETENTION_POLICIES },
-        };
-    }
-    /**
-   * Stop the periodic cleanup job.
-   */
-    static shutdown() {
-        if (this.cleanupInterval) {
-            clearInterval(this.cleanupInterval);
-            this.cleanupInterval = null;
-            logger.info("[RETENTION] Cleanup job stopped");
-        }
-    }
-    /**
-   * Clean old messages from the Hermes queue.
-   * Messages older than 30 days are removed.
-   */
-    static cleanOldMessages() {
-        const db = Storage.getDB();
-        const result = db.prepare(`
-      DELETE FROM messages
-      WHERE timestamp < datetime('now', '-30 days')
-    `).run();
-        return result.changes;
-    }
-    /**
-   * Clean old logs.
-   * Logs older than 30 days are removed.
-   */
-    static cleanOldLogs() {
-        const db = Storage.getDB();
-        const result = db.prepare(`
-      DELETE FROM logs
-      WHERE timestamp < datetime('now', '-30 days')
-    `).run();
-        return result.changes;
-    }
-}