claude-flow-novice 2.15.3 → 2.15.5

package/dist/lib/edge-case-deduplicator.js

@@ -0,0 +1,227 @@
+/**
+ * Edge Case Deduplicator
+ *
+ * Handles deduplication of edge cases using SHA-256 signatures.
+ * Normalizes context to detect similar errors with different IDs, timestamps, or numbers.
+ */ import * as crypto from 'crypto';
+export class EdgeCaseDeduplicator {
+    /**
+   * Generate SHA-256 signature for edge case deduplication
+   *
+   * Signature is based on:
+   * - Type
+   * - Category
+   * - Normalized error message
+   * - Normalized stack trace
+   *
+   * @param edgeCase Edge case input
+   * @returns SHA-256 signature (64 hex characters)
+   */ generateSignature(edgeCase) {
+        const normalizedContext = this.normalizeContext(edgeCase.context);
+        const signatureData = {
+            type: edgeCase.type,
+            category: edgeCase.category,
+            context: normalizedContext
+        };
+        const signatureString = JSON.stringify(signatureData);
+        const hash = crypto.createHash('sha256');
+        hash.update(signatureString);
+        return hash.digest('hex');
+    }
+    /**
+   * Normalize context for deduplication
+   *
+   * Replaces variable data with placeholders:
+   * - Dates/timestamps → {date}
+   * - IDs (hex, alphanumeric) → {id}
+   * - Numbers → {number}
+   * - File paths → normalized paths
+   * - Line numbers in stack traces → {line}
+   *
+   * @param context Edge case context object
+   * @returns Normalized JSON string
+   */ normalizeContext(context) {
+        const normalized = this.deepNormalize(context);
+        return JSON.stringify(normalized, null, 0);
+    }
+    /**
+   * Normalize stack trace for deduplication
+   *
+   * Removes:
+   * - Line numbers
+   * - Column numbers
+   * - Absolute file paths (keep relative paths)
+   * - Memory addresses
+   *
+   * @param stackTrace Stack trace string
+   * @returns Normalized stack trace
+   */ normalizeStackTrace(stackTrace) {
+        let normalized = stackTrace;
+        // Normalize line and column numbers: ":42:10" → ":{line}:{col}"
+        normalized = normalized.replace(/:(\d+):(\d+)/g, ':{line}:{col}');
+        // Normalize single line numbers: ":42)" → ":{line})"
+        normalized = normalized.replace(/:(\d+)\)/g, ':{line})');
+        // Normalize absolute paths to relative
+        // /app/src/file.js → src/file.js
+        // /home/user/project/file.js → file.js
+        normalized = normalized.replace(/\/[a-zA-Z0-9_\-\/]+\//g, (match)=>{
+            // Keep only the last 2 path segments
+            const segments = match.split('/').filter((s)=>s.length > 0);
+            return segments.slice(-2).join('/') + '/';
+        });
+        // Normalize memory addresses: 0x7f1234567890 → {addr}
+        normalized = normalized.replace(/0x[0-9a-f]+/gi, '{addr}');
+        return normalized;
+    }
+    /**
+   * Deep normalize an object or string
+   *
+   * Recursively processes objects and arrays,
+   * normalizing strings at leaf nodes.
+   */ deepNormalize(value) {
+        if (typeof value === 'string') {
+            return this.normalizeString(value);
+        }
+        if (Array.isArray(value)) {
+            return value.map((item)=>this.deepNormalize(item));
+        }
+        if (typeof value === 'object' && value !== null) {
+            const normalized = {};
+            // Special handling for error objects
+            if (value.message !== undefined) {
+                normalized.message = this.normalizeString(value.message);
+            }
+            if (value.stack !== undefined) {
+                normalized.stack = this.normalizeStackTrace(value.stack);
+            }
+            // Normalize other properties
+            for (const key of Object.keys(value)){
+                if (key !== 'message' && key !== 'stack') {
+                    normalized[key] = this.deepNormalize(value[key]);
+                }
+            }
+            // Sort keys for consistent hashing
+            const sorted = {};
+            Object.keys(normalized).sort().forEach((key)=>{
+                sorted[key] = normalized[key];
+            });
+            return sorted;
+        }
+        // Numbers, booleans, null stay as-is for non-string normalization
+        // but we track them as {number} etc. in strings
+        return value;
+    }
+    /**
+   * Normalize a string by replacing variable data with placeholders
+   */ normalizeString(str) {
+        let normalized = str;
+        // Normalize ISO 8601 dates/timestamps
+        // 2025-11-16T13:00:00Z → {date}
+        // 2025-11-16T13:00:00.123Z → {date}
+        // 2025-11-16 13:00:00 → {date}
+        normalized = normalized.replace(/\d{4}-\d{2}-\d{2}[T\s]\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z?/g, '{date}');
+        // Normalize standalone dates
+        // 2025-11-16 → {date}
+        normalized = normalized.replace(/\d{4}-\d{2}-\d{2}/g, '{date}');
+        // Normalize Unix timestamps (10 digits)
+        // 1700000000 → {timestamp}
+        normalized = normalized.replace(/\b\d{10}\b/g, '{timestamp}');
+        // Normalize UUIDs
+        // 550e8400-e29b-41d4-a716-446655440000 → {uuid}
+        normalized = normalized.replace(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi, '{uuid}');
+        // Normalize hex IDs (8+ hex characters)
+        // abc123def456 → {id}
+        normalized = normalized.replace(/\b[a-f0-9]{8,}\b/gi, '{id}');
+        // Normalize task/agent IDs with prefixes
+        // task-abc123, agent-xyz789, cfn-cli-1234567 → {id}
+        normalized = normalized.replace(/(?:task|agent|cfn|job|run|session)-[a-z0-9\-]+/gi, '{id}');
+        // Normalize user/resource IDs in paths
+        // /api/users/12345 → /api/users/{id}
+        // /tasks/abc123/status → /tasks/{id}/status
+        normalized = normalized.replace(/\/([a-z0-9\-]+)(?=\/|$)/gi, (match, id)=>{
+            // Only replace if it looks like an ID (contains numbers or is hex)
+            if (/\d/.test(id) || /^[a-f0-9]+$/i.test(id)) {
+                return '/{id}';
+            }
+            return match;
+        });
+        // Normalize standalone numbers
+        // "Error 500", "timeout after 5000ms", "user 12345" → "Error {number}", etc.
+        normalized = normalized.replace(/\b\d+\b/g, '{number}');
+        // Normalize memory addresses
+        // 0x7f1234567890 → {addr}
+        normalized = normalized.replace(/0x[0-9a-f]+/gi, '{addr}');
+        // Normalize file paths with line numbers
+        // /app/file.js:42 → /app/file.js:{line}
+        normalized = normalized.replace(/:(\d+)(?::(\d+))?/g, ':{line}');
+        return normalized;
+    }
+    /**
+   * Check if two edge cases are similar based on their signatures
+   *
+   * @param signature1 First signature
+   * @param signature2 Second signature
+   * @returns True if signatures match
+   */ areSimilar(signature1, signature2) {
+        return signature1 === signature2;
+    }
+    /**
+   * Calculate similarity score between two contexts (for fuzzy matching)
+   *
+   * This is for future enhancement - currently we use exact signature matching.
+   * Could be used for "similar but not identical" edge case detection.
+   *
+   * @param context1 First context
+   * @param context2 Second context
+   * @returns Similarity score (0.0 to 1.0)
+   */ calculateSimilarity(context1, context2) {
+        const norm1 = this.normalizeContext(context1);
+        const norm2 = this.normalizeContext(context2);
+        // Simple Jaccard similarity on normalized strings
+        const set1 = new Set(norm1.split(/\s+/));
+        const set2 = new Set(norm2.split(/\s+/));
+        const intersection = new Set(Array.from(set1).filter((x)=>set2.has(x)));
+        const union = new Set([
+            ...Array.from(set1),
+            ...Array.from(set2)
+        ]);
+        return intersection.size / union.size;
+    }
+    /**
+   * Extract common pattern from multiple edge cases
+   *
+   * For future pattern detection feature.
+   *
+   * @param edgeCases Array of edge case inputs
+   * @returns Common pattern descriptor
+   */ extractPattern(edgeCases) {
+        // Future implementation: extract common error patterns
+        // For now, return basic statistics
+        const types = new Map();
+        const categories = new Map();
+        for (const edgeCase of edgeCases){
+            types.set(edgeCase.type, (types.get(edgeCase.type) || 0) + 1);
+            categories.set(edgeCase.category, (categories.get(edgeCase.category) || 0) + 1);
+        }
+        return {
+            commonType: this.findMostCommon(types),
+            commonCategory: this.findMostCommon(categories),
+            totalCases: edgeCases.length
+        };
+    }
+    /**
+   * Find most common value in a map
+   */ findMostCommon(map) {
+        let maxCount = 0;
+        let maxKey = null;
+        for (const [key, count] of Array.from(map.entries())){
+            if (count > maxCount) {
+                maxCount = count;
+                maxKey = key;
+            }
+        }
+        return maxKey;
+    }
+}
+
+//# sourceMappingURL=edge-case-deduplicator.js.map

package/dist/lib/edge-case-deduplicator.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/lib/edge-case-deduplicator.ts"],"sourcesContent":["/**\r\n * Edge Case Deduplicator\r\n *\r\n * Handles deduplication of edge cases using SHA-256 signatures.\r\n * Normalizes context to detect similar errors with different IDs, timestamps, or numbers.\r\n */\r\n\r\nimport * as crypto from 'crypto';\r\nimport { EdgeCaseInput, EdgeCaseType } from '../types/edge-case.js';\r\n\r\nexport class EdgeCaseDeduplicator {\r\n  /**\r\n   * Generate SHA-256 signature for edge case deduplication\r\n   *\r\n   * Signature is based on:\r\n   * - Type\r\n   * - Category\r\n   * - Normalized error message\r\n   * - Normalized stack trace\r\n   *\r\n   * @param edgeCase Edge case input\r\n   * @returns SHA-256 signature (64 hex characters)\r\n   */\r\n  public generateSignature(edgeCase: EdgeCaseInput): string {\r\n    const normalizedContext = this.normalizeContext(edgeCase.context);\r\n\r\n    const signatureData = {\r\n      type: edgeCase.type,\r\n      category: edgeCase.category,\r\n      context: normalizedContext\r\n    };\r\n\r\n    const signatureString = JSON.stringify(signatureData);\r\n    const hash = crypto.createHash('sha256');\r\n    hash.update(signatureString);\r\n\r\n    return hash.digest('hex');\r\n  }\r\n\r\n  /**\r\n   * Normalize context for deduplication\r\n   *\r\n   * Replaces variable data with placeholders:\r\n   * - Dates/timestamps → {date}\r\n   * - IDs (hex, alphanumeric) → {id}\r\n   * - Numbers → {number}\r\n   * - File paths → normalized paths\r\n   * - Line numbers in stack traces → {line}\r\n   *\r\n   * @param context Edge case context object\r\n   * @returns Normalized JSON string\r\n   */\r\n  public normalizeContext(context: any): string {\r\n    const normalized = this.deepNormalize(context);\r\n    return JSON.stringify(normalized, null, 0);\r\n  }\r\n\r\n  /**\r\n   * Normalize stack trace for deduplication\r\n   *\r\n   * Removes:\r\n   * - Line numbers\r\n   * - Column numbers\r\n   * - Absolute file paths (keep relative paths)\r\n   * - Memory addresses\r\n   *\r\n   * @param stackTrace Stack trace string\r\n   * @returns Normalized stack trace\r\n   */\r\n  public normalizeStackTrace(stackTrace: string): string {\r\n    let normalized = stackTrace;\r\n\r\n    // Normalize line and column numbers: \":42:10\" → \":{line}:{col}\"\r\n    normalized = normalized.replace(/:(\\d+):(\\d+)/g, ':{line}:{col}');\r\n\r\n    // Normalize single line numbers: \":42)\" → \":{line})\"\r\n    normalized = normalized.replace(/:(\\d+)\\)/g, ':{line})');\r\n\r\n    // Normalize absolute paths to relative\r\n    // /app/src/file.js → src/file.js\r\n    // /home/user/project/file.js → file.js\r\n    normalized = normalized.replace(/\\/[a-zA-Z0-9_\\-\\/]+\\//g, (match) => {\r\n      // Keep only the last 2 path segments\r\n      const segments = match.split('/').filter(s => s.length > 0);\r\n      return segments.slice(-2).join('/') + '/';\r\n    });\r\n\r\n    // Normalize memory addresses: 0x7f1234567890 → {addr}\r\n    normalized = normalized.replace(/0x[0-9a-f]+/gi, '{addr}');\r\n\r\n    return normalized;\r\n  }\r\n\r\n  /**\r\n   * Deep normalize an object or string\r\n   *\r\n   * Recursively processes objects and arrays,\r\n   * normalizing strings at leaf nodes.\r\n   */\r\n  private deepNormalize(value: any): any {\r\n    if (typeof value === 'string') {\r\n      return this.normalizeString(value);\r\n    }\r\n\r\n    if (Array.isArray(value)) {\r\n      return value.map(item => this.deepNormalize(item));\r\n    }\r\n\r\n    if (typeof value === 'object' && value !== null) {\r\n      const normalized: any = {};\r\n\r\n      // Special handling for error objects\r\n      if (value.message !== undefined) {\r\n        normalized.message = this.normalizeString(value.message);\r\n      }\r\n\r\n      if (value.stack !== undefined) {\r\n        normalized.stack = this.normalizeStackTrace(value.stack);\r\n      }\r\n\r\n      // Normalize other properties\r\n      for (const key of Object.keys(value)) {\r\n        if (key !== 'message' && key !== 'stack') {\r\n          normalized[key] = this.deepNormalize(value[key]);\r\n        }\r\n      }\r\n\r\n      // Sort keys for consistent hashing\r\n      const sorted: any = {};\r\n      Object.keys(normalized).sort().forEach(key => {\r\n        sorted[key] = normalized[key];\r\n      });\r\n\r\n      return sorted;\r\n    }\r\n\r\n    // Numbers, booleans, null stay as-is for non-string normalization\r\n    // but we track them as {number} etc. in strings\r\n    return value;\r\n  }\r\n\r\n  /**\r\n   * Normalize a string by replacing variable data with placeholders\r\n   */\r\n  private normalizeString(str: string): string {\r\n    let normalized = str;\r\n\r\n    // Normalize ISO 8601 dates/timestamps\r\n    // 2025-11-16T13:00:00Z → {date}\r\n    // 2025-11-16T13:00:00.123Z → {date}\r\n    // 2025-11-16 13:00:00 → {date}\r\n    normalized = normalized.replace(/\\d{4}-\\d{2}-\\d{2}[T\\s]\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{3})?Z?/g, '{date}');\r\n\r\n    // Normalize standalone dates\r\n    // 2025-11-16 → {date}\r\n    normalized = normalized.replace(/\\d{4}-\\d{2}-\\d{2}/g, '{date}');\r\n\r\n    // Normalize Unix timestamps (10 digits)\r\n    // 1700000000 → {timestamp}\r\n    normalized = normalized.replace(/\\b\\d{10}\\b/g, '{timestamp}');\r\n\r\n    // Normalize UUIDs\r\n    // 550e8400-e29b-41d4-a716-446655440000 → {uuid}\r\n    normalized = normalized.replace(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi, '{uuid}');\r\n\r\n    // Normalize hex IDs (8+ hex characters)\r\n    // abc123def456 → {id}\r\n    normalized = normalized.replace(/\\b[a-f0-9]{8,}\\b/gi, '{id}');\r\n\r\n    // Normalize task/agent IDs with prefixes\r\n    // task-abc123, agent-xyz789, cfn-cli-1234567 → {id}\r\n    normalized = normalized.replace(/(?:task|agent|cfn|job|run|session)-[a-z0-9\\-]+/gi, '{id}');\r\n\r\n    // Normalize user/resource IDs in paths\r\n    // /api/users/12345 → /api/users/{id}\r\n    // /tasks/abc123/status → /tasks/{id}/status\r\n    normalized = normalized.replace(/\\/([a-z0-9\\-]+)(?=\\/|$)/gi, (match, id) => {\r\n      // Only replace if it looks like an ID (contains numbers or is hex)\r\n      if (/\\d/.test(id) || /^[a-f0-9]+$/i.test(id)) {\r\n        return '/{id}';\r\n      }\r\n      return match;\r\n    });\r\n\r\n    // Normalize standalone numbers\r\n    // \"Error 500\", \"timeout after 5000ms\", \"user 12345\" → \"Error {number}\", etc.\r\n    normalized = normalized.replace(/\\b\\d+\\b/g, '{number}');\r\n\r\n    // Normalize memory addresses\r\n    // 0x7f1234567890 → {addr}\r\n    normalized = normalized.replace(/0x[0-9a-f]+/gi, '{addr}');\r\n\r\n    // Normalize file paths with line numbers\r\n    // /app/file.js:42 → /app/file.js:{line}\r\n    normalized = normalized.replace(/:(\\d+)(?::(\\d+))?/g, ':{line}');\r\n\r\n    return normalized;\r\n  }\r\n\r\n  /**\r\n   * Check if two edge cases are similar based on their signatures\r\n   *\r\n   * @param signature1 First signature\r\n   * @param signature2 Second signature\r\n   * @returns True if signatures match\r\n   */\r\n  public areSimilar(signature1: string, signature2: string): boolean {\r\n    return signature1 === signature2;\r\n  }\r\n\r\n  /**\r\n   * Calculate similarity score between two contexts (for fuzzy matching)\r\n   *\r\n   * This is for future enhancement - currently we use exact signature matching.\r\n   * Could be used for \"similar but not identical\" edge case detection.\r\n   *\r\n   * @param context1 First context\r\n   * @param context2 Second context\r\n   * @returns Similarity score (0.0 to 1.0)\r\n   */\r\n  public calculateSimilarity(context1: any, context2: any): number {\r\n    const norm1 = this.normalizeContext(context1);\r\n    const norm2 = this.normalizeContext(context2);\r\n\r\n    // Simple Jaccard similarity on normalized strings\r\n    const set1 = new Set(norm1.split(/\\s+/));\r\n    const set2 = new Set(norm2.split(/\\s+/));\r\n\r\n    const intersection = new Set(Array.from(set1).filter(x => set2.has(x)));\r\n    const union = new Set([...Array.from(set1), ...Array.from(set2)]);\r\n\r\n    return intersection.size / union.size;\r\n  }\r\n\r\n  /**\r\n   * Extract common pattern from multiple edge cases\r\n   *\r\n   * For future pattern detection feature.\r\n   *\r\n   * @param edgeCases Array of edge case inputs\r\n   * @returns Common pattern descriptor\r\n   */\r\n  public extractPattern(edgeCases: EdgeCaseInput[]): any {\r\n    // Future implementation: extract common error patterns\r\n    // For now, return basic statistics\r\n\r\n    const types = new Map<EdgeCaseType, number>();\r\n    const categories = new Map<string, number>();\r\n\r\n    for (const edgeCase of edgeCases) {\r\n      types.set(edgeCase.type, (types.get(edgeCase.type) || 0) + 1);\r\n      categories.set(edgeCase.category, (categories.get(edgeCase.category) || 0) + 1);\r\n    }\r\n\r\n    return {\r\n      commonType: this.findMostCommon(types),\r\n      commonCategory: this.findMostCommon(categories),\r\n      totalCases: edgeCases.length\r\n    };\r\n  }\r\n\r\n  /**\r\n   * Find most common value in a map\r\n   */\r\n  private findMostCommon<K>(map: Map<K, number>): K | null {\r\n    let maxCount = 0;\r\n    let maxKey: K | null = null;\r\n\r\n    for (const [key, count] of Array.from(map.entries())) {\r\n      if (count > maxCount) {\r\n        maxCount = count;\r\n        maxKey = key;\r\n      }\r\n    }\r\n\r\n    return maxKey;\r\n  }\r\n}\r\n"],"names":["crypto","EdgeCaseDeduplicator","generateSignature","edgeCase","normalizedContext","normalizeContext","context","signatureData","type","category","signatureString","JSON","stringify","hash","createHash","update","digest","normalized","deepNormalize","normalizeStackTrace","stackTrace","replace","match","segments","split","filter","s","length","slice","join","value","normalizeString","Array","isArray","map","item","message","undefined","stack","key","Object","keys","sorted","sort","forEach","str","id","test","areSimilar","signature1","signature2","calculateSimilarity","context1","context2","norm1","norm2","set1","Set","set2","intersection","from","x","has","union","size","extractPattern","edgeCases","types","Map","categories","set","get","commonType","findMostCommon","commonCategory","totalCases","maxCount","maxKey","count","entries"],"mappings":"AAAA;;;;;CAKC,GAED,YAAYA,YAAY,SAAS;AAGjC,OAAO,MAAMC;IACX;;;;;;;;;;;GAWC,GACD,AAAOC,kBAAkBC,QAAuB,EAAU;QACxD,MAAMC,oBAAoB,IAAI,CAACC,gBAAgB,CAACF,SAASG,OAAO;QAEhE,MAAMC,gBAAgB;YACpBC,MAAML,SAASK,IAAI;YACnBC,UAAUN,SAASM,QAAQ;YAC3BH,SAASF;QACX;QAEA,MAAMM,kBAAkBC,KAAKC,SAAS,CAACL;QACvC,MAAMM,OAAOb,OAAOc,UAAU,CAAC;QAC/BD,KAAKE,MAAM,CAACL;QAEZ,OAAOG,KAAKG,MAAM,CAAC;IACrB;IAEA;;;;;;;;;;;;GAYC,GACD,AAAOX,iBAAiBC,OAAY,EAAU;QAC5C,MAAMW,aAAa,IAAI,CAACC,aAAa,CAACZ;QACtC,OAAOK,KAAKC,SAAS,CAACK,YAAY,MAAM;IAC1C;IAEA;;;;;;;;;;;GAWC,GACD,AAAOE,oBAAoBC,UAAkB,EAAU;QACrD,IAAIH,aAAaG;QAEjB,gEAAgE;QAChEH,aAAaA,WAAWI,OAAO,CAAC,iBAAiB;QAEjD,qDAAqD;QACrDJ,aAAaA,WAAWI,OAAO,CAAC,aAAa;QAE7C,uCAAuC;QACvC,iCAAiC;QACjC,uCAAuC;QACvCJ,aAAaA,WAAWI,OAAO,CAAC,0BAA0B,CAACC;YACzD,qCAAqC;YACrC,MAAMC,WAAWD,MAAME,KAAK,CAAC,KAAKC,MAAM,CAACC,CAAAA,IAAKA,EAAEC,MAAM,GAAG;YACzD,OAAOJ,SAASK,KAAK,CAAC,CAAC,GAAGC,IAAI,CAAC,OAAO;QACxC;QAEA,sDAAsD;QACtDZ,aAAaA,WAAWI,OAAO,CAAC,iBAAiB;QAEjD,OAAOJ;IACT;IAEA;;;;;GAKC,GACD,AAAQC,cAAcY,KAAU,EAAO;QACrC,IAAI,OAAOA,UAAU,UAAU;YAC7B,OAAO,IAAI,CAACC,eAAe,CAACD;QAC9B;QAEA,IAAIE,MAAMC,OAAO,CAACH,QAAQ;YACxB,OAAOA,MAAMI,GAAG,CAACC,CAAAA,OAAQ,IAAI,CAACjB,aAAa,CAACiB;QAC9C;QAEA,IAAI,OAAOL,UAAU,YAAYA,UAAU,MAAM;YAC/C,MAAMb,aAAkB,CAAC;YAEzB,qCAAqC;YACrC,IAAIa,MAAMM,OAAO,KAAKC,WAAW;gBAC/BpB,WAAWmB,OAAO,GAAG,IAAI,CAACL,eAAe,CAACD,MAAMM,OAAO;YACzD;YAEA,IAAIN,MAAMQ,KAAK,KAAKD,WAAW;gBAC7BpB,WAAWqB,KAAK,GAAG,IAAI,CAACnB,mBAAmB,CAACW,MAAMQ,KAAK;YACzD;YAEA,6BAA6B;YAC7B,KAAK,MAAMC,OAAOC,OAAOC,IAAI,CAACX,OAAQ;gBACpC,IAAIS,QAAQ,aAAaA,QAAQ,SAAS;oBACxCtB,UAAU,CAACsB,IAAI,GAAG,IAAI,CAACrB,aAAa,CAACY,KAAK,CAACS,IAAI;gBACjD;YACF;YAEA,mCAAmC;YACnC,MAAMG,SAAc,CAAC;YACrBF,OAAOC,IAAI,CAACxB,YAAY0B,IAAI,GAAGC,OAAO,CAACL,CAAAA;gBACrCG,MAAM,CAACH,IAAI,GAAGtB,UAAU,CAACsB,IAAI;YAC/B;YAEA,OAAOG;QACT;QAEA,kEAAkE;QAClE,gDAAgD;QAChD,OAAOZ;IACT;IAEA;;GAEC,GACD,AAAQC,gBAAgBc,GAAW,EAAU;QAC3C,IAAI5B,aAAa4B;QAEjB,sCAAsC;QACtC,gCAAgC;QAChC,oCAAoC;QACpC,+BAA+B;QAC/B5B,aAAaA,WAAWI,OAAO,CAAC,0DAA0D;QAE1F,6BAA6B;QAC7B,sBAAsB;QACtBJ,aAAaA,WAAWI,OAAO,CAAC,sBAAsB;QAEtD,wCAAwC;QACxC,2BAA2B;QAC3BJ,aAAaA,WAAWI,OAAO,CAAC,eAAe;QAE/C,kBAAkB;QAClB,gDAAgD;QAChDJ,aAAaA,WAAWI,OAAO,CAAC,kEAAkE;QAElG,wCAAwC;QACxC,sBAAsB;QACtBJ,aAAaA,WAAWI,OAAO,CAAC,sBAAsB;QAEtD,yCAAyC;QACzC,oDAAoD;QACpDJ,aAAaA,WAAWI,OAAO,CAAC,oDAAoD;QAEpF,uCAAuC;QACvC,qCAAqC;QACrC,4CAA4C;QAC5CJ,aAAaA,WAAWI,OAAO,CAAC,6BAA6B,CAACC,OAAOwB;YACnE,mEAAmE;YACnE,IAAI,KAAKC,IAAI,CAACD,OAAO,eAAeC,IAAI,CAACD,KAAK;gBAC5C,OAAO;YACT;YACA,OAAOxB;QACT;QAEA,+BAA+B;QAC/B,6EAA6E;QAC7EL,aAAaA,WAAWI,OAAO,CAAC,YAAY;QAE5C,6BAA6B;QAC7B,0BAA0B;QAC1BJ,aAAaA,WAAWI,OAAO,CAAC,iBAAiB;QAEjD,yCAAyC;QACzC,wCAAwC;QACxCJ,aAAaA,WAAWI,OAAO,CAAC,sBAAsB;QAEtD,OAAOJ;IACT;IAEA;;;;;;GAMC,GACD,AAAO+B,WAAWC,UAAkB,EAAEC,UAAkB,EAAW;QACjE,OAAOD,eAAeC;IACxB;IAEA;;;;;;;;;GASC,GACD,AAAOC,oBAAoBC,QAAa,EAAEC,QAAa,EAAU;QAC/D,MAAMC,QAAQ,IAAI,CAACjD,gBAAgB,CAAC+C;QACpC,MAAMG,QAAQ,IAAI,CAAClD,gBAAgB,CAACgD;QAEpC,kDAAkD;QAClD,MAAMG,OAAO,IAAIC,IAAIH,MAAM9B,KAAK,CAAC;QACjC,MAAMkC,OAAO,IAAID,IAAIF,MAAM/B,KAAK,CAAC;QAEjC,MAAMmC,eAAe,IAAIF,IAAIzB,MAAM4B,IAAI,CAACJ,MAAM/B,MAAM,CAACoC,CAAAA,IAAKH,KAAKI,GAAG,CAACD;QACnE,MAAME,QAAQ,IAAIN,IAAI;eAAIzB,MAAM4B,IAAI,CAACJ;eAAUxB,MAAM4B,IAAI,CAACF;SAAM;QAEhE,OAAOC,aAAaK,IAAI,GAAGD,MAAMC,IAAI;IACvC;IAEA;;;;;;;GAOC,GACD,AAAOC,eAAeC,SAA0B,EAAO;QACrD,uDAAuD;QACvD,mCAAmC;QAEnC,MAAMC,QAAQ,IAAIC;QAClB,MAAMC,aAAa,IAAID;QAEvB,KAAK,MAAMjE,YAAY+D,UAAW;YAChCC,MAAMG,GAAG,CAACnE,SAASK,IAAI,EAAE,AAAC2D,CAAAA,MAAMI,GAAG,CAACpE,SAASK,IAAI,KAAK,CAAA,IAAK;YAC3D6D,WAAWC,GAAG,CAACnE,SAASM,QAAQ,EAAE,AAAC4D,CAAAA,WAAWE,GAAG,CAACpE,SAASM,QAAQ,KAAK,CAAA,IAAK;QAC/E;QAEA,OAAO;YACL+D,YAAY,IAAI,CAACC,cAAc,CAACN;YAChCO,gBAAgB,IAAI,CAACD,cAAc,CAACJ;YACpCM,YAAYT,UAAUvC,MAAM;QAC9B;IACF;IAEA;;GAEC,GACD,AAAQ8C,eAAkBvC,GAAmB,EAAY;QACvD,IAAI0C,WAAW;QACf,IAAIC,SAAmB;QAEvB,KAAK,MAAM,CAACtC,KAAKuC,MAAM,IAAI9C,MAAM4B,IAAI,CAAC1B,IAAI6C,OAAO,IAAK;YACpD,IAAID,QAAQF,UAAU;gBACpBA,WAAWE;gBACXD,SAAStC;YACX;QACF;QAEA,OAAOsC;IACT;AACF"}

package/dist/lib/encryption-manager.js

@@ -0,0 +1,322 @@
+/**
+ * Backup Encryption Manager
+ *
+ * Implements AES-256-GCM encryption for backup files with:
+ * - Secure key management via environment variables
+ * - Unique IV generation for each backup
+ * - HMAC-SHA256 integrity verification
+ * - Key rotation support
+ * - Backward compatibility detection
+ * - Encryption metadata tracking
+ *
+ * CVSS Mitigation: Addresses CVSS 7.2 (high severity) vulnerability
+ * by encrypting sensitive backup data at rest.
+ *
+ * Security Requirements:
+ * - BACKUP_ENCRYPTION_KEY: 32-byte hex encoded AES-256 key (env var)
+ * - BACKUP_ENCRYPTION_ENABLED: Set to 'true' to enable encryption (env var)
+ * - IV: Cryptographically random, unique per backup
+ * - Auth Tag: GCM authentication tag for integrity verification
+ * - HMAC: SHA-256 for additional integrity verification
+ *
+ * Usage:
+ *   const encryptionManager = new EncryptionManager();
+ *   const encrypted = await encryptionManager.encrypt(buffer, backupId);
+ *   const decrypted = await encryptionManager.decrypt(encrypted, backupId);
+ *   const verified = encryptionManager.verifyIntegrity(encrypted);
+ */ import * as crypto from 'crypto';
+import { createLogger } from './logging.js';
+import { createError, ErrorCode } from './errors.js';
+const logger = createLogger('encryption-manager');
+/**
+ * Backup Encryption Manager
+ *
+ * Implements AES-256-GCM encryption with integrity verification
+ */ export class EncryptionManager {
+    enabled;
+    masterKey = null;
+    keyVersion;
+    ALGORITHM = 'aes-256-gcm';
+    IV_LENGTH = 16;
+    AUTH_TAG_LENGTH = 16;
+    KEY_LENGTH = 32;
+    HMAC_ALGORITHM = 'sha256';
+    constructor(config = {}){
+        // Check if encryption is enabled
+        this.enabled = config.enabled !== undefined ? config.enabled : this.isEncryptionEnabled();
+        // Load and validate master key
+        if (this.enabled) {
+            const keyHex = config.masterKey || process.env.BACKUP_ENCRYPTION_KEY;
+            if (!keyHex) {
+                throw createError(ErrorCode.VALIDATION_FAILED, 'BACKUP_ENCRYPTION_KEY environment variable is required when encryption is enabled', {
+                    enabledVia: 'BACKUP_ENCRYPTION_ENABLED env var'
+                });
+            }
+            try {
+                this.masterKey = Buffer.from(keyHex, 'hex');
+                if (this.masterKey.length !== this.KEY_LENGTH) {
+                    throw createError(ErrorCode.VALIDATION_FAILED, `Master key must be exactly ${this.KEY_LENGTH} bytes (${this.KEY_LENGTH * 2} hex characters)`, {
+                        providedLength: this.masterKey.length,
+                        expectedLength: this.KEY_LENGTH
+                    });
+                }
+                logger.info('Encryption manager initialized with AES-256-GCM', {
+                    enabled: true,
+                    algorithm: this.ALGORITHM,
+                    keyLength: this.KEY_LENGTH,
+                    ivLength: this.IV_LENGTH,
+                    authTagLength: this.AUTH_TAG_LENGTH
+                });
+            } catch (error) {
+                if (error instanceof Error && 'code' in error) {
+                    throw error;
+                }
+                throw createError(ErrorCode.VALIDATION_FAILED, 'Failed to parse BACKUP_ENCRYPTION_KEY. Must be valid hex-encoded 32-byte key.', {
+                    error: error instanceof Error ? error.message : String(error)
+                });
+            }
+        } else {
+            logger.info('Encryption manager initialized with encryption disabled', {
+                enabled: false,
+                enablementRequired: 'Set BACKUP_ENCRYPTION_ENABLED=true and provide BACKUP_ENCRYPTION_KEY to enable encryption'
+            });
+        }
+        this.keyVersion = config.keyVersion || 'v1';
+    }
+    /**
+   * Check if encryption is enabled
+   */ isEnabled() {
+        return this.enabled;
+    }
+    /**
+   * Encrypt backup data
+   *
+   * @param data - Data to encrypt
+   * @param backupId - Backup identifier (for logging/tracking)
+   * @returns Encrypted backup with metadata
+   * @throws Error if encryption is disabled or encryption fails
+   */ async encrypt(data, backupId) {
+        if (!this.enabled || !this.masterKey) {
+            throw createError(ErrorCode.VALIDATION_FAILED, 'Encryption is not enabled. Enable BACKUP_ENCRYPTION_ENABLED and provide BACKUP_ENCRYPTION_KEY.', {
+                backupId
+            });
+        }
+        try {
+            // Generate cryptographically random IV
+            const iv = crypto.randomBytes(this.IV_LENGTH);
+            // Create cipher
+            const cipher = crypto.createCipheriv(this.ALGORITHM, this.masterKey, iv);
+            // Encrypt data
+            let encryptedData = cipher.update(data);
+            encryptedData = Buffer.concat([
+                encryptedData,
+                cipher.final()
+            ]);
+            // Get authentication tag
+            const authTag = cipher.getAuthTag();
+            // Calculate HMAC for additional integrity verification
+            const hmac = crypto.createHmac(this.HMAC_ALGORITHM, this.masterKey).update(Buffer.concat([
+                iv,
+                encryptedData,
+                authTag
+            ])).digest();
+            // Create metadata
+            const metadata = {
+                algorithm: 'AES-256-GCM',
+                iv: iv.toString('hex'),
+                authTag: authTag.toString('hex'),
+                hmac: hmac.toString('hex'),
+                encryptedAt: new Date().toISOString(),
+                keyVersion: this.keyVersion
+            };
+            logger.debug('Backup encrypted successfully', {
+                backupId,
+                algorithm: this.ALGORITHM,
+                dataSize: data.length,
+                encryptedSize: encryptedData.length,
+                ivLength: iv.length,
+                authTagLength: authTag.length
+            });
+            return {
+                data: encryptedData,
+                metadata
+            };
+        } catch (error) {
+            logger.error('Backup encryption failed', error instanceof Error ? error : undefined, {
+                backupId
+            });
+            throw createError(ErrorCode.INTERNAL_ERROR, 'Backup encryption failed', {
+                backupId,
+                error: error instanceof Error ? error.message : String(error)
+            });
+        }
+    }
+    /**
+   * Decrypt backup data
+   *
+   * @param encrypted - Encrypted backup
+   * @param backupId - Backup identifier (for logging/tracking)
+   * @returns Decryption result with data and integrity verification
+   * @throws Error if decryption fails or integrity verification fails
+   */ async decrypt(encrypted, backupId) {
+        if (!this.enabled || !this.masterKey) {
+            throw createError(ErrorCode.VALIDATION_FAILED, 'Encryption is not enabled. Enable BACKUP_ENCRYPTION_ENABLED and provide BACKUP_ENCRYPTION_KEY.', {
+                backupId
+            });
+        }
+        try {
+            // Verify HMAC first
+            const iv = Buffer.from(encrypted.metadata.iv, 'hex');
+            const authTag = Buffer.from(encrypted.metadata.authTag, 'hex');
+            const expectedHmac = encrypted.metadata.hmac;
+            const calculatedHmac = crypto.createHmac(this.HMAC_ALGORITHM, this.masterKey).update(Buffer.concat([
+                iv,
+                encrypted.data,
+                authTag
+            ])).digest().toString('hex');
+            const integrityVerified = calculatedHmac === expectedHmac;
+            if (!integrityVerified) {
+                logger.warn('HMAC verification failed during decryption', {
+                    backupId,
+                    expectedHmac,
+                    calculatedHmac
+                });
+            }
+            // Decrypt data
+            const decipher = crypto.createDecipheriv(this.ALGORITHM, this.masterKey, iv);
+            decipher.setAuthTag(authTag);
+            let decryptedData = decipher.update(encrypted.data);
+            decryptedData = Buffer.concat([
+                decryptedData,
+                decipher.final()
+            ]);
+            logger.debug('Backup decrypted successfully', {
+                backupId,
+                algorithm: this.ALGORITHM,
+                encryptedSize: encrypted.data.length,
+                decryptedSize: decryptedData.length,
+                integrityVerified
+            });
+            return {
+                data: decryptedData,
+                integrityVerified,
+                metadata: encrypted.metadata
+            };
+        } catch (error) {
+            logger.error('Backup decryption failed', error instanceof Error ? error : undefined, {
+                backupId
+            });
+            throw createError(ErrorCode.INTERNAL_ERROR, 'Backup decryption failed. Backup may be corrupted or key may be incorrect.', {
+                backupId,
+                error: error instanceof Error ? error.message : String(error)
+            });
+        }
+    }
+    /**
+   * Verify backup integrity without decryption
+   *
+   * @param encrypted - Encrypted backup
+   * @param backupId - Backup identifier (for logging)
+   * @returns Whether integrity verification passed
+   */ verifyIntegrity(encrypted, backupId) {
+        if (!this.masterKey) {
+            logger.error('Cannot verify integrity without master key', {
+                backupId
+            });
+            return false;
+        }
+        try {
+            const iv = Buffer.from(encrypted.metadata.iv, 'hex');
+            const authTag = Buffer.from(encrypted.metadata.authTag, 'hex');
+            const expectedHmac = encrypted.metadata.hmac;
+            const calculatedHmac = crypto.createHmac(this.HMAC_ALGORITHM, this.masterKey).update(Buffer.concat([
+                iv,
+                encrypted.data,
+                authTag
+            ])).digest().toString('hex');
+            const verified = calculatedHmac === expectedHmac;
+            if (!verified) {
+                logger.warn('Integrity verification failed', {
+                    backupId
+                });
+            }
+            return verified;
+        } catch (error) {
+            logger.error('Integrity verification error', error instanceof Error ? error : undefined, {
+                backupId
+            });
+            return false;
+        }
+    }
+    /**
+   * Detect if a backup file is encrypted
+   *
+   * Useful for backward compatibility - detects if backup is encrypted
+   *
+   * @param data - File data
+   * @returns Whether the data appears to be encrypted
+   */ static isEncrypted(data) {
+        // Encrypted data with metadata should have a specific structure
+        // For now, we can check if the data is valid JSON metadata (simple heuristic)
+        try {
+            // Try to detect our encryption format
+            // This is a simple heuristic - encrypted data won't be valid text/JSON
+            if (data.length < 100) {
+                return false;
+            }
+            // Try to parse as JSON at the end for metadata
+            const str = data.toString('utf8', Math.max(0, data.length - 500));
+            const match = str.match(/"algorithm"\s*:\s*"AES-256-GCM"/);
+            return match !== null;
+        } catch  {
+            return false;
+        }
+    }
+    /**
+   * Generate a new encryption key
+   *
+   * Useful for key rotation
+   *
+   * @returns 32-byte hex-encoded AES-256 key
+   */ static generateKey() {
+        return crypto.randomBytes(32).toString('hex');
+    }
+    /**
+   * Export encryption metadata as JSON
+   *
+   * Useful for storing metadata separately from encrypted data
+   *
+   * @param encrypted - Encrypted backup
+   * @returns JSON stringified metadata
+   */ static exportMetadata(encrypted) {
+        return JSON.stringify(encrypted.metadata, null, 2);
+    }
+    /**
+   * Import encryption metadata from JSON
+   *
+   * @param metadataJson - JSON stringified metadata
+   * @returns Parsed encryption metadata
+   */ static importMetadata(metadataJson) {
+        return JSON.parse(metadataJson);
+    }
+    // ============================================================================
+    // Private Helper Methods
+    // ============================================================================
+    isEncryptionEnabled() {
+        const enabled = process.env.BACKUP_ENCRYPTION_ENABLED?.toLowerCase() === 'true';
+        return enabled;
+    }
+}
+/**
+ * Singleton instance
+ */ let defaultManager = null;
+/**
+ * Get the default encryption manager instance
+ */ export function getEncryptionManager(config) {
+    if (!defaultManager) {
+        defaultManager = new EncryptionManager(config);
+    }
+    return defaultManager;
+}
+
+//# sourceMappingURL=encryption-manager.js.map

package/dist/lib/encryption-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/lib/encryption-manager.ts"],"sourcesContent":["/**\r\n * Backup Encryption Manager\r\n *\r\n * Implements AES-256-GCM encryption for backup files with:\r\n * - Secure key management via environment variables\r\n * - Unique IV generation for each backup\r\n * - HMAC-SHA256 integrity verification\r\n * - Key rotation support\r\n * - Backward compatibility detection\r\n * - Encryption metadata tracking\r\n *\r\n * CVSS Mitigation: Addresses CVSS 7.2 (high severity) vulnerability\r\n * by encrypting sensitive backup data at rest.\r\n *\r\n * Security Requirements:\r\n * - BACKUP_ENCRYPTION_KEY: 32-byte hex encoded AES-256 key (env var)\r\n * - BACKUP_ENCRYPTION_ENABLED: Set to 'true' to enable encryption (env var)\r\n * - IV: Cryptographically random, unique per backup\r\n * - Auth Tag: GCM authentication tag for integrity verification\r\n * - HMAC: SHA-256 for additional integrity verification\r\n *\r\n * Usage:\r\n *   const encryptionManager = new EncryptionManager();\r\n *   const encrypted = await encryptionManager.encrypt(buffer, backupId);\r\n *   const decrypted = await encryptionManager.decrypt(encrypted, backupId);\r\n *   const verified = encryptionManager.verifyIntegrity(encrypted);\r\n */\r\n\r\nimport * as crypto from 'crypto';\r\nimport { createLogger } from './logging.js';\r\nimport { createError, ErrorCode } from './errors.js';\r\n\r\nconst logger = createLogger('encryption-manager');\r\n\r\n/**\r\n * Encryption metadata stored with encrypted backup\r\n */\r\nexport interface EncryptionMetadata {\r\n  /** Encryption algorithm identifier */\r\n  algorithm: 'AES-256-GCM';\r\n  /** Initialization Vector (hex encoded) */\r\n  iv: string;\r\n  /** GCM Authentication Tag (hex encoded) */\r\n  authTag: string;\r\n  /** HMAC verification tag (hex encoded) */\r\n  hmac: string;\r\n  /** When encryption was applied */\r\n  encryptedAt: string;\r\n  /** Master key version/ID for key rotation support */\r\n  keyVersion: string;\r\n}\r\n\r\n/**\r\n * Encrypted backup payload\r\n */\r\nexport interface EncryptedBackup {\r\n  /** Encrypted file content */\r\n  data: Buffer;\r\n  /** Encryption metadata */\r\n  metadata: EncryptionMetadata;\r\n}\r\n\r\n/**\r\n * Decryption result\r\n */\r\nexport interface DecryptionResult {\r\n  /** Decrypted content */\r\n  data: Buffer;\r\n  /** Whether integrity verification passed */\r\n  integrityVerified: boolean;\r\n  /** Metadata about the encryption */\r\n  metadata: EncryptionMetadata;\r\n}\r\n\r\n/**\r\n * Encryption Manager Configuration\r\n */\r\nexport interface EncryptionConfig {\r\n  /** Enable encryption (default: from BACKUP_ENCRYPTION_ENABLED env var) */\r\n  enabled?: boolean;\r\n  /** Master encryption key (32-byte hex, from BACKUP_ENCRYPTION_KEY env var) */\r\n  masterKey?: string;\r\n  /** Key version ID for rotation tracking (default: 'v1') */\r\n  keyVersion?: string;\r\n}\r\n\r\n/**\r\n * Backup Encryption Manager\r\n *\r\n * Implements AES-256-GCM encryption with integrity verification\r\n */\r\nexport class EncryptionManager {\r\n  private enabled: boolean;\r\n  private masterKey: Buffer | null = null;\r\n  private keyVersion: string;\r\n  private readonly ALGORITHM = 'aes-256-gcm';\r\n  private readonly IV_LENGTH = 16; // 128 bits\r\n  private readonly AUTH_TAG_LENGTH = 16; // 128 bits\r\n  private readonly KEY_LENGTH = 32; // 256 bits\r\n  private readonly HMAC_ALGORITHM = 'sha256';\r\n\r\n  constructor(config: EncryptionConfig = {}) {\r\n    // Check if encryption is enabled\r\n    this.enabled = config.enabled !== undefined ? config.enabled : this.isEncryptionEnabled();\r\n\r\n    // Load and validate master key\r\n    if (this.enabled) {\r\n      const keyHex = config.masterKey || process.env.BACKUP_ENCRYPTION_KEY;\r\n\r\n      if (!keyHex) {\r\n        throw createError(\r\n          ErrorCode.VALIDATION_FAILED,\r\n          'BACKUP_ENCRYPTION_KEY environment variable is required when encryption is enabled',\r\n          { enabledVia: 'BACKUP_ENCRYPTION_ENABLED env var' }\r\n        );\r\n      }\r\n\r\n      try {\r\n        this.masterKey = Buffer.from(keyHex, 'hex');\r\n\r\n        if (this.masterKey.length !== this.KEY_LENGTH) {\r\n          throw createError(\r\n            ErrorCode.VALIDATION_FAILED,\r\n            `Master key must be exactly ${this.KEY_LENGTH} bytes (${this.KEY_LENGTH * 2} hex characters)`,\r\n            { providedLength: this.masterKey.length, expectedLength: this.KEY_LENGTH }\r\n          );\r\n        }\r\n\r\n        logger.info('Encryption manager initialized with AES-256-GCM', {\r\n          enabled: true,\r\n          algorithm: this.ALGORITHM,\r\n          keyLength: this.KEY_LENGTH,\r\n          ivLength: this.IV_LENGTH,\r\n          authTagLength: this.AUTH_TAG_LENGTH,\r\n        });\r\n      } catch (error) {\r\n        if (error instanceof Error && 'code' in error) {\r\n          throw error;\r\n        }\r\n\r\n        throw createError(\r\n          ErrorCode.VALIDATION_FAILED,\r\n          'Failed to parse BACKUP_ENCRYPTION_KEY. Must be valid hex-encoded 32-byte key.',\r\n          { error: error instanceof Error ? error.message : String(error) }\r\n        );\r\n      }\r\n    } else {\r\n      logger.info('Encryption manager initialized with encryption disabled', {\r\n        enabled: false,\r\n        enablementRequired:\r\n          'Set BACKUP_ENCRYPTION_ENABLED=true and provide BACKUP_ENCRYPTION_KEY to enable encryption',\r\n      });\r\n    }\r\n\r\n    this.keyVersion = config.keyVersion || 'v1';\r\n  }\r\n\r\n  /**\r\n   * Check if encryption is enabled\r\n   */\r\n  isEnabled(): boolean {\r\n    return this.enabled;\r\n  }\r\n\r\n  /**\r\n   * Encrypt backup data\r\n   *\r\n   * @param data - Data to encrypt\r\n   * @param backupId - Backup identifier (for logging/tracking)\r\n   * @returns Encrypted backup with metadata\r\n   * @throws Error if encryption is disabled or encryption fails\r\n   */\r\n  async encrypt(data: Buffer, backupId: string): Promise<EncryptedBackup> {\r\n    if (!this.enabled || !this.masterKey) {\r\n      throw createError(\r\n        ErrorCode.VALIDATION_FAILED,\r\n        'Encryption is not enabled. Enable BACKUP_ENCRYPTION_ENABLED and provide BACKUP_ENCRYPTION_KEY.',\r\n        { backupId }\r\n      );\r\n    }\r\n\r\n    try {\r\n      // Generate cryptographically random IV\r\n      const iv = crypto.randomBytes(this.IV_LENGTH);\r\n\r\n      // Create cipher\r\n      const cipher = crypto.createCipheriv(this.ALGORITHM, this.masterKey, iv);\r\n\r\n      // Encrypt data\r\n      let encryptedData = cipher.update(data);\r\n      encryptedData = Buffer.concat([encryptedData, cipher.final()]);\r\n\r\n      // Get authentication tag\r\n      const authTag = cipher.getAuthTag();\r\n\r\n      // Calculate HMAC for additional integrity verification\r\n      const hmac = crypto\r\n        .createHmac(this.HMAC_ALGORITHM, this.masterKey)\r\n        .update(Buffer.concat([iv, encryptedData, authTag]))\r\n        .digest();\r\n\r\n      // Create metadata\r\n      const metadata: EncryptionMetadata = {\r\n        algorithm: 'AES-256-GCM',\r\n        iv: iv.toString('hex'),\r\n        authTag: authTag.toString('hex'),\r\n        hmac: hmac.toString('hex'),\r\n        encryptedAt: new Date().toISOString(),\r\n        keyVersion: this.keyVersion,\r\n      };\r\n\r\n      logger.debug('Backup encrypted successfully', {\r\n        backupId,\r\n        algorithm: this.ALGORITHM,\r\n        dataSize: data.length,\r\n        encryptedSize: encryptedData.length,\r\n        ivLength: iv.length,\r\n        authTagLength: authTag.length,\r\n      });\r\n\r\n      return {\r\n        data: encryptedData,\r\n        metadata,\r\n      };\r\n    } catch (error) {\r\n      logger.error(\r\n        'Backup encryption failed',\r\n        error instanceof Error ? error : undefined,\r\n        { backupId }\r\n      );\r\n\r\n      throw createError(\r\n        ErrorCode.INTERNAL_ERROR,\r\n        'Backup encryption failed',\r\n        {\r\n          backupId,\r\n          error: error instanceof Error ? error.message : String(error),\r\n        }\r\n      );\r\n    }\r\n  }\r\n\r\n  /**\r\n   * Decrypt backup data\r\n   *\r\n   * @param encrypted - Encrypted backup\r\n   * @param backupId - Backup identifier (for logging/tracking)\r\n   * @returns Decryption result with data and integrity verification\r\n   * @throws Error if decryption fails or integrity verification fails\r\n   */\r\n  async decrypt(encrypted: EncryptedBackup, backupId: string): Promise<DecryptionResult> {\r\n    if (!this.enabled || !this.masterKey) {\r\n      throw createError(\r\n        ErrorCode.VALIDATION_FAILED,\r\n        'Encryption is not enabled. Enable BACKUP_ENCRYPTION_ENABLED and provide BACKUP_ENCRYPTION_KEY.',\r\n        { backupId }\r\n      );\r\n    }\r\n\r\n    try {\r\n      // Verify HMAC first\r\n      const iv = Buffer.from(encrypted.metadata.iv, 'hex');\r\n      const authTag = Buffer.from(encrypted.metadata.authTag, 'hex');\r\n      const expectedHmac = encrypted.metadata.hmac;\r\n\r\n      const calculatedHmac = crypto\r\n        .createHmac(this.HMAC_ALGORITHM, this.masterKey)\r\n        .update(Buffer.concat([iv, encrypted.data, authTag]))\r\n        .digest()\r\n        .toString('hex');\r\n\r\n      const integrityVerified = calculatedHmac === expectedHmac;\r\n\r\n      if (!integrityVerified) {\r\n        logger.warn('HMAC verification failed during decryption', {\r\n          backupId,\r\n          expectedHmac,\r\n          calculatedHmac,\r\n        });\r\n      }\r\n\r\n      // Decrypt data\r\n      const decipher = crypto.createDecipheriv(this.ALGORITHM, this.masterKey, iv);\r\n      decipher.setAuthTag(authTag);\r\n\r\n      let decryptedData = decipher.update(encrypted.data);\r\n      decryptedData = Buffer.concat([decryptedData, decipher.final()]);\r\n\r\n      logger.debug('Backup decrypted successfully', {\r\n        backupId,\r\n        algorithm: this.ALGORITHM,\r\n        encryptedSize: encrypted.data.length,\r\n        decryptedSize: decryptedData.length,\r\n        integrityVerified,\r\n      });\r\n\r\n      return {\r\n        data: decryptedData,\r\n        integrityVerified,\r\n        metadata: encrypted.metadata,\r\n      };\r\n    } catch (error) {\r\n      logger.error(\r\n        'Backup decryption failed',\r\n        error instanceof Error ? error : undefined,\r\n        { backupId }\r\n      );\r\n\r\n      throw createError(\r\n        ErrorCode.INTERNAL_ERROR,\r\n        'Backup decryption failed. Backup may be corrupted or key may be incorrect.',\r\n        {\r\n          backupId,\r\n          error: error instanceof Error ? error.message : String(error),\r\n        }\r\n      );\r\n    }\r\n  }\r\n\r\n  /**\r\n   * Verify backup integrity without decryption\r\n   *\r\n   * @param encrypted - Encrypted backup\r\n   * @param backupId - Backup identifier (for logging)\r\n   * @returns Whether integrity verification passed\r\n   */\r\n  verifyIntegrity(encrypted: EncryptedBackup, backupId?: string): boolean {\r\n    if (!this.masterKey) {\r\n      logger.error('Cannot verify integrity without master key', { backupId });\r\n      return false;\r\n    }\r\n\r\n    try {\r\n      const iv = Buffer.from(encrypted.metadata.iv, 'hex');\r\n      const authTag = Buffer.from(encrypted.metadata.authTag, 'hex');\r\n      const expectedHmac = encrypted.metadata.hmac;\r\n\r\n      const calculatedHmac = crypto\r\n        .createHmac(this.HMAC_ALGORITHM, this.masterKey)\r\n        .update(Buffer.concat([iv, encrypted.data, authTag]))\r\n        .digest()\r\n        .toString('hex');\r\n\r\n      const verified = calculatedHmac === expectedHmac;\r\n\r\n      if (!verified) {\r\n        logger.warn('Integrity verification failed', { backupId });\r\n      }\r\n\r\n      return verified;\r\n    } catch (error) {\r\n      logger.error('Integrity verification error', error instanceof Error ? error : undefined, {\r\n        backupId,\r\n      });\r\n\r\n      return false;\r\n    }\r\n  }\r\n\r\n  /**\r\n   * Detect if a backup file is encrypted\r\n   *\r\n   * Useful for backward compatibility - detects if backup is encrypted\r\n   *\r\n   * @param data - File data\r\n   * @returns Whether the data appears to be encrypted\r\n   */\r\n  static isEncrypted(data: Buffer): boolean {\r\n    // Encrypted data with metadata should have a specific structure\r\n    // For now, we can check if the data is valid JSON metadata (simple heuristic)\r\n    try {\r\n      // Try to detect our encryption format\r\n      // This is a simple heuristic - encrypted data won't be valid text/JSON\r\n      if (data.length < 100) {\r\n        return false;\r\n      }\r\n\r\n      // Try to parse as JSON at the end for metadata\r\n      const str = data.toString('utf8', Math.max(0, data.length - 500));\r\n      const match = str.match(/\"algorithm\"\\s*:\\s*\"AES-256-GCM\"/);\r\n\r\n      return match !== null;\r\n    } catch {\r\n      return false;\r\n    }\r\n  }\r\n\r\n  /**\r\n   * Generate a new encryption key\r\n   *\r\n   * Useful for key rotation\r\n   *\r\n   * @returns 32-byte hex-encoded AES-256 key\r\n   */\r\n  static generateKey(): string {\r\n    return crypto.randomBytes(32).toString('hex');\r\n  }\r\n\r\n  /**\r\n   * Export encryption metadata as JSON\r\n   *\r\n   * Useful for storing metadata separately from encrypted data\r\n   *\r\n   * @param encrypted - Encrypted backup\r\n   * @returns JSON stringified metadata\r\n   */\r\n  static exportMetadata(encrypted: EncryptedBackup): string {\r\n    return JSON.stringify(encrypted.metadata, null, 2);\r\n  }\r\n\r\n  /**\r\n   * Import encryption metadata from JSON\r\n   *\r\n   * @param metadataJson - JSON stringified metadata\r\n   * @returns Parsed encryption metadata\r\n   */\r\n  static importMetadata(metadataJson: string): EncryptionMetadata {\r\n    return JSON.parse(metadataJson) as EncryptionMetadata;\r\n  }\r\n\r\n  // ============================================================================\r\n  // Private Helper Methods\r\n  // ============================================================================\r\n\r\n  private isEncryptionEnabled(): boolean {\r\n    const enabled = process.env.BACKUP_ENCRYPTION_ENABLED?.toLowerCase() === 'true';\r\n    return enabled;\r\n  }\r\n}\r\n\r\n/**\r\n * Singleton instance\r\n */\r\nlet defaultManager: EncryptionManager | null = null;\r\n\r\n/**\r\n * Get the default encryption manager instance\r\n */\r\nexport function getEncryptionManager(config?: EncryptionConfig): EncryptionManager {\r\n  if (!defaultManager) {\r\n    defaultManager = new EncryptionManager(config);\r\n  }\r\n  return defaultManager;\r\n}\r\n"],"names":["crypto","createLogger","createError","ErrorCode","logger","EncryptionManager","enabled","masterKey","keyVersion","ALGORITHM","IV_LENGTH","AUTH_TAG_LENGTH","KEY_LENGTH","HMAC_ALGORITHM","config","undefined","isEncryptionEnabled","keyHex","process","env","BACKUP_ENCRYPTION_KEY","VALIDATION_FAILED","enabledVia","Buffer","from","length","providedLength","expectedLength","info","algorithm","keyLength","ivLength","authTagLength","error","Error","message","String","enablementRequired","isEnabled","encrypt","data","backupId","iv","randomBytes","cipher","createCipheriv","encryptedData","update","concat","final","authTag","getAuthTag","hmac","createHmac","digest","metadata","toString","encryptedAt","Date","toISOString","debug","dataSize","encryptedSize","INTERNAL_ERROR","decrypt","encrypted","expectedHmac","calculatedHmac","integrityVerified","warn","decipher","createDecipheriv","setAuthTag","decryptedData","decryptedSize","verifyIntegrity","verified","isEncrypted","str","Math","max","match","generateKey","exportMetadata","JSON","stringify","importMetadata","metadataJson","parse","BACKUP_ENCRYPTION_ENABLED","toLowerCase","defaultManager","getEncryptionManager"],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BC,GAED,YAAYA,YAAY,SAAS;AACjC,SAASC,YAAY,QAAQ,eAAe;AAC5C,SAASC,WAAW,EAAEC,SAAS,QAAQ,cAAc;AAErD,MAAMC,SAASH,aAAa;AAsD5B;;;;CAIC,GACD,OAAO,MAAMI;IACHC,QAAiB;IACjBC,YAA2B,KAAK;IAChCC,WAAmB;IACVC,YAAY,cAAc;IAC1BC,YAAY,GAAG;IACfC,kBAAkB,GAAG;IACrBC,aAAa,GAAG;IAChBC,iBAAiB,SAAS;IAE3C,YAAYC,SAA2B,CAAC,CAAC,CAAE;QACzC,iCAAiC;QACjC,IAAI,CAACR,OAAO,GAAGQ,OAAOR,OAAO,KAAKS,YAAYD,OAAOR,OAAO,GAAG,IAAI,CAACU,mBAAmB;QAEvF,+BAA+B;QAC/B,IAAI,IAAI,CAACV,OAAO,EAAE;YAChB,MAAMW,SAASH,OAAOP,SAAS,IAAIW,QAAQC,GAAG,CAACC,qBAAqB;YAEpE,IAAI,CAACH,QAAQ;gBACX,MAAMf,YACJC,UAAUkB,iBAAiB,EAC3B,qFACA;oBAAEC,YAAY;gBAAoC;YAEtD;YAEA,IAAI;gBACF,IAAI,CAACf,SAAS,GAAGgB,OAAOC,IAAI,CAACP,QAAQ;gBAErC,IAAI,IAAI,CAACV,SAAS,CAACkB,MAAM,KAAK,IAAI,CAACb,UAAU,EAAE;oBAC7C,MAAMV,YACJC,UAAUkB,iBAAiB,EAC3B,CAAC,2BAA2B,EAAE,IAAI,CAACT,UAAU,CAAC,QAAQ,EAAE,IAAI,CAACA,UAAU,GAAG,EAAE,gBAAgB,CAAC,EAC7F;wBAAEc,gBAAgB,IAAI,CAACnB,SAAS,CAACkB,MAAM;wBAAEE,gBAAgB,IAAI,CAACf,UAAU;oBAAC;gBAE7E;gBAEAR,OAAOwB,IAAI,CAAC,mDAAmD;oBAC7DtB,SAAS;oBACTuB,WAAW,IAAI,CAACpB,SAAS;oBACzBqB,WAAW,IAAI,CAAClB,UAAU;oBAC1BmB,UAAU,IAAI,CAACrB,SAAS;oBACxBsB,eAAe,IAAI,CAACrB,eAAe;gBACrC;YACF,EAAE,OAAOsB,OAAO;gBACd,IAAIA,iBAAiBC,SAAS,UAAUD,OAAO;oBAC7C,MAAMA;gBACR;gBAEA,MAAM/B,YACJC,UAAUkB,iBAAiB,EAC3B,iFACA;oBAAEY,OAAOA,iBAAiBC,QAAQD,MAAME,OAAO,GAAGC,OAAOH;gBAAO;YAEpE;QACF,OAAO;YACL7B,OAAOwB,IAAI,CAAC,2DAA2D;gBACrEtB,SAAS;gBACT+B,oBACE;YACJ;QACF;QAEA,IAAI,CAAC7B,UAAU,GAAGM,OAAON,UAAU,IAAI;IACzC;IAEA;;GAEC,GACD8B,YAAqB;QACnB,OAAO,IAAI,CAAChC,OAAO;IACrB;IAEA;;;;;;;GAOC,GACD,MAAMiC,QAAQC,IAAY,EAAEC,QAAgB,EAA4B;QACtE,IAAI,CAAC,IAAI,CAACnC,OAAO,IAAI,CAAC,IAAI,CAACC,SAAS,EAAE;YACpC,MAAML,YACJC,UAAUkB,iBAAiB,EAC3B,kGACA;gBAAEoB;YAAS;QAEf;QAEA,IAAI;YACF,uCAAuC;YACvC,MAAMC,KAAK1C,OAAO2C,WAAW,CAAC,IAAI,CAACjC,SAAS;YAE5C,gBAAgB;YAChB,MAAMkC,SAAS5C,OAAO6C,cAAc,CAAC,IAAI,CAACpC,SAAS,EAAE,IAAI,CAACF,SAAS,EAAEmC;YAErE,eAAe;YACf,IAAII,gBAAgBF,OAAOG,MAAM,CAACP;YAClCM,gBAAgBvB,OAAOyB,MAAM,CAAC;gBAACF;gBAAeF,OAAOK,KAAK;aAAG;YAE7D,yBAAyB;YACzB,MAAMC,UAAUN,OAAOO,UAAU;YAEjC,uDAAuD;YACvD,MAAMC,OAAOpD,OACVqD,UAAU,CAAC,IAAI,CAACxC,cAAc,EAAE,IAAI,CAACN,SAAS,EAC9CwC,MAAM,CAACxB,OAAOyB,MAAM,CAAC;gBAACN;gBAAII;gBAAeI;aAAQ,GACjDI,MAAM;YAET,kBAAkB;YAClB,MAAMC,WAA+B;gBACnC1B,WAAW;gBACXa,IAAIA,GAAGc,QAAQ,CAAC;gBAChBN,SAASA,QAAQM,QAAQ,CAAC;gBAC1BJ,MAAMA,KAAKI,QAAQ,CAAC;gBACpBC,aAAa,IAAIC,OAAOC,WAAW;gBACnCnD,YAAY,IAAI,CAACA,UAAU;YAC7B;YAEAJ,OAAOwD,KAAK,CAAC,iCAAiC;gBAC5CnB;gBACAZ,WAAW,IAAI,CAACpB,SAAS;gBACzBoD,UAAUrB,KAAKf,MAAM;gBACrBqC,eAAehB,cAAcrB,MAAM;gBACnCM,UAAUW,GAAGjB,MAAM;gBACnBO,eAAekB,QAAQzB,MAAM;YAC/B;YAEA,OAAO;gBACLe,MAAMM;gBACNS;YACF;QACF,EAAE,OAAOtB,OAAO;YACd7B,OAAO6B,KAAK,CACV,4BACAA,iBAAiBC,QAAQD,QAAQlB,WACjC;gBAAE0B;YAAS;YAGb,MAAMvC,YACJC,UAAU4D,cAAc,EACxB,4BACA;gBACEtB;gBACAR,OAAOA,iBAAiBC,QAAQD,MAAME,OAAO,GAAGC,OAAOH;YACzD;QAEJ;IACF;IAEA;;;;;;;GAOC,GACD,MAAM+B,QAAQC,SAA0B,EAAExB,QAAgB,EAA6B;QACrF,IAAI,CAAC,IAAI,CAACnC,OAAO,IAAI,CAAC,IAAI,CAACC,SAAS,EAAE;YACpC,MAAML,YACJC,UAAUkB,iBAAiB,EAC3B,kGACA;gBAAEoB;YAAS;QAEf;QAEA,IAAI;YACF,oBAAoB;YACpB,MAAMC,KAAKnB,OAAOC,IAAI,CAACyC,UAAUV,QAAQ,CAACb,EAAE,EAAE;YAC9C,MAAMQ,UAAU3B,OAAOC,IAAI,CAACyC,UAAUV,QAAQ,CAACL,OAAO,EAAE;YACxD,MAAMgB,eAAeD,UAAUV,QAAQ,CAACH,IAAI;YAE5C,MAAMe,iBAAiBnE,OACpBqD,UAAU,CAAC,IAAI,CAACxC,cAAc,EAAE,IAAI,CAACN,SAAS,EAC9CwC,MAAM,CAACxB,OAAOyB,MAAM,CAAC;gBAACN;gBAAIuB,UAAUzB,IAAI;gBAAEU;aAAQ,GAClDI,MAAM,GACNE,QAAQ,CAAC;YAEZ,MAAMY,oBAAoBD,mBAAmBD;YAE7C,IAAI,CAACE,mBAAmB;gBACtBhE,OAAOiE,IAAI,CAAC,8CAA8C;oBACxD5B;oBACAyB;oBACAC;gBACF;YACF;YAEA,eAAe;YACf,MAAMG,WAAWtE,OAAOuE,gBAAgB,CAAC,IAAI,CAAC9D,SAAS,EAAE,IAAI,CAACF,SAAS,EAAEmC;YACzE4B,SAASE,UAAU,CAACtB;YAEpB,IAAIuB,gBAAgBH,SAASvB,MAAM,CAACkB,UAAUzB,IAAI;YAClDiC,gBAAgBlD,OAAOyB,MAAM,CAAC;gBAACyB;gBAAeH,SAASrB,KAAK;aAAG;YAE/D7C,OAAOwD,KAAK,CAAC,iCAAiC;gBAC5CnB;gBACAZ,WAAW,IAAI,CAACpB,SAAS;gBACzBqD,eAAeG,UAAUzB,IAAI,CAACf,MAAM;gBACpCiD,eAAeD,cAAchD,MAAM;gBACnC2C;YACF;YAEA,OAAO;gBACL5B,MAAMiC;gBACNL;gBACAb,UAAUU,UAAUV,QAAQ;YAC9B;QACF,EAAE,OAAOtB,OAAO;YACd7B,OAAO6B,KAAK,CACV,4BACAA,iBAAiBC,QAAQD,QAAQlB,WACjC;gBAAE0B;YAAS;YAGb,MAAMvC,YACJC,UAAU4D,cAAc,EACxB,8EACA;gBACEtB;gBACAR,OAAOA,iBAAiBC,QAAQD,MAAME,OAAO,GAAGC,OAAOH;YACzD;QAEJ;IACF;IAEA;;;;;;GAMC,GACD0C,gBAAgBV,SAA0B,EAAExB,QAAiB,EAAW;QACtE,IAAI,CAAC,IAAI,CAAClC,SAAS,EAAE;YACnBH,OAAO6B,KAAK,CAAC,8CAA8C;gBAAEQ;YAAS;YACtE,OAAO;QACT;QAEA,IAAI;YACF,MAAMC,KAAKnB,OAAOC,IAAI,CAACyC,UAAUV,QAAQ,CAACb,EAAE,EAAE;YAC9C,MAAMQ,UAAU3B,OAAOC,IAAI,CAACyC,UAAUV,QAAQ,CAACL,OAAO,EAAE;YACxD,MAAMgB,eAAeD,UAAUV,QAAQ,CAACH,IAAI;YAE5C,MAAMe,iBAAiBnE,OACpBqD,UAAU,CAAC,IAAI,CAACxC,cAAc,EAAE,IAAI,CAACN,SAAS,EAC9CwC,MAAM,CAACxB,OAAOyB,MAAM,CAAC;gBAACN;gBAAIuB,UAAUzB,IAAI;gBAAEU;aAAQ,GAClDI,MAAM,GACNE,QAAQ,CAAC;YAEZ,MAAMoB,WAAWT,mBAAmBD;YAEpC,IAAI,CAACU,UAAU;gBACbxE,OAAOiE,IAAI,CAAC,iCAAiC;oBAAE5B;gBAAS;YAC1D;YAEA,OAAOmC;QACT,EAAE,OAAO3C,OAAO;YACd7B,OAAO6B,KAAK,CAAC,gCAAgCA,iBAAiBC,QAAQD,QAAQlB,WAAW;gBACvF0B;YACF;YAEA,OAAO;QACT;IACF;IAEA;;;;;;;GAOC,GACD,OAAOoC,YAAYrC,IAAY,EAAW;QACxC,gEAAgE;QAChE,8EAA8E;QAC9E,IAAI;YACF,sCAAsC;YACtC,uEAAuE;YACvE,IAAIA,KAAKf,MAAM,GAAG,KAAK;gBACrB,OAAO;YACT;YAEA,+CAA+C;YAC/C,MAAMqD,MAAMtC,KAAKgB,QAAQ,CAAC,QAAQuB,KAAKC,GAAG,CAAC,GAAGxC,KAAKf,MAAM,GAAG;YAC5D,MAAMwD,QAAQH,IAAIG,KAAK,CAAC;YAExB,OAAOA,UAAU;QACnB,EAAE,OAAM;YACN,OAAO;QACT;IACF;IAEA;;;;;;GAMC,GACD,OAAOC,cAAsB;QAC3B,OAAOlF,OAAO2C,WAAW,CAAC,IAAIa,QAAQ,CAAC;IACzC;IAEA;;;;;;;GAOC,GACD,OAAO2B,eAAelB,SAA0B,EAAU;QACxD,OAAOmB,KAAKC,SAAS,CAACpB,UAAUV,QAAQ,EAAE,MAAM;IAClD;IAEA;;;;;GAKC,GACD,OAAO+B,eAAeC,YAAoB,EAAsB;QAC9D,OAAOH,KAAKI,KAAK,CAACD;IACpB;IAEA,+EAA+E;IAC/E,yBAAyB;IACzB,+EAA+E;IAEvEvE,sBAA+B;QACrC,MAAMV,UAAUY,QAAQC,GAAG,CAACsE,yBAAyB,EAAEC,kBAAkB;QACzE,OAAOpF;IACT;AACF;AAEA;;CAEC,GACD,IAAIqF,iBAA2C;AAE/C;;CAEC,GACD,OAAO,SAASC,qBAAqB9E,MAAyB;IAC5D,IAAI,CAAC6E,gBAAgB;QACnBA,iBAAiB,IAAItF,kBAAkBS;IACzC;IACA,OAAO6E;AACT"}