mask-privacy 4.1.0 → 4.3.0

package/dist/index.js

@@ -1,7 +1,7 @@
 'use strict';
 
 var process2 = require('process');
-var path = require('path');
+var path2 = require('path');
 var os = require('os');
 var cryptoNode = require('crypto');
 var fs = require('fs');
@@ -36,7 +36,7 @@ function _interopNamespace(e) {
 }
 
 var process2__namespace = /*#__PURE__*/_interopNamespace(process2);
-var path__namespace = /*#__PURE__*/_interopNamespace(path);
+var path2__namespace = /*#__PURE__*/_interopNamespace(path2);
 var os__namespace = /*#__PURE__*/_interopNamespace(os);
 var cryptoNode__namespace = /*#__PURE__*/_interopNamespace(cryptoNode);
 var fs__namespace = /*#__PURE__*/_interopNamespace(fs);
@@ -129,6 +129,11 @@ var init_config = __esm({
       get MASK_ENCRYPTION_KEY() {
         return process2__namespace.env.MASK_ENCRYPTION_KEY || null;
       },
+      // JSON map of keyId -> base64 key string for key rotation, e.g. {"v1":"...","v2":"..."}
+      // The last entry in the map is treated as the active (encryption) key.
+      get MASK_KEYRING() {
+        return process2__namespace.env.MASK_KEYRING || null;
+      },
       get MASK_MASTER_KEY() {
         return process2__namespace.env.MASK_MASTER_KEY || process2__namespace.env.MASK_ENCRYPTION_KEY || "";
       },
@@ -160,6 +165,9 @@ var init_config = __esm({
       get MASK_VAULT_CLEANUP_FREQUENCY() {
         return getEnvFloat("MASK_VAULT_CLEANUP_FREQUENCY", 0.01);
       },
+      get MASK_VAULT_MAX_MEMORY_KEYS() {
+        return getEnvInt("MASK_VAULT_MAX_MEMORY_KEYS", 1e5);
+      },
       // --- BACKEND CONNECTIONS ---
       get MASK_REDIS_URL() {
         return process2__namespace.env.MASK_REDIS_URL || "redis://localhost:6379/0";
@@ -199,7 +207,7 @@ var init_config = __esm({
         return process2__namespace.env.MASK_SCANNER_URL || "http://localhost:5001/analyze";
       },
       get MASK_MODEL_CACHE_DIR() {
-        return process2__namespace.env.MASK_MODEL_CACHE_DIR || path__namespace.join(os__namespace.homedir(), ".cache", "mask");
+        return process2__namespace.env.MASK_MODEL_CACHE_DIR || path2__namespace.join(os__namespace.homedir(), ".cache", "mask");
       },
       // --- TELEMETRY & AUDIT ---
       get MASK_AUDIT_LOG_STRICT() {
@@ -224,6 +232,16 @@ var init_key_provider = __esm({
   "src/core/key_provider.ts"() {
     init_config();
     BaseKeyProvider = class {
+      /**
+       * Return a JSON keyring string (e.g. from KMS / Secrets Manager), or null
+       * to fall back to the MASK_KEYRING environment variable.
+       *
+       * Override in KMS-backed providers to source the full keyring from a
+       * secure external store, removing the need for MASK_KEYRING in env vars.
+       */
+      getKeyring() {
+        return null;
+      }
     };
     EnvKeyProvider = class extends BaseKeyProvider {
       async getEncryptionKey() {
@@ -239,6 +257,10 @@ var init_key_provider = __esm({
         let key = config.MASK_MASTER_KEY;
         return key || null;
       }
+      /** Return MASK_KEYRING from environment (default behaviour). */
+      async getKeyring() {
+        return config.MASK_KEYRING || null;
+      }
     };
     providerInstance = null;
   }
@@ -692,17 +714,34 @@ function looksLikeToken(value) {
   if (v7.includes("-") && v7.length >= 6) {
     const parts = v7.split("-");
     const tag = parts[parts.length - 1];
-    if (tag.length === 4 && /^\d+$/.test(tag)) {
+    if (tag.length >= 3 && tag.length <= 10 && /^\d+$/.test(tag)) {
       return true;
     }
   }
   return false;
 }
+function isUnambiguouslySafeToken(value) {
+  if (typeof value !== "string") return false;
+  const v7 = value.trim();
+  if (v7.startsWith("tkn-") && v7.includes("@")) {
+    const parts = v7.split("@");
+    if (parts.length === 2 && parts[0].length >= 12 && parts[1].includes(".")) {
+      return true;
+    }
+  }
+  if (/^\+[1-9]\d{0,3}-555-\d{7}$/.test(v7)) return true;
+  if (/^000\d{5}[A-Z]$/.test(v7)) return true;
+  if (/^[A-Z]{2}00[A-F0-9]{4,16}$/.test(v7)) return true;
+  if (/^<(PER|LOC|ORG):[^>]+>$/.test(v7)) return true;
+  if (v7.startsWith("[TKN-") && v7.endsWith("]")) return true;
+  if (/^[A-Z][a-zA-Z, ]+-[0-9]{3,10}$/.test(v7)) return true;
+  return false;
+}
 var TOKEN_PATTERN;
 var init_fpe_utils = __esm({
   "src/core/fpe_utils.ts"() {
     TOKEN_PATTERN = new RegExp(
-      "tkn-[a-f0-9]{8,64}@[A-Za-z0-9.\\-]+\\.[A-Za-z]{2,}|\\+[1-9]\\d{0,3}-555-\\d{7}|\\d{3}-\\d{2}-\\d{4}|\\d{4}-\\d{4}-\\d{4}-\\d{4}|\\b\\d{9}\\b|\\b000\\d{5}[A-Z]\\b|[A-Z]{2}00[A-F0-9]{4,16}|<(?:PER|LOC|ORG):[^>]+>|\\b[A-Z][a-zA-Z, ]+-[0-9]{3,4}\\b|\\[TKN-[^\\]]+\\]",
+      "tkn-[a-f0-9]{8,64}@[A-Za-z0-9.\\-]+\\.[A-Za-z]{2,}|\\+[1-9]\\d{0,3}-555-\\d{7}|\\d{3}-\\d{2}-\\d{4}|\\d{4}-\\d{4}-\\d{4}-\\d{4}|\\b\\d{9}\\b|\\b000\\d{5}[A-Z]\\b|[A-Z]{2}00[A-F0-9]{4,16}|<(?:PER|LOC|ORG):[^>]+>|\\b[A-Z][a-zA-Z, ]+-[0-9]{3,10}\\b|\\[TKN-[^\\]]+\\]",
       // Opaque
       "g"
     );
@@ -732,7 +771,7 @@ function resetMasterKey() {
 }
 async function _getAesKey() {
   const masterKey = await _getMasterKey();
-  return cryptoNode__namespace.createHash("sha256").update(masterKey).digest();
+  return cryptoNode__namespace.createHmac("sha256", masterKey).update(config.MASK_TENANT_ID, "utf-8").digest();
 }
 async function _hmacHex(plaintext, n6 = 8) {
   const masterKey = await _getMasterKey();
@@ -740,61 +779,57 @@ async function _hmacHex(plaintext, n6 = 8) {
   return digest.slice(0, n6);
 }
 async function _getBijectiveTweak() {
-  const masterKey = await _getMasterKey();
-  let base = config.MASK_TENANT_ID;
   if (config.MASK_SALT_ROTATION !== "NONE") {
-    const now = /* @__PURE__ */ new Date();
-    if (config.MASK_SALT_ROTATION === "MONTHLY") {
-      base += `-${now.getUTCFullYear()}-${now.getUTCMonth() + 1}`;
-    } else if (config.MASK_SALT_ROTATION === "YEARLY") {
-      base += `-${now.getUTCFullYear()}`;
-    }
+    console.warn(
+      `[mask] MASK_SALT_ROTATION=${config.MASK_SALT_ROTATION} is deprecated and ignored. Time-based tweaks caused permanent data loss on month/year rollovers. Use MASK_KEYRING for key rotation instead.`
+    );
   }
-  return cryptoNode__namespace.createHmac("sha256", masterKey).update(base, "utf-8").digest();
+  const masterKey = await _getMasterKey();
+  return cryptoNode__namespace.createHmac("sha256", masterKey).update(config.MASK_TENANT_ID, "utf-8").digest();
 }
 async function _encryptBijectiveFF1(text) {
   const canonical = text.toLowerCase().trim();
   const hash = cryptoNode__namespace.createHash("sha256").update(canonical, "utf-8").digest();
-  const inputInt = hash.readBigUInt64BE(0);
-  const inputStr = inputInt.toString().padStart(20, "0");
+  const hash128 = hash.subarray(0, 16);
+  const inputInt = hash128.readBigUInt64BE(0) << 64n | hash128.readBigUInt64BE(8);
+  const inputStr = inputInt.toString().padStart(40, "0");
   const aesKey = await _getAesKey();
   const tweak = await _getBijectiveTweak();
   const engine = new FF1(aesKey, tweak, 10);
   const cipherStr = engine.encrypt(inputStr);
-  return BigInt(cipherStr) % 2n ** 64n;
+  return BigInt(cipherStr);
 }
 function _renderBijectivePerson(bits) {
   const firstIdx = Number(bits & 0x7FFn);
   const connIdx = Number(bits >> 11n & 0x3Fn);
   const rootIdx = Number(bits >> 17n & 0xFFFn);
   const suffixIdx = Number(bits >> 29n & 0x1FFn);
-  const tag = Number(bits >> 38n & 0x3FFFn);
-  const formatIdx = Number(bits >> 52n & 0xFn);
+  const tag = bits >> 38n & 0xFFFFFFFFFFn;
+  const formatIdx = Number(bits >> 78n & 0xFn);
   const first = FIRST_NAMES[firstIdx % FIRST_NAMES.length];
   const conn = CONNECTORS[connIdx % CONNECTORS.length];
   const root = SURNAME_ROOTS[rootIdx % SURNAME_ROOTS.length];
   const suffix = SURNAME_SUFFIXES[suffixIdx % SURNAME_SUFFIXES.length];
   const surname = `${root}${suffix}`;
-  const numeric = tag % 1e4;
-  const paddedNumeric = numeric.toString().padStart(4, "0");
+  const numeric = Number(tag % 10000000000n);
+  const paddedNumeric = numeric.toString().padStart(10, "0");
   if (formatIdx === 0) return `${first} ${conn} ${surname}-${paddedNumeric}`;
   if (formatIdx === 1) return `${surname}, ${first}-${paddedNumeric}`;
   if (formatIdx === 2) return `${first[0]}. ${surname}-${paddedNumeric}`;
-  if (formatIdx === 3) return `${first} ${surname}-${paddedNumeric}`;
   return `${first} ${surname}-${paddedNumeric}`;
 }
 function _renderBijectiveLocation(bits) {
   const s1 = Number(bits & 0x3FFn);
   const s22 = Number(bits >> 10n & 0x3FFn);
   const s32 = Number(bits >> 20n & 0x3FFn);
-  const tag = Number(bits >> 30n & 0xFFFn);
+  const tag = bits >> 30n & 0xFFFFFFFFFFn;
   const city = `${SYLLABLES[s1 % 1e3]}${SYLLABLES[s22 % 1e3].toLowerCase()}${SYLLABLES[s32 % 1e3].toLowerCase()}`;
-  return `${city}-${tag.toString().padStart(3, "0")}`;
+  return `${city}-${Number(tag % 10000000000n).toString().padStart(10, "0")}`;
 }
-function _computeLuhnDigit(partialNum) {
-  const digits = partialNum.split("").map(Number);
+function _getLuhnSum(numStr) {
+  const digits = numStr.split("").map(Number);
   let sum = 0;
-  let shouldDouble = true;
+  let shouldDouble = false;
   for (let i6 = digits.length - 1; i6 >= 0; i6--) {
     let digit = digits[i6];
     if (shouldDouble) {
@@ -804,7 +839,7 @@ function _computeLuhnDigit(partialNum) {
     sum += digit;
     shouldDouble = !shouldDouble;
   }
-  return ((10 - sum % 10) % 10).toString();
+  return sum;
 }
 function _computeEsIdCheck(num) {
   return "TRWAGMYFPDXBNJZSQVHLCKE"[num % 23];
@@ -851,14 +886,15 @@ async function generateDPToken(rawText, entityType = "UNKNOWN") {
   if (type === "CREDIT_CARD" || type === "CREDIT_CARD_NUMBER") {
     const digits = _stripCcSeparators(text);
     if (digits.length === 16) {
-      const bin6 = digits.slice(0, 6);
-      const last4 = digits.slice(12, 16);
-      const middle6 = digits.slice(6, 12);
+      const prefix6 = digits.slice(0, 6);
+      const suffix4 = digits.slice(12, 16);
+      const middle5 = digits.slice(6, 11);
       const engine = new FF1(await _getAesKey(), Buffer.from("CREDIT_CARD"), 10);
-      const encMiddle = engine.encrypt(middle6);
-      const base15 = bin6 + encMiddle + last4.slice(0, 3);
-      const checkDig = _computeLuhnDigit(base15);
-      const full = bin6 + encMiddle + last4.slice(0, 3) + checkDig;
+      const encMiddle5 = engine.encrypt(middle5);
+      const draft = prefix6 + encMiddle5 + "0" + suffix4;
+      const sum = _getLuhnSum(draft);
+      const correction = (10 - sum % 10) % 10;
+      const full = prefix6 + encMiddle5 + correction.toString() + suffix4;
       return `${full.slice(0, 4)}-${full.slice(4, 8)}-${full.slice(8, 12)}-${full.slice(12, 16)}`;
     } else {
       const fallbackDigits = digits.padEnd(16, "0").slice(0, 16);
@@ -3349,24 +3385,28 @@ function getCryptoEngine() {
 async function getCryptoEngineAsync() {
   return await CryptoEngine.getInstanceAsync();
 }
-var GCM_IV_BYTES, GCM_AUTH_TAG_BYTES, GCM_ALGORITHM, AES_GCM_PREFIX, _CryptoEngine, CryptoEngine;
+var AES_KEY_BYTES, GCM_IV_BYTES, GCM_AUTH_TAG_BYTES, GCM_ALGORITHM, AES_V2_PREFIX, AES_GCM_PREFIX, AES_GCM_LEGACY_PREFIX, _CryptoEngine, CryptoEngine;
 var init_crypto = __esm({
   "src/core/crypto.ts"() {
     init_config();
     init_key_provider();
     init_exceptions();
+    AES_KEY_BYTES = 32;
     GCM_IV_BYTES = 12;
     GCM_AUTH_TAG_BYTES = 16;
     GCM_ALGORITHM = "aes-256-gcm";
-    AES_GCM_PREFIX = "aes:";
+    AES_V2_PREFIX = "aes:v2:";
+    AES_GCM_PREFIX = "aes:v1:";
+    AES_GCM_LEGACY_PREFIX = "aes:";
     _CryptoEngine = class _CryptoEngine {
       constructor() {
-        this._aesKey = null;
+        this._keyring = /* @__PURE__ */ new Map();
+        this._activeKeyId = "default";
         this._indexSecret = null;
       }
-      /** 
+      /**
        * Return the singleton instance, initialising it if necessary.
-       * This is asynchronous because key providers (KMS, etc.) might be async.
+       * Async because Argon2id key derivation is async.
        */
       static async getInstanceAsync() {
         if (this._instance === null) {
@@ -3382,11 +3422,11 @@ var init_crypto = __esm({
         }
         return this._instance;
       }
-      /** Clear the singleton instance to force re-initialization (useful for key rotation). */
+      /** Clear the singleton (useful for key rotation / tests). */
       static reset() {
         this._instance = null;
       }
-      async _init() {
+      async _deriveAesKey(rawKey, keyId) {
         let argon2;
         try {
           argon2 = __require("argon2");
@@ -3395,38 +3435,72 @@ var init_crypto = __esm({
             "The 'argon2' package is required for Mask SDK cryptographic operations. Install with: npm install argon2"
           );
         }
-        const provider = getKeyProvider();
-        const keyFromProvider = await provider.getEncryptionKey();
-        let key;
-        if (!keyFromProvider) {
-          if (config.MASK_DEV_MODE) {
-            key = cryptoNode__namespace.randomBytes(32).toString("base64");
-            process.env.MASK_ENCRYPTION_KEY = key;
-            console.warn(
-              "MASK_DEV_MODE is enabled. Using a generated throwaway key. DO NOT USE THIS IN PRODUCTION \u2014 tokens will be lost on restart."
-            );
-          } else {
-            throw new Error(
-              "MASK_ENCRYPTION_KEY is not set. Set MASK_ENCRYPTION_KEY to a valid encryption key, or set MASK_DEV_MODE=true to use an ephemeral throwaway key."
-            );
-          }
-        } else {
-          key = keyFromProvider;
-        }
-        const kdfSaltStr = config.MASK_KDF_SALT + "-" + config.MASK_TENANT_ID;
+        const kdfSaltStr = config.MASK_KDF_SALT + "-" + config.MASK_TENANT_ID + "-" + keyId;
         const kdfSaltBytes = cryptoNode__namespace.createHash("sha256").update(kdfSaltStr).digest().subarray(0, 16);
-        this._aesKey = await argon2.hash(key, {
+        return await argon2.hash(rawKey, {
           type: argon2.argon2id,
           memoryCost: 19456,
-          // 19 MiB
           timeCost: 2,
           parallelism: 1,
-          hashLength: 32,
+          hashLength: AES_KEY_BYTES,
           salt: kdfSaltBytes,
           raw: true
-          // return a Buffer, not a hash string
         });
-        const masterKey = await provider.getMasterKey() || key;
+      }
+      async _init() {
+        let argon2;
+        try {
+          argon2 = __require("argon2");
+        } catch (e6) {
+          throw new Error("The 'argon2' package is required. Install with: npm install argon2");
+        }
+        const provider = getKeyProvider();
+        const rawKeys = /* @__PURE__ */ new Map();
+        let activeKeyId = "default";
+        const keyringJson = await provider.getKeyring();
+        if (keyringJson) {
+          let parsed;
+          try {
+            parsed = JSON.parse(keyringJson);
+            if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+              throw new Error("MASK_KEYRING must be a non-empty JSON object.");
+            }
+          } catch (e6) {
+            throw new Error(`Invalid MASK_KEYRING format: ${e6}`);
+          }
+          const entries = Object.entries(parsed);
+          if (entries.length === 0) throw new Error("MASK_KEYRING must contain at least one key.");
+          for (const [kid, k6] of entries) rawKeys.set(kid, k6);
+          activeKeyId = entries[entries.length - 1][0];
+        } else {
+          const keyFromProvider = await provider.getEncryptionKey();
+          let key;
+          if (!keyFromProvider) {
+            if (config.MASK_DEV_MODE) {
+              key = cryptoNode__namespace.randomBytes(32).toString("base64");
+              process.env.MASK_ENCRYPTION_KEY = key;
+              console.warn(
+                "MASK_DEV_MODE is enabled. Using a generated throwaway key. DO NOT USE THIS IN PRODUCTION \u2014 tokens will be lost on restart."
+              );
+            } else {
+              throw new Error(
+                "MASK_ENCRYPTION_KEY or MASK_KEYRING is not set. Set one of these, or set MASK_DEV_MODE=true for ephemeral use."
+              );
+            }
+          } else {
+            key = keyFromProvider;
+          }
+          rawKeys.set("default", key);
+          activeKeyId = "default";
+        }
+        this._keyring = /* @__PURE__ */ new Map();
+        for (const [kid, rawKey] of rawKeys) {
+          this._keyring.set(kid, await this._deriveAesKey(rawKey, kid));
+        }
+        this._activeKeyId = activeKeyId;
+        const rawKeysArr = Array.from(rawKeys.values());
+        const lastRawKey = rawKeysArr[rawKeysArr.length - 1];
+        const masterKey = await provider.getMasterKey() || lastRawKey;
         const indexSaltStr = config.MASK_BLIND_INDEX_SALT + "-" + config.MASK_TENANT_ID;
         const indexSaltBytes = cryptoNode__namespace.createHash("sha256").update(indexSaltStr).digest().subarray(0, 16);
         this._indexSecret = await argon2.hash(masterKey, {
@@ -3434,7 +3508,7 @@ var init_crypto = __esm({
           memoryCost: 19456,
           timeCost: 2,
           parallelism: 1,
-          hashLength: 32,
+          hashLength: AES_KEY_BYTES,
           salt: indexSaltBytes,
           raw: true
         });
@@ -3446,36 +3520,56 @@ var init_crypto = __esm({
         }
         return this._indexSecret;
       }
+      /** Encrypt plaintext using the active keyring key.
+       *  Envelope format: aes:v2:{keyId}:{base64(iv+authTag+ciphertext)}
+       */
       encrypt(plaintext) {
-        if (!this._aesKey) {
-          throw new Error("CryptoEngine not initialised. AES key missing.");
+        const aesKey = this._keyring.get(this._activeKeyId);
+        if (!aesKey) {
+          throw new Error(`CryptoEngine: active key ID '${this._activeKeyId}' not found in keyring.`);
         }
         const iv = cryptoNode__namespace.randomBytes(GCM_IV_BYTES);
-        const cipher = cryptoNode__namespace.createCipheriv(GCM_ALGORITHM, this._aesKey, iv);
-        const encrypted = Buffer.concat([
-          cipher.update(plaintext, "utf8"),
-          cipher.final()
-        ]);
+        const cipher = cryptoNode__namespace.createCipheriv(GCM_ALGORITHM, aesKey, iv);
+        const plaintextBuf = Buffer.from(plaintext, "utf8");
+        const encrypted = Buffer.concat([cipher.update(plaintextBuf), cipher.final()]);
         const authTag = cipher.getAuthTag();
+        plaintextBuf.fill(0);
         const combined = Buffer.concat([iv, authTag, encrypted]);
-        return AES_GCM_PREFIX + combined.toString("base64");
+        return `${AES_V2_PREFIX}${this._activeKeyId}:${combined.toString("base64")}`;
       }
+      /** Decrypt ciphertext. Supports all historical envelope formats. */
       decrypt(ciphertext) {
-        if (!this._aesKey) {
-          throw new Error("CryptoEngine not initialised. AES key missing.");
+        if (this._keyring.size === 0) {
+          throw new Error("CryptoEngine not initialised.");
         }
         try {
+          if (ciphertext.startsWith(AES_V2_PREFIX)) {
+            const rest = ciphertext.slice(AES_V2_PREFIX.length);
+            const sep3 = rest.indexOf(":");
+            if (sep3 === -1) throw new Error("Malformed aes:v2 envelope: missing key ID separator.");
+            const keyId = rest.slice(0, sep3);
+            const b64 = rest.slice(sep3 + 1);
+            return this._decryptAesGcm(keyId, b64);
+          }
           if (ciphertext.startsWith(AES_GCM_PREFIX)) {
-            return this._decryptAesGcm(ciphertext.slice(AES_GCM_PREFIX.length));
+            return this._decryptAesGcm("default", ciphertext.slice(AES_GCM_PREFIX.length));
+          }
+          if (ciphertext.startsWith(AES_GCM_LEGACY_PREFIX)) {
+            return this._decryptAesGcm("default", ciphertext.slice(AES_GCM_LEGACY_PREFIX.length));
           }
           return this._decryptLegacyFernet(ciphertext);
         } catch (e6) {
-          console.error("Failed to decrypt vault payload. Check your MASK_ENCRYPTION_KEY. Inner error:", e6);
+          console.error("Failed to decrypt vault payload. Check your MASK_ENCRYPTION_KEY / MASK_KEYRING. Inner error:", e6);
           throw new exports.MaskDecryptionError("Decryption failed");
         }
       }
-      /** Decrypt an AES-256-GCM token (base64 encoded). */
-      _decryptAesGcm(b64) {
+      _decryptAesGcm(keyId, b64) {
+        const aesKey = this._keyring.get(keyId);
+        if (!aesKey) {
+          throw new exports.MaskDecryptionError(
+            `No key found for key ID '${keyId}'. Ensure the key is present in MASK_KEYRING.`
+          );
+        }
         const combined = Buffer.from(b64, "base64");
         if (combined.length < GCM_IV_BYTES + GCM_AUTH_TAG_BYTES) {
           throw new Error("Ciphertext too short for AES-GCM");
@@ -3483,22 +3577,11 @@ var init_crypto = __esm({
         const iv = combined.subarray(0, GCM_IV_BYTES);
         const authTag = combined.subarray(GCM_IV_BYTES, GCM_IV_BYTES + GCM_AUTH_TAG_BYTES);
         const encrypted = combined.subarray(GCM_IV_BYTES + GCM_AUTH_TAG_BYTES);
-        const decipher = cryptoNode__namespace.createDecipheriv(GCM_ALGORITHM, this._aesKey, iv);
+        const decipher = cryptoNode__namespace.createDecipheriv(GCM_ALGORITHM, aesKey, iv);
         decipher.setAuthTag(authTag);
-        const decrypted = Buffer.concat([
-          decipher.update(encrypted),
-          decipher.final()
-        ]);
+        const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
         return decrypted.toString("utf8");
       }
-      /**
-       * Attempt to decrypt a legacy Fernet-format token.
-       *
-       * Fernet format: Version (1) || Timestamp (8) || IV (16) || Ciphertext (var) || HMAC (32)
-       * All base64url-encoded.
-       *
-       * We try to use the `fernet` npm package if available, otherwise throw.
-       */
       _decryptLegacyFernet(ciphertext) {
         let fernet;
         try {
@@ -3559,16 +3642,15 @@ function getLogger(name) {
     error: (...args) => _log("error", ...args)
   };
 }
-function _makeEvent(action, token, dataType, agent = "", tool = "", extra = null) {
+function _makeEvent(action, token, dataType, agent = "", tool = "", extra = null, instanceId = "") {
   const event = {
     ts: Date.now() / 1e3,
     action,
-    // "encode" | "decode" | "expired" | "error"
     token,
     data_type: dataType,
-    // "email" | "phone" | "ssn" | "opaque"
     agent,
-    tool
+    tool,
+    instance_id: instanceId
   };
   if (extra) {
     Object.assign(event, _deepMask(extra));
@@ -3578,7 +3660,7 @@ function _makeEvent(action, token, dataType, agent = "", tool = "", extra = null
 function _deepMask(obj) {
   if (obj === null || obj === void 0) return obj;
   if (typeof obj === "string") {
-    return looksLikeToken(obj) ? obj : "[REDACTED]";
+    return isUnambiguouslySafeToken(obj) ? obj : "[REDACTED]";
   }
   if (typeof obj !== "object") return obj;
   if (Array.isArray(obj)) {
@@ -3614,7 +3696,8 @@ var init_audit_logger = __esm({
         this._strictMode = config.MASK_AUDIT_LOG_STRICT;
         const rawKey = process.env.MASK_MASTER_KEY || process.env.MASK_ENCRYPTION_KEY || "";
         this._signingKey = cryptoNode__namespace.createHash("sha256").update(rawKey).digest();
-        this._prevSig = "0".repeat(64);
+        this._instanceId = cryptoNode__namespace.randomUUID();
+        this._prevSig = cryptoNode__namespace.createHmac("sha256", this._signingKey).update(this._instanceId, "utf-8").digest("hex");
       }
       static getInstance() {
         if (this._instance === null) {
@@ -3622,16 +3705,46 @@ var init_audit_logger = __esm({
         }
         return this._instance;
       }
+      _getOverflowPath() {
+        const d6 = process.env.MASK_SECURE_AUDIT_LOG_DIR || __require("os").tmpdir();
+        return path2__namespace.join(d6, `mask_audit_overflow_${this._instanceId}.ndjson`);
+      }
+      _writeOverflow(event) {
+        try {
+          fs__namespace.appendFileSync(this._getOverflowPath(), JSON.stringify(event) + "\n", "utf-8");
+        } catch {
+        }
+      }
+      _consumeOverflow(events) {
+        const overflowPath = this._getOverflowPath();
+        if (!fs__namespace.existsSync(overflowPath)) return;
+        const processingPath = overflowPath + ".processing";
+        try {
+          fs__namespace.renameSync(overflowPath, processingPath);
+        } catch {
+          return;
+        }
+        try {
+          const content = fs__namespace.readFileSync(processingPath, "utf-8");
+          for (const line of content.split("\n")) {
+            if (line.trim()) events.push(JSON.parse(line));
+          }
+          fs__namespace.unlinkSync(processingPath);
+        } catch (e6) {
+          _logger.error(`Failed to consume overflow: ${e6}`);
+        }
+      }
       log(action, token, dataType = "opaque", agent = "", tool = "", extra = {}) {
-        const event = _makeEvent(action, token, dataType, agent, tool, extra);
+        const event = _makeEvent(action, token, dataType, agent, tool, extra, this._instanceId);
         if (this._buffer.length >= this._maxBufferSize) {
           if (!this._bufferFullWarned) {
             _logger.warn(
-              `AuditLogger buffer full (max=${this._maxBufferSize}). Performing emergency sync-flush to prevent data loss.`
+              `AuditLogger buffer full (max=${this._maxBufferSize}). Spooling to disk overflow to prevent OOM.`
             );
             this._bufferFullWarned = true;
           }
-          this._flushSync();
+          this._writeOverflow(event);
+          return;
         }
         this._buffer.push(event);
       }
@@ -3661,18 +3774,20 @@ var init_audit_logger = __esm({
         await this._flush();
       }
       async _flush() {
-        if (this._isFlushing || this._buffer.length === 0) return;
+        if (this._isFlushing) return;
         this._isFlushing = true;
         try {
           const events = [...this._buffer];
           this._buffer = [];
           this._bufferFullWarned = false;
+          this._consumeOverflow(events);
+          if (events.length === 0) return;
           const secureLogDir = process.env.MASK_SECURE_AUDIT_LOG_DIR || "";
           let secureStream = null;
           if (secureLogDir) {
             fs__namespace.mkdirSync(secureLogDir, { recursive: true });
             const dateStr = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-            const filePath = path__namespace.join(secureLogDir, `mask-audit-${dateStr}.ndjson`);
+            const filePath = path2__namespace.join(secureLogDir, `mask-audit-${dateStr}.ndjson`);
             try {
               secureStream = fs__namespace.createWriteStream(filePath, { flags: "a" });
             } catch {
@@ -3700,13 +3815,43 @@ var init_audit_logger = __esm({
           this._isFlushing = false;
         }
       }
-      /** Synchronous flush for use in signal handlers where async is unreliable. */
+      /** Synchronous flush for use in signal handlers where async is unreliable.
+       *
+       * Computes HMAC signatures to maintain chain integrity and writes to the
+       * secure ndjson audit file (MASK_SECURE_AUDIT_LOG_DIR) if configured,
+       * ensuring SOC 2 tamper-evidence guarantees hold through process shutdown.
+       */
       _flushSync() {
         if (this._buffer.length === 0) return;
         const events = [...this._buffer];
         this._buffer = [];
+        const secureLogDir = process.env.MASK_SECURE_AUDIT_LOG_DIR || "";
+        let secureFilePath = null;
+        if (secureLogDir) {
+          try {
+            fs__namespace.mkdirSync(secureLogDir, { recursive: true });
+            const dateStr = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+            secureFilePath = path2__namespace.join(secureLogDir, `mask-audit-${dateStr}.ndjson`);
+          } catch {
+          }
+        }
         for (const evt of events) {
-          process.stdout.write(JSON.stringify(evt) + "\n");
+          const body = JSON.stringify(evt, (_, v7) => typeof v7 === "bigint" ? v7.toString() : v7);
+          const sigInput = Buffer.from(this._prevSig + body, "utf-8");
+          const sig = cryptoNode__namespace.createHmac("sha256", this._signingKey).update(sigInput).digest("hex");
+          const signedLine = JSON.stringify({
+            ...evt,
+            prev_sig: this._prevSig,
+            sig
+          }, (_, v7) => typeof v7 === "bigint" ? v7.toString() : v7);
+          this._prevSig = sig;
+          process.stdout.write(signedLine + "\n");
+          if (secureFilePath) {
+            try {
+              fs__namespace.appendFileSync(secureFilePath, signedLine + "\n", { encoding: "utf-8" });
+            } catch {
+            }
+          }
         }
       }
     };
@@ -18299,10 +18444,10 @@ var init_date_utils = __esm({
     };
   }
 });
-var randomUUID;
+var randomUUID2;
 var init_randomUUID = __esm({
   "node_modules/@smithy/uuid/dist-es/randomUUID.js"() {
-    randomUUID = cryptoNode__namespace.default.randomUUID.bind(cryptoNode__namespace.default);
+    randomUUID2 = cryptoNode__namespace.default.randomUUID.bind(cryptoNode__namespace.default);
   }
 });
 
@@ -18313,8 +18458,8 @@ var init_v4 = __esm({
     init_randomUUID();
     decimalToHex = Array.from({ length: 256 }, (_, i6) => i6.toString(16).padStart(2, "0"));
     v4 = () => {
-      if (randomUUID) {
-        return randomUUID();
+      if (randomUUID2) {
+        return randomUUID2();
       }
       const rnds = new Uint8Array(16);
       crypto.getRandomValues(rnds);
@@ -27993,7 +28138,7 @@ var init_getHomeDir = __esm({
       return "DEFAULT";
     };
     getHomeDir = () => {
-      const { HOME, USERPROFILE, HOMEPATH, HOMEDRIVE = `C:${path.sep}` } = process.env;
+      const { HOME, USERPROFILE, HOMEPATH, HOMEDRIVE = `C:${path2.sep}` } = process.env;
       if (HOME)
         return HOME;
       if (USERPROFILE)
@@ -28024,7 +28169,7 @@ var init_getSSOTokenFilepath = __esm({
     getSSOTokenFilepath = (id) => {
       const hasher = cryptoNode.createHash("sha1");
       const cacheName = hasher.update(id).digest("hex");
-      return path.join(getHomeDir(), ".aws", "sso", "cache", `${cacheName}.json`);
+      return path2.join(getHomeDir(), ".aws", "sso", "cache", `${cacheName}.json`);
     };
   }
 });
@@ -28079,7 +28224,7 @@ var init_getConfigFilepath = __esm({
   "node_modules/@smithy/shared-ini-file-loader/dist-es/getConfigFilepath.js"() {
     init_getHomeDir();
     ENV_CONFIG_PATH = "AWS_CONFIG_FILE";
-    getConfigFilepath = () => process.env[ENV_CONFIG_PATH] || path.join(getHomeDir(), ".aws", "config");
+    getConfigFilepath = () => process.env[ENV_CONFIG_PATH] || path2.join(getHomeDir(), ".aws", "config");
   }
 });
 var ENV_CREDENTIALS_PATH, getCredentialsFilepath;
@@ -28087,7 +28232,7 @@ var init_getCredentialsFilepath = __esm({
   "node_modules/@smithy/shared-ini-file-loader/dist-es/getCredentialsFilepath.js"() {
     init_getHomeDir();
     ENV_CREDENTIALS_PATH = "AWS_SHARED_CREDENTIALS_FILE";
-    getCredentialsFilepath = () => process.env[ENV_CREDENTIALS_PATH] || path.join(getHomeDir(), ".aws", "credentials");
+    getCredentialsFilepath = () => process.env[ENV_CREDENTIALS_PATH] || path2.join(getHomeDir(), ".aws", "credentials");
   }
 });
 
@@ -28179,11 +28324,11 @@ var init_loadSharedConfigFiles = __esm({
       const relativeHomeDirPrefix = "~/";
       let resolvedFilepath = filepath;
       if (filepath.startsWith(relativeHomeDirPrefix)) {
-        resolvedFilepath = path.join(homeDir, filepath.slice(2));
+        resolvedFilepath = path2.join(homeDir, filepath.slice(2));
       }
       let resolvedConfigFilepath = configFilepath;
       if (configFilepath.startsWith(relativeHomeDirPrefix)) {
-        resolvedConfigFilepath = path.join(homeDir, configFilepath.slice(2));
+        resolvedConfigFilepath = path2.join(homeDir, configFilepath.slice(2));
       }
       const parsedFiles = await Promise.all([
         readFile2(resolvedConfigFilepath, {
@@ -34448,10 +34593,10 @@ var init_getNodeModulesParentDirs = __esm({
       if (!dirname2) {
         return [cwd];
       }
-      const normalizedPath = path.normalize(dirname2);
-      const parts = normalizedPath.split(path.sep);
+      const normalizedPath = path2.normalize(dirname2);
+      const parts = normalizedPath.split(path2.sep);
       const nodeModulesIndex = parts.indexOf("node_modules");
-      const parentDir = nodeModulesIndex !== -1 ? parts.slice(0, nodeModulesIndex).join(path.sep) : normalizedPath;
+      const parentDir = nodeModulesIndex !== -1 ? parts.slice(0, nodeModulesIndex).join(path2.sep) : normalizedPath;
       if (cwd === parentDir) {
         return [cwd];
       }
@@ -34503,7 +34648,7 @@ var init_getTypeScriptUserAgentPair = __esm({
     init_getNodeModulesParentDirs();
     init_getSanitizedDevTypeScriptVersion();
     init_getSanitizedTypeScriptVersion();
-    TS_PACKAGE_JSON = path.join("node_modules", "typescript", "package.json");
+    TS_PACKAGE_JSON = path2.join("node_modules", "typescript", "package.json");
     getTypeScriptUserAgentPair = async () => {
       if (tscVersion === null) {
         return void 0;
@@ -34524,7 +34669,7 @@ var init_getTypeScriptUserAgentPair = __esm({
       let versionFromApp;
       for (const nodeModulesParentDir of nodeModulesParentDirs) {
         try {
-          const appPackageJsonPath = path.join(nodeModulesParentDir, "package.json");
+          const appPackageJsonPath = path2.join(nodeModulesParentDir, "package.json");
           const packageJson = await fs2.readFile(appPackageJsonPath, "utf-8");
           const { dependencies, devDependencies } = JSON.parse(packageJson);
           const version = devDependencies?.typescript ?? dependencies?.typescript;
@@ -34543,7 +34688,7 @@ var init_getTypeScriptUserAgentPair = __esm({
       let versionFromNodeModules;
       for (const nodeModulesParentDir of nodeModulesParentDirs) {
         try {
-          const tsPackageJsonPath = path.join(nodeModulesParentDir, TS_PACKAGE_JSON);
+          const tsPackageJsonPath = path2.join(nodeModulesParentDir, TS_PACKAGE_JSON);
           const packageJson = await fs2.readFile(tsPackageJsonPath, "utf-8");
           const { version } = JSON.parse(packageJson);
           const sanitizedVersion2 = getSanitizedTypeScriptVersion(version);
@@ -38912,7 +39057,7 @@ var init_LoginCredentialsFetcher = __esm({
       }
       async saveToken(token) {
         const tokenFilePath = this.getTokenFilePath();
-        const directory = path.dirname(tokenFilePath);
+        const directory = path2.dirname(tokenFilePath);
         try {
           await fs.promises.mkdir(directory, { recursive: true });
         } catch (error) {
@@ -38920,10 +39065,10 @@ var init_LoginCredentialsFetcher = __esm({
         await fs.promises.writeFile(tokenFilePath, JSON.stringify(token, null, 2), "utf8");
       }
       getTokenFilePath() {
-        const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? path.join(os.homedir(), ".aws", "login", "cache");
+        const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? path2.join(os.homedir(), ".aws", "login", "cache");
         const loginSessionBytes = Buffer.from(this.loginSession, "utf8");
         const loginSessionSha256 = cryptoNode.createHash("sha256").update(loginSessionBytes).digest("hex");
-        return path.join(directory, `${loginSessionSha256}.json`);
+        return path2.join(directory, `${loginSessionSha256}.json`);
       }
       derToRawSignature(derSignature) {
         let offset = 2;
@@ -43542,6 +43687,25 @@ function _hashPlaintext(plaintext, secret) {
   }
   return cryptoNode__namespace.createHash("sha256").update(trimmed, "utf-8").digest("hex");
 }
+function _vaultKey(token) {
+  return `mask:${config.MASK_TENANT_ID}:${token}`;
+}
+function _vaultRevKey(ptHash) {
+  return `mask-rev:${config.MASK_TENANT_ID}:${ptHash}`;
+}
+function _vaultHashKey(token) {
+  return `mask-hash:${config.MASK_TENANT_ID}:${token}`;
+}
+function _unwrapPayload(raw) {
+  if (raw && raw.startsWith("{")) {
+    try {
+      const obj = JSON.parse(raw);
+      if (obj.ct) return obj.ct;
+    } catch {
+    }
+  }
+  return raw;
+}
 function getVault() {
   if (_vaultInstance === null) {
     const vaultType = config.MASK_VAULT_TYPE;
@@ -43666,14 +43830,15 @@ var init_vault = __esm({
     MemoryVault = class extends BaseVault {
       constructor() {
         super();
+        this._cleanupTimer = null;
         this._store = /* @__PURE__ */ new Map();
         this._reverseStore = /* @__PURE__ */ new Map();
+        this._cleanupTimer = setInterval(() => this._cleanup(), 6e4);
+        if (this._cleanupTimer && typeof this._cleanupTimer.unref === "function") {
+          this._cleanupTimer.unref();
+        }
       }
       _cleanup() {
-        const cleanupFreq = config.MASK_VAULT_CLEANUP_FREQUENCY;
-        if (Math.random() > cleanupFreq) {
-          return;
-        }
         const now = Date.now() / 1e3;
         for (const [token, entry] of this._store.entries()) {
           if (now > entry.expiry) {
@@ -43685,8 +43850,18 @@ var init_vault = __esm({
         }
       }
       async store(token, ciphertext, ttlSeconds, ptHash = null, metadata = null) {
-        this._cleanup();
+        if (!this._store.has(token) && this._store.size >= config.MASK_VAULT_MAX_MEMORY_KEYS) {
+          const firstKey = this._store.keys().next().value;
+          if (firstKey !== void 0) {
+            const oldEntry = this._store.get(firstKey);
+            this._store.delete(firstKey);
+            if (oldEntry?.ptHash && this._reverseStore.get(oldEntry.ptHash) === firstKey) {
+              this._reverseStore.delete(oldEntry.ptHash);
+            }
+          }
+        }
         const existing = this._store.get(token);
+        if (existing) this._store.delete(token);
         this._store.set(token, {
           plaintext: ciphertext,
           expiry: Date.now() / 1e3 + ttlSeconds,
@@ -43698,7 +43873,6 @@ var init_vault = __esm({
         }
       }
       async getTokenByPlaintextHash(ptHash) {
-        this._cleanup();
         const token = this._reverseStore.get(ptHash);
         if (token && this._store.has(token)) {
           return token;
@@ -43710,7 +43884,6 @@ var init_vault = __esm({
         return entry?.ptHash ?? null;
       }
       async retrieve(token) {
-        this._cleanup();
         const entry = this._store.get(token);
         if (!entry) {
           return null;
@@ -43770,10 +43943,10 @@ var init_vault = __esm({
         try {
           const pipeline = this._client.pipeline();
           const payload = metadata ? JSON.stringify({ ct: ciphertext, meta: metadata }) : ciphertext;
-          pipeline.set(`mask:${token}`, payload, "EX", ttlSeconds);
+          pipeline.set(_vaultKey(token), payload, "EX", ttlSeconds);
           if (ptHash) {
-            pipeline.set(`mask-rev:${ptHash}`, token, "EX", ttlSeconds);
-            pipeline.set(`mask-hash:${token}`, ptHash, "EX", ttlSeconds);
+            pipeline.set(_vaultRevKey(ptHash), token, "EX", ttlSeconds);
+            pipeline.set(_vaultHashKey(token), ptHash, "EX", ttlSeconds);
           }
           const results = await pipeline.exec();
           if (results) {
@@ -43787,19 +43960,19 @@ var init_vault = __esm({
       }
       async getPtHashForToken(token) {
         try {
-          return await this._client.get(`mask-hash:${token}`);
+          return await this._client.get(_vaultHashKey(token));
         } catch {
           return null;
         }
       }
       async getTokenByPlaintextHash(ptHash) {
         try {
-          const token = await this._client.get(`mask-rev:${ptHash}`);
+          const token = await this._client.get(_vaultRevKey(ptHash));
           if (token) {
-            if (await this._client.exists(`mask:${token}`)) {
+            if (await this._client.exists(_vaultKey(token))) {
               return token;
             } else {
-              await this._client.del(`mask-rev:${ptHash}`);
+              await this._client.del(_vaultRevKey(ptHash));
             }
           }
           return null;
@@ -43812,7 +43985,8 @@ var init_vault = __esm({
       }
       async retrieve(token) {
         try {
-          return await this._client.get(`mask:${token}`);
+          const raw = await this._client.get(_vaultKey(token));
+          return raw ? _unwrapPayload(raw) : null;
         } catch (e6) {
           if (_getFailStrategy() === "closed") {
             throw new exports.MaskVaultConnectionError(`Redis read failed: ${e6}`);
@@ -43822,12 +43996,12 @@ var init_vault = __esm({
       }
       async delete(token) {
         try {
-          const ptHash = await this._client.get(`mask-hash:${token}`);
+          const ptHash = await this._client.get(_vaultHashKey(token));
           const pipeline = this._client.pipeline();
-          pipeline.del(`mask:${token}`);
-          pipeline.del(`mask-hash:${token}`);
+          pipeline.del(_vaultKey(token));
+          pipeline.del(_vaultHashKey(token));
           if (ptHash) {
-            pipeline.del(`mask-rev:${ptHash}`);
+            pipeline.del(_vaultRevKey(ptHash));
           }
           await pipeline.exec();
         } catch (e6) {
@@ -43866,39 +44040,26 @@ var init_vault = __esm({
         this._client = DynamoDBDocument.from(baseClient);
         console.info(`DynamoDBVault connected to table ${this._tableName} in ${this._region}`);
       }
-      async store(token, ciphertext, ttlSeconds, ptHash = null) {
+      async store(token, ciphertext, ttlSeconds, ptHash = null, metadata = null) {
         const { TransactWriteCommand, PutCommand } = __require("@aws-sdk/lib-dynamodb");
         const now = Math.floor(Date.now() / 1e3);
         const ttlVal = now + ttlSeconds;
-        const item = {
-          token: `mask:${token}`,
+        const primaryItem = {
+          token: _vaultKey(token),
           ciphertext,
-          ttl: ttlVal,
-          ptr_hash: ptHash || void 0
+          ttl: ttlVal
         };
+        if (ptHash) primaryItem.ptr_hash = ptHash;
+        if (metadata) primaryItem.meta_json = JSON.stringify(metadata);
         if (ptHash) {
           try {
             await this._client.send(new TransactWriteCommand({
               TransactItems: [
+                { Put: { TableName: this._tableName, Item: primaryItem } },
                 {
                   Put: {
                     TableName: this._tableName,
-                    Item: {
-                      token: `mask:${token}`,
-                      ciphertext,
-                      ttl: ttlVal,
-                      ptr_hash: ptHash
-                    }
-                  }
-                },
-                {
-                  Put: {
-                    TableName: this._tableName,
-                    Item: {
-                      token: `mask-rev:${ptHash}`,
-                      ciphertext: token,
-                      ttl: ttlVal
-                    }
+                    Item: { token: _vaultRevKey(ptHash), ciphertext: token, ttl: ttlVal }
                   }
                 }
               ]
@@ -43909,7 +44070,7 @@ var init_vault = __esm({
           }
         } else {
           try {
-            await this._client.send(new PutCommand({ TableName: this._tableName, Item: item }));
+            await this._client.send(new PutCommand({ TableName: this._tableName, Item: primaryItem }));
           } catch (e6) {
             throw new exports.MaskVaultConnectionError(`DynamoDB individual write failed: ${e6}`);
           }
@@ -43921,12 +44082,12 @@ var init_vault = __esm({
           const now = Math.floor(Date.now() / 1e3);
           const resp = await this._client.send(new GetCommand({
             TableName: this._tableName,
-            Key: { token: `mask-rev:${ptHash}` }
+            Key: { token: _vaultRevKey(ptHash) }
           }));
           const item = resp.Item;
           if (!item) return null;
           if (now > (item.ttl || 0)) {
-            await this._client.send(new DeleteCommand({ TableName: this._tableName, Key: { token: `mask-rev:${ptHash}` } }));
+            await this._client.send(new DeleteCommand({ TableName: this._tableName, Key: { token: _vaultRevKey(ptHash) } }));
             return null;
           }
           const token = item.ciphertext;
@@ -43942,16 +44103,16 @@ var init_vault = __esm({
           const now = Math.floor(Date.now() / 1e3);
           const resp = await this._client.send(new GetCommand({
             TableName: this._tableName,
-            Key: { token: `mask:${token}` }
+            Key: { token: _vaultKey(token) }
           }));
           const item = resp.Item;
           if (!item) return null;
           if (now > (item.ttl || 0)) {
             const ptHash = item.ptr_hash;
             if (ptHash) {
-              await this._client.send(new DeleteCommand({ TableName: this._tableName, Key: { token: `mask-rev:${ptHash}` } }));
+              await this._client.send(new DeleteCommand({ TableName: this._tableName, Key: { token: _vaultRevKey(ptHash) } }));
             }
-            await this._client.send(new DeleteCommand({ TableName: this._tableName, Key: { token: `mask:${token}` } }));
+            await this._client.send(new DeleteCommand({ TableName: this._tableName, Key: { token: _vaultKey(token) } }));
             return null;
           }
           return item.ciphertext;
@@ -43965,7 +44126,7 @@ var init_vault = __esm({
           const { GetCommand } = __require("@aws-sdk/lib-dynamodb");
           const resp = await this._client.send(new GetCommand({
             TableName: this._tableName,
-            Key: { token: `mask:${token}` }
+            Key: { token: _vaultKey(token) }
           }));
           return resp.Item?.ptr_hash ?? null;
         } catch {
@@ -43977,13 +44138,13 @@ var init_vault = __esm({
           const { GetCommand, DeleteCommand } = __require("@aws-sdk/lib-dynamodb");
           const resp = await this._client.send(new GetCommand({
             TableName: this._tableName,
-            Key: { token: `mask:${token}` }
+            Key: { token: _vaultKey(token) }
           }));
           const item = resp.Item;
           if (item && item.ptr_hash) {
-            await this._client.send(new DeleteCommand({ TableName: this._tableName, Key: { token: `mask-rev:${item.ptr_hash}` } }));
+            await this._client.send(new DeleteCommand({ TableName: this._tableName, Key: { token: _vaultRevKey(item.ptr_hash) } }));
           }
-          await this._client.send(new DeleteCommand({ TableName: this._tableName, Key: { token: `mask:${token}` } }));
+          await this._client.send(new DeleteCommand({ TableName: this._tableName, Key: { token: _vaultKey(token) } }));
         } catch (e6) {
           if (_getFailStrategy() === "closed") throw new exports.MaskVaultConnectionError(`DynamoDB delete failed: ${e6}`);
         }
@@ -44005,10 +44166,10 @@ var init_vault = __esm({
       async store(token, ciphertext, ttlSeconds, ptHash = null, metadata = null) {
         try {
           const payload = metadata ? JSON.stringify({ ct: ciphertext, meta: metadata }) : ciphertext;
-          await this._client.set(`mask:${token}`, Buffer.from(payload), { expires: ttlSeconds });
+          await this._client.set(_vaultKey(token), Buffer.from(payload), { expires: ttlSeconds });
           if (ptHash) {
-            await this._client.set(`mask-rev:${ptHash}`, Buffer.from(token), { expires: ttlSeconds });
-            await this._client.set(`mask-hash:${token}`, Buffer.from(ptHash), { expires: ttlSeconds });
+            await this._client.set(_vaultRevKey(ptHash), Buffer.from(token), { expires: ttlSeconds });
+            await this._client.set(_vaultHashKey(token), Buffer.from(ptHash), { expires: ttlSeconds });
           }
         } catch (e6) {
           throw new exports.MaskVaultConnectionError(`Memcached error: ${e6}`);
@@ -44016,7 +44177,7 @@ var init_vault = __esm({
       }
       async getPtHashForToken(token) {
         try {
-          const { value } = await this._client.get(`mask-hash:${token}`);
+          const { value } = await this._client.get(_vaultHashKey(token));
           return value ? value.toString() : null;
         } catch {
           return null;
@@ -44024,7 +44185,7 @@ var init_vault = __esm({
       }
       async getTokenByPlaintextHash(ptHash) {
         try {
-          const { value } = await this._client.get(`mask-rev:${ptHash}`);
+          const { value } = await this._client.get(_vaultRevKey(ptHash));
           if (!value) return null;
           const token = value.toString();
           return await this.retrieve(token) !== null ? token : null;
@@ -44035,8 +44196,9 @@ var init_vault = __esm({
       }
       async retrieve(token) {
         try {
-          const { value } = await this._client.get(`mask:${token}`);
-          return value ? value.toString() : null;
+          const { value } = await this._client.get(_vaultKey(token));
+          if (!value) return null;
+          return _unwrapPayload(value.toString());
         } catch (e6) {
           if (_getFailStrategy() === "closed") throw new exports.MaskVaultConnectionError(`Memcached read failed: ${e6}`);
           return null;
@@ -44044,12 +44206,12 @@ var init_vault = __esm({
       }
       async delete(token) {
         try {
-          const { value } = await this._client.get(`mask-hash:${token}`);
+          const { value } = await this._client.get(_vaultHashKey(token));
           const ptHash = value ? value.toString() : null;
-          await this._client.delete(`mask:${token}`);
-          await this._client.delete(`mask-hash:${token}`);
+          await this._client.delete(_vaultKey(token));
+          await this._client.delete(_vaultHashKey(token));
           if (ptHash) {
-            await this._client.delete(`mask-rev:${ptHash}`);
+            await this._client.delete(_vaultRevKey(ptHash));
           }
         } catch (e6) {
           if (_getFailStrategy() === "closed") throw new exports.MaskVaultConnectionError(`Memcached delete failed: ${e6}`);
@@ -59534,7 +59696,7 @@ var init_transformers_scanner = __esm({
           );
         }
         if (!this._pool) {
-          const workerPath = path__namespace.resolve(__dirname, "nlp_worker.js");
+          const workerPath = path2__namespace.resolve(__dirname, "nlp_worker.js");
           const maxThreads = Math.max(1, Math.min(os__namespace.cpus().length - 1, 4));
           this._pool = new Piscina({
             filename: workerPath,