promptkaizen-agent 0.1.0 → 0.2.0

package/dist/detection-secret.d.ts

@@ -0,0 +1,8 @@
+/**
+ * HMAC 鍵を解決する。優先順:
+ * 1. agent 設定 `detection.hmacSecret`
+ * 2. 既存の鍵ファイル (~/.promptkaizen/detection-secret)
+ * 3. 初回起動時に生成して同ファイルへ保存 (mode 600)
+ */
+export declare function loadOrCreateDetectionSecret(configSecret?: string, secretPath?: string): Promise<string>;
+//# sourceMappingURL=detection-secret.d.ts.map

package/dist/detection-secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detection-secret.d.ts","sourceRoot":"","sources":["../src/detection-secret.ts"],"names":[],"mappings":"AAWA;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,YAAY,CAAC,EAAE,MAAM,EACrB,UAAU,GAAE,MAA4B,GACvC,OAAO,CAAC,MAAM,CAAC,CAYjB"}

package/dist/detection-secret.js

@@ -0,0 +1,37 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadOrCreateDetectionSecret = loadOrCreateDetectionSecret;
+const crypto_1 = require("crypto");
+const promises_1 = __importDefault(require("fs/promises"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+// pii/pii_jp の matchHash (HMAC-SHA256) に使うローカルシークレット (Issue #42)。
+// マイナンバー等の低エントロピー値を無塩ハッシュで送ると総当たりで復元できてしまう
+// ため、鍵付きハッシュにする。鍵はローカルにのみ保持し、クラウドへは送らない。
+const DEFAULT_SECRET_PATH = path_1.default.join(os_1.default.homedir(), '.promptkaizen', 'detection-secret');
+/**
+ * HMAC 鍵を解決する。優先順:
+ * 1. agent 設定 `detection.hmacSecret`
+ * 2. 既存の鍵ファイル (~/.promptkaizen/detection-secret)
+ * 3. 初回起動時に生成して同ファイルへ保存 (mode 600)
+ */
+async function loadOrCreateDetectionSecret(configSecret, secretPath = DEFAULT_SECRET_PATH) {
+    if (configSecret)
+        return configSecret;
+    try {
+        const existing = (await promises_1.default.readFile(secretPath, 'utf8')).trim();
+        if (existing.length >= 32)
+            return existing;
+    }
+    catch {
+        // ファイルなし (初回起動) → 下で生成する
+    }
+    const secret = (0, crypto_1.randomBytes)(32).toString('hex');
+    await promises_1.default.mkdir(path_1.default.dirname(secretPath), { recursive: true });
+    await promises_1.default.writeFile(secretPath, secret + '\n', { mode: 0o600 });
+    return secret;
+}
+//# sourceMappingURL=detection-secret.js.map

package/dist/detection-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detection-secret.js","sourceRoot":"","sources":["../src/detection-secret.ts"],"names":[],"mappings":";;;;;AAiBA,kEAeC;AAhCD,mCAAoC;AACpC,2DAA4B;AAC5B,4CAAmB;AACnB,gDAAuB;AAEvB,kEAAkE;AAClE,2CAA2C;AAC3C,yCAAyC;AAEzC,MAAM,mBAAmB,GAAG,cAAI,CAAC,IAAI,CAAC,YAAE,CAAC,OAAO,EAAE,EAAE,eAAe,EAAE,kBAAkB,CAAC,CAAA;AAExF;;;;;GAKG;AACI,KAAK,UAAU,2BAA2B,CAC/C,YAAqB,EACrB,aAAqB,mBAAmB;IAExC,IAAI,YAAY;QAAE,OAAO,YAAY,CAAA;IACrC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,CAAC,MAAM,kBAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC/D,IAAI,QAAQ,CAAC,MAAM,IAAI,EAAE;YAAE,OAAO,QAAQ,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC9C,MAAM,kBAAE,CAAC,KAAK,CAAC,cAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7D,MAAM,kBAAE,CAAC,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9D,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/index.js

@@ -3,9 +3,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const init_1 = require("./cli/init");
 const install_launchd_1 = require("./cli/install-launchd");
+const install_systemd_1 = require("./cli/install-systemd");
 const start_1 = require("./cli/start");
 const status_1 = require("./cli/status");
 const uninstall_launchd_1 = require("./cli/uninstall-launchd");
+const uninstall_systemd_1 = require("./cli/uninstall-systemd");
 const version_1 = require("./version");
 const HELP = `promptkaizen-agent v${version_1.AGENT_VERSION}
 
@@ -18,17 +20,19 @@ Usage:
 
 Subcommands:
   init                 Interactive setup — write ~/.promptkaizen/agent.config.json
-  start                Run the agent in the foreground (used by launchd too)
-  status               Health check: config, plist, process, offsets, endpoint
-  install-launchd      Register a macOS LaunchAgent — auto-start on login + auto-restart
-  uninstall-launchd    Remove the LaunchAgent (config/offsets preserved)
+  start                Run the agent in the foreground (used by launchd/systemd too)
+  status               Health check: config, autostart, process, offsets, endpoint
+  install-launchd      [macOS] Register a LaunchAgent — auto-start on login + auto-restart
+  uninstall-launchd    [macOS] Remove the LaunchAgent (config/offsets preserved)
+  install-systemd      [Linux] Register a systemd user unit — auto-start + auto-restart
+  uninstall-systemd    [Linux] Remove the systemd user unit (config/offsets preserved)
   version              Print agent version
   help                 Print this message
 
 Examples:
   npm link                                   # one-time, from repo root after build
   promptkaizen-agent init
-  promptkaizen-agent install-launchd
+  promptkaizen-agent install-launchd         # macOS (Linux: install-systemd)
   promptkaizen-agent status
 `;
 async function main() {
@@ -44,6 +48,10 @@ async function main() {
             return (0, install_launchd_1.runInstallLaunchd)(rest);
         case 'uninstall-launchd':
             return (0, uninstall_launchd_1.runUninstallLaunchd)(rest);
+        case 'install-systemd':
+            return (0, install_systemd_1.runInstallSystemd)(rest);
+        case 'uninstall-systemd':
+            return (0, uninstall_systemd_1.runUninstallSystemd)(rest);
         case 'version':
         case '--version':
         case '-v':

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AACA,qCAAoC;AACpC,2DAAyD;AACzD,uCAAsC;AACtC,yCAAwC;AACxC,+DAA6D;AAC7D,uCAAyC;AAEzC,MAAM,IAAI,GAAG,uBAAuB,uBAAa;;;;;;;;;;;;;;;;;;;;;;;CAuBhD,CAAA;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC5C,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM;YACT,OAAO,IAAA,cAAO,EAAC,IAAI,CAAC,CAAA;QACtB,KAAK,OAAO;YACV,OAAO,IAAA,gBAAQ,EAAC,IAAI,CAAC,CAAA;QACvB,KAAK,QAAQ;YACX,OAAO,IAAA,kBAAS,EAAC,IAAI,CAAC,CAAA;QACxB,KAAK,iBAAiB;YACpB,OAAO,IAAA,mCAAiB,EAAC,IAAI,CAAC,CAAA;QAChC,KAAK,mBAAmB;YACtB,OAAO,IAAA,uCAAmB,EAAC,IAAI,CAAC,CAAA;QAClC,KAAK,SAAS,CAAC;QACf,KAAK,WAAW,CAAC;QACjB,KAAK,IAAI;YACP,OAAO,CAAC,GAAG,CAAC,uBAAa,CAAC,CAAA;YAC1B,OAAM;QACR,KAAK,SAAS,CAAC;QACf,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACjB,OAAM;QACR;YACE,OAAO,CAAC,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAA;YAC7C,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACnB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE;IAC1B,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;IACtC,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAC9D,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AACA,qCAAoC;AACpC,2DAAyD;AACzD,2DAAyD;AACzD,uCAAsC;AACtC,yCAAwC;AACxC,+DAA6D;AAC7D,+DAA6D;AAC7D,uCAAyC;AAEzC,MAAM,IAAI,GAAG,uBAAuB,uBAAa;;;;;;;;;;;;;;;;;;;;;;;;;CAyBhD,CAAA;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC5C,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM;YACT,OAAO,IAAA,cAAO,EAAC,IAAI,CAAC,CAAA;QACtB,KAAK,OAAO;YACV,OAAO,IAAA,gBAAQ,EAAC,IAAI,CAAC,CAAA;QACvB,KAAK,QAAQ;YACX,OAAO,IAAA,kBAAS,EAAC,IAAI,CAAC,CAAA;QACxB,KAAK,iBAAiB;YACpB,OAAO,IAAA,mCAAiB,EAAC,IAAI,CAAC,CAAA;QAChC,KAAK,mBAAmB;YACtB,OAAO,IAAA,uCAAmB,EAAC,IAAI,CAAC,CAAA;QAClC,KAAK,iBAAiB;YACpB,OAAO,IAAA,mCAAiB,EAAC,IAAI,CAAC,CAAA;QAChC,KAAK,mBAAmB;YACtB,OAAO,IAAA,uCAAmB,EAAC,IAAI,CAAC,CAAA;QAClC,KAAK,SAAS,CAAC;QACf,KAAK,WAAW,CAAC;QACjB,KAAK,IAAI;YACP,OAAO,CAAC,GAAG,CAAC,uBAAa,CAAC,CAAA;YAC1B,OAAM;QACR,KAAK,SAAS,CAAC;QACf,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACjB,OAAM;QACR;YACE,OAAO,CAAC,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAA;YAC7C,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACnB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE;IAC1B,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;IACtC,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAC9D,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}

package/dist/mask-rules-fetcher.d.ts

@@ -0,0 +1,15 @@
+import type { MaskRulesConfig } from './pii-masker';
+/** receiveObservations と同じ apiKey/endpoint pattern で /getAgentMaskRules を導出。 */
+export declare function maskRulesUrl(apiEndpoint: string): string;
+export interface FetchMaskRulesOptions {
+    apiEndpoint: string;
+    apiKey: string;
+    fetchImpl?: typeof fetch;
+}
+/**
+ * 組織/ユーザーのマスクルールを取得する。
+ * - 未設定 (cloud に doc がない) → null (ローカル設定のみで動作)
+ * - 通信エラー / 不正レスポンス → null + warn log (検知・送信は止めない)
+ */
+export declare function fetchMaskRules(opts: FetchMaskRulesOptions): Promise<MaskRulesConfig | null>;
+//# sourceMappingURL=mask-rules-fetcher.d.ts.map

package/dist/mask-rules-fetcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mask-rules-fetcher.d.ts","sourceRoot":"","sources":["../src/mask-rules-fetcher.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAWnD,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAExD;AAsBD,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAuBjG"}

package/dist/mask-rules-fetcher.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.maskRulesUrl = maskRulesUrl;
+exports.fetchMaskRules = fetchMaskRules;
+const zod_1 = require("zod");
+const logger_1 = require("./logger");
+// =============================================
+// 組織マスクルールの取得 (Issue #43)
+// =============================================
+//
+// cloud (functions/src/agent/maskRules.ts getAgentMaskRules) から組織/ユーザーの
+// マスクルールを取得する。認証は receiveObservations / agentHeartbeat と同じ
+// Bearer apiKey。取得できない場合は null を返し、agent はローカル設定のみで
+// 動作する (マスキング適用自体はローカル完結を維持)。
+/** receiveObservations と同じ apiKey/endpoint pattern で /getAgentMaskRules を導出。 */
+function maskRulesUrl(apiEndpoint) {
+    return apiEndpoint.replace(/\/receiveObservations\/?$/, '/getAgentMaskRules');
+}
+// cloud 側 (functions/src/agent/maskRules.ts) の schema と整合させること。
+const MaskRulesSchema = zod_1.z.object({
+    builtin: zod_1.z.object({
+        maskApiKeys: zod_1.z.boolean(),
+        maskFilePaths: zod_1.z.boolean(),
+        maskEmails: zod_1.z.boolean(),
+    }),
+    customRules: zod_1.z
+        .array(zod_1.z.object({
+        ruleId: zod_1.z.string().regex(/^[A-Za-z0-9_-]{1,50}$/),
+        pattern: zod_1.z.string().min(1).max(500),
+        replacement: zod_1.z.string().max(100),
+        enabled: zod_1.z.boolean(),
+    }))
+        .max(100),
+    updatedAt: zod_1.z.number().optional(),
+});
+/**
+ * 組織/ユーザーのマスクルールを取得する。
+ * - 未設定 (cloud に doc がない) → null (ローカル設定のみで動作)
+ * - 通信エラー / 不正レスポンス → null + warn log (検知・送信は止めない)
+ */
+async function fetchMaskRules(opts) {
+    const doFetch = opts.fetchImpl ?? fetch;
+    try {
+        const res = await doFetch(maskRulesUrl(opts.apiEndpoint), {
+            method: 'GET',
+            headers: { Authorization: `Bearer ${opts.apiKey}` },
+        });
+        if (!res.ok) {
+            logger_1.logger.warn('fetchMaskRules: non-OK response', { status: res.status });
+            return null;
+        }
+        const body = (await res.json());
+        if (!body.success || body.rules == null)
+            return null;
+        const parsed = MaskRulesSchema.safeParse(body.rules);
+        if (!parsed.success) {
+            logger_1.logger.warn('fetchMaskRules: invalid rules payload', { error: parsed.error.message });
+            return null;
+        }
+        return parsed.data;
+    }
+    catch (e) {
+        logger_1.logger.warn('fetchMaskRules failed', { error: e.message });
+        return null;
+    }
+}
+//# sourceMappingURL=mask-rules-fetcher.js.map

package/dist/mask-rules-fetcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mask-rules-fetcher.js","sourceRoot":"","sources":["../src/mask-rules-fetcher.ts"],"names":[],"mappings":";;AAcA,oCAEC;AAiCD,wCAuBC;AAxED,6BAAuB;AACvB,qCAAiC;AAGjC,gDAAgD;AAChD,0BAA0B;AAC1B,gDAAgD;AAChD,EAAE;AACF,wEAAwE;AACxE,2DAA2D;AAC3D,oDAAoD;AACpD,8BAA8B;AAE9B,gFAAgF;AAChF,SAAgB,YAAY,CAAC,WAAmB;IAC9C,OAAO,WAAW,CAAC,OAAO,CAAC,2BAA2B,EAAE,oBAAoB,CAAC,CAAA;AAC/E,CAAC;AAED,gEAAgE;AAChE,MAAM,eAAe,GAAG,OAAC,CAAC,MAAM,CAAC;IAC/B,OAAO,EAAE,OAAC,CAAC,MAAM,CAAC;QAChB,WAAW,EAAE,OAAC,CAAC,OAAO,EAAE;QACxB,aAAa,EAAE,OAAC,CAAC,OAAO,EAAE;QAC1B,UAAU,EAAE,OAAC,CAAC,OAAO,EAAE;KACxB,CAAC;IACF,WAAW,EAAE,OAAC;SACX,KAAK,CACJ,OAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;QACjD,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACnC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;QAChC,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE;KACrB,CAAC,CACH;SACA,GAAG,CAAC,GAAG,CAAC;IACX,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAA;AAQF;;;;GAIG;AACI,KAAK,UAAU,cAAc,CAAC,IAA2B;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE;YACxD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE;SACpD,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,eAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;YACtE,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2C,CAAA;QACzE,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI;YAAE,OAAO,IAAI,CAAA;QACpD,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,eAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;YACrF,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAA;IACpB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,eAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAA;QACrE,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/pii-masker.d.ts

@@ -1,10 +1,55 @@
 import type { AgentConfig } from './config';
 import type { ParsedEntry } from './types';
+/** ファイルパス / 画像など、正規表現グループ外の構造的ルールの ruleId。 */
+export declare const RULE_ID_FILE_PATH = "file_path";
+export declare const RULE_ID_EMAIL = "email";
+export declare const RULE_ID_IMAGE = "image_base64";
+/** 1 entry あたりの MaskStat 上限 (detections の MAX_DETECTIONS_PER_ENTRY と同思想)。 */
+export declare const MAX_MASK_STATS_PER_ENTRY = 50;
+/** ルールごとのマスク実績 (生値は持たない。件数のみ)。 */
+export interface MaskStat {
+    ruleId: string;
+    count: number;
+}
+export interface CustomMaskRule {
+    /** 英数字・ハイフン・アンダースコアのみ (Firestore field path 安全性のため)。 */
+    ruleId: string;
+    /** 正規表現文字列 (global flag は自動付与)。 */
+    pattern: string;
+    /** マスク後の文字列 (literal 置換。$1 等のグループ参照は使えない)。 */
+    replacement: string;
+    enabled: boolean;
+}
+export interface MaskRulesConfig {
+    builtin: {
+        maskApiKeys: boolean;
+        maskFilePaths: boolean;
+        maskEmails: boolean;
+    };
+    customRules: CustomMaskRule[];
+    updatedAt?: number;
+}
+/** 適用時の実効設定。ローカル設定と組織ルール (remote) をマージした結果。 */
+export interface EffectiveMaskConfig {
+    maskApiKeys: boolean;
+    maskFilePaths: boolean;
+    maskEmails: boolean;
+    customRules: CustomMaskRule[];
+}
+/**
+ * ローカル設定 (agent.config.json の pii) と組織ルール (cloud 配信) をマージする。
+ * - builtin トグルは組織ルールがあればそちらを正とする (組織統制を優先)。
+ * - カスタムルールは両方の和集合 (多くマスクする方向は常に安全側)。
+ *   ローカル customPatterns は ruleId を持たないため custom_local_N を自動付与する。
+ */
+export declare function resolveMaskConfig(local: AgentConfig['pii'], remote?: MaskRulesConfig | null): EffectiveMaskConfig;
 export interface PiiMaskerOptions {
     homeDir?: string;
+    /** 組織のマスクルール (cloud 配信)。null/未指定ならローカル設定のみで動作する。 */
+    remoteRules?: MaskRulesConfig | null;
 }
 export declare class PiiMasker {
-    private readonly config;
+    private readonly effective;
     private readonly homeDir;
     private readonly customPatterns;
     constructor(config: AgentConfig['pii'], opts?: PiiMaskerOptions);
@@ -13,6 +58,8 @@ export declare class PiiMasker {
     /** 任意の値を再帰的に処理。string は pattern 置換、object は structural な特別処理あり */
     private maskValue;
     private maskString;
+    /** ファイルパス内のユーザー名を匿名化 */
+    private maskFilePathsInString;
     private isBase64ImageBlock;
     private summarizeImage;
 }

package/dist/pii-masker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pii-masker.d.ts","sourceRoot":"","sources":["../src/pii-masker.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AA4C1C,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAQ;IAChC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAyB;gBAE5C,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,GAAE,gBAAqB;IAUnE,IAAI,CAAC,KAAK,EAAE,WAAW,GAAG,WAAW;IAIrC,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE;IAI9C,kEAAkE;IAClE,OAAO,CAAC,SAAS;IAyBjB,OAAO,CAAC,UAAU;IAmBlB,OAAO,CAAC,kBAAkB;IAQ1B,OAAO,CAAC,cAAc;CAevB"}
+{"version":3,"file":"pii-masker.d.ts","sourceRoot":"","sources":["../src/pii-masker.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAmE1C,8CAA8C;AAC9C,eAAO,MAAM,iBAAiB,cAAc,CAAA;AAC5C,eAAO,MAAM,aAAa,UAAU,CAAA;AACpC,eAAO,MAAM,aAAa,iBAAiB,CAAA;AAE3C,6EAA6E;AAC7E,eAAO,MAAM,wBAAwB,KAAK,CAAA;AAE1C,kCAAkC;AAClC,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;CACd;AAQD,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAA;IACd,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAA;IACf,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE;QACP,WAAW,EAAE,OAAO,CAAA;QACpB,aAAa,EAAE,OAAO,CAAA;QACtB,UAAU,EAAE,OAAO,CAAA;KACpB,CAAA;IACD,WAAW,EAAE,cAAc,EAAE,CAAA;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,+CAA+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,OAAO,CAAA;IACpB,aAAa,EAAE,OAAO,CAAA;IACtB,UAAU,EAAE,OAAO,CAAA;IACnB,WAAW,EAAE,cAAc,EAAE,CAAA;CAC9B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EACzB,MAAM,CAAC,EAAE,eAAe,GAAG,IAAI,GAC9B,mBAAmB,CAqBrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,oDAAoD;IACpD,WAAW,CAAC,EAAE,eAAe,GAAG,IAAI,CAAA;CACrC;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAQ;IAChC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA+D;gBAElF,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,GAAE,gBAAqB;IAenE,IAAI,CAAC,KAAK,EAAE,WAAW,GAAG,WAAW;IAYrC,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE;IAI9C,kEAAkE;IAClE,OAAO,CAAC,SAAS;IA0BjB,OAAO,CAAC,UAAU;IAmBlB,wBAAwB;IACxB,OAAO,CAAC,qBAAqB;IAc7B,OAAO,CAAC,kBAAkB;IAQ1B,OAAO,CAAC,cAAc;CAevB"}

package/dist/pii-masker.js

@@ -3,110 +3,198 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PiiMasker = void 0;
+exports.PiiMasker = exports.MAX_MASK_STATS_PER_ENTRY = exports.RULE_ID_IMAGE = exports.RULE_ID_EMAIL = exports.RULE_ID_FILE_PATH = void 0;
+exports.resolveMaskConfig = resolveMaskConfig;
 const crypto_1 = require("crypto");
 const os_1 = __importDefault(require("os"));
+// =============================================
+// PII マスキング (送信前に伏せる) — Issue #43 でルール駆動化
+// =============================================
+//
+// secret-detector.ts (検出・記録) と同じ前処理パイプラインの別レイヤ。
+// Issue #43 で「何がどうマスクされるか」を顧客が定義・確認・監査できるよう、
+//   1. 既定ルールの ON/OFF とカスタムルール (正規表現 + マスク文字列) を設定可能に
+//   2. ルールごとのマスク件数 (MaskStat) を entry に付与 → cloud が日次集計
+//   3. 組織ルール (cloud 配信) とローカル設定をマージして適用
+// した。マスク文字列のみが残り、元の値は entry に保持されない。
 /**
  * Built-in PII patterns. Phase B 観測 (`agent/docs/claude-log-structure.md` 第 7 節)
  * で実際に conversation に出現することが確認されたものを優先実装。
  *
  * 注: 検出粒度は false negative より false positive を許容する方針
  * (key 漏洩リスク > 文字列を過剰にマスクするリスク)。
+ * ruleId は secret-detector.ts の同種ルールと揃える (監査表示で対応が取れるように)。
  */
 const SECRET_PATTERNS = [
     // Anthropic API key (sk-ant-api... / sk-ant-oat... / sk-ant-ort...)
-    [/sk-ant-(api|oat|ort)\d+-[A-Za-z0-9_-]{40,}/g, '[MASKED_ANTHROPIC_KEY]'],
+    {
+        ruleId: 'anthropic_key',
+        regex: /sk-ant-(api|oat|ort)\d+-[A-Za-z0-9_-]{40,}/g,
+        replacement: '[MASKED_ANTHROPIC_KEY]',
+    },
     // OpenAI key (sk-proj-... or legacy sk-...) — 40+ 文字に絞って誤検出抑制
-    [/sk-(proj-)?[A-Za-z0-9]{40,}/g, '[MASKED_OPENAI_KEY]'],
+    {
+        ruleId: 'openai_key',
+        regex: /sk-(proj-)?[A-Za-z0-9]{40,}/g,
+        replacement: '[MASKED_OPENAI_KEY]',
+    },
     // GitHub token (ghp_, gho_, ghu_, ghs_, ghr_)
-    [/gh[pousr]_[A-Za-z0-9]{36}/g, '[MASKED_GITHUB_TOKEN]'],
+    {
+        ruleId: 'github_token',
+        regex: /gh[pousr]_[A-Za-z0-9]{36}/g,
+        replacement: '[MASKED_GITHUB_TOKEN]',
+    },
     // Slack token (xoxb-, xoxp-, xoxa-, xoxr-, xoxs-)
-    [/xox[baprs]-[A-Za-z0-9-]{10,}/g, '[MASKED_SLACK_TOKEN]'],
+    {
+        ruleId: 'slack_token',
+        regex: /xox[baprs]-[A-Za-z0-9-]{10,}/g,
+        replacement: '[MASKED_SLACK_TOKEN]',
+    },
     // AWS access key
-    [/\bAKIA[0-9A-Z]{16}\b/g, '[MASKED_AWS_KEY]'],
+    { ruleId: 'aws_access_key', regex: /\bAKIA[0-9A-Z]{16}\b/g, replacement: '[MASKED_AWS_KEY]' },
     // GCP API key
-    [/\bAIza[0-9A-Za-z_-]{35}\b/g, '[MASKED_GCP_KEY]'],
+    {
+        ruleId: 'gcp_api_key',
+        regex: /\bAIza[0-9A-Za-z_-]{35}\b/g,
+        replacement: '[MASKED_GCP_KEY]',
+    },
     // Generic Bearer token (短すぎる文字列は誤検出するので 20+ 文字に絞る)
-    [/Bearer\s+[A-Za-z0-9._-]{20,}/g, 'Bearer [MASKED_TOKEN]'],
+    {
+        ruleId: 'bearer_token',
+        regex: /Bearer\s+[A-Za-z0-9._-]{20,}/g,
+        replacement: 'Bearer [MASKED_TOKEN]',
+    },
 ];
 // local-part を 2 文字以上にして Flask デコレータ等 (例: `t@app.context_processor`,
 // `n@app.after_request`) の false positive をブロック。1 文字 local-part の実 email は
 // RFC 上 valid だが実運用ではほぼ存在しない (acceptable trade-off)。
 const EMAIL_PATTERN = /[a-zA-Z0-9._%+-]{2,}@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
-/** ファイルパス内のユーザー名を匿名化 */
-function maskFilePathsInString(str, homeDir) {
-    let result = str;
-    // 自分のホーム → ~
-    if (homeDir) {
-        result = result.split(homeDir).join('~');
+/** ファイルパス / 画像など、正規表現グループ外の構造的ルールの ruleId。 */
+exports.RULE_ID_FILE_PATH = 'file_path';
+exports.RULE_ID_EMAIL = 'email';
+exports.RULE_ID_IMAGE = 'image_base64';
+/** 1 entry あたりの MaskStat 上限 (detections の MAX_DETECTIONS_PER_ENTRY と同思想)。 */
+exports.MAX_MASK_STATS_PER_ENTRY = 50;
+/**
+ * ローカル設定 (agent.config.json の pii) と組織ルール (cloud 配信) をマージする。
+ * - builtin トグルは組織ルールがあればそちらを正とする (組織統制を優先)。
+ * - カスタムルールは両方の和集合 (多くマスクする方向は常に安全側)。
+ *   ローカル customPatterns は ruleId を持たないため custom_local_N を自動付与する。
+ */
+function resolveMaskConfig(local, remote) {
+    const localCustom = (local.customPatterns ?? []).map((p, i) => ({
+        ruleId: `custom_local_${i + 1}`,
+        pattern: p.pattern,
+        replacement: p.replacement,
+        enabled: true,
+    }));
+    if (!remote) {
+        return {
+            maskApiKeys: local.maskApiKeys,
+            maskFilePaths: local.maskFilePaths,
+            maskEmails: local.maskEmails,
+            customRules: localCustom,
+        };
     }
-    // 他ユーザー (チーム共有時に他のユーザー名が漏れないように)
-    result = result.replace(/\/Users\/[^/\s"'`]+/g, '/Users/[USER]');
-    result = result.replace(/\/home\/[^/\s"'`]+/g, '/home/[USER]');
-    return result;
+    return {
+        maskApiKeys: remote.builtin.maskApiKeys,
+        maskFilePaths: remote.builtin.maskFilePaths,
+        maskEmails: remote.builtin.maskEmails,
+        customRules: [...remote.customRules.filter((r) => r.enabled), ...localCustom],
+    };
 }
 class PiiMasker {
-    config;
+    effective;
     homeDir;
     customPatterns;
     constructor(config, opts = {}) {
-        this.config = config;
+        this.effective = resolveMaskConfig(config, opts.remoteRules);
         this.homeDir = opts.homeDir ?? os_1.default.homedir();
-        this.customPatterns = (config.customPatterns ?? []).map(({ pattern, replacement }) => {
-            // ユーザー指定 regex は flag を付けて global にする
-            const flags = pattern.startsWith('/') ? '' : 'g';
-            return [new RegExp(pattern, flags), replacement];
-        });
+        this.customPatterns = this.effective.customRules
+            .map((rule) => {
+            try {
+                return { ruleId: rule.ruleId, regex: new RegExp(rule.pattern, 'g'), replacement: rule.replacement };
+            }
+            catch {
+                // 不正な正規表現は無視 (1 ルールのせいでマスキング全体を落とさない)。
+                return null;
+            }
+        })
+            .filter((r) => r !== null);
     }
     mask(entry) {
-        return { ...entry, raw: this.maskValue(entry.raw) };
+        const counts = new Map();
+        const raw = this.maskValue(entry.raw, counts);
+        if (counts.size === 0)
+            return { ...entry, raw };
+        // 件数降順で上限へ切り詰める (cloud 側 schema の上限と整合)。
+        const masks = [...counts.entries()]
+            .map(([ruleId, count]) => ({ ruleId, count }))
+            .sort((a, b) => b.count - a.count)
+            .slice(0, exports.MAX_MASK_STATS_PER_ENTRY);
+        return { ...entry, raw, masks };
     }
     maskAll(entries) {
         return entries.map((e) => this.mask(e));
     }
     /** 任意の値を再帰的に処理。string は pattern 置換、object は structural な特別処理あり */
-    maskValue(v) {
+    maskValue(v, counts) {
         if (typeof v === 'string') {
-            return this.maskString(v);
+            return this.maskString(v, counts);
         }
         if (Array.isArray(v)) {
-            return v.map((x) => this.maskValue(x));
+            return v.map((x) => this.maskValue(x, counts));
         }
         if (v !== null && typeof v === 'object') {
             const obj = v;
             // 画像 base64 は構造的に検出して省略 (帯域節約 + 二次的 PII 流出防止)
             if (this.isBase64ImageBlock(obj)) {
+                bump(counts, exports.RULE_ID_IMAGE, 1);
                 return this.summarizeImage(obj);
             }
             const result = {};
             for (const [k, val] of Object.entries(obj)) {
                 // key 自体に絶対パス等が入るケース (例: file-history-snapshot の
                 // trackedFileBackups は file path を key にする) があるので key も maskString
-                const newKey = this.maskString(k);
-                result[newKey] = this.maskValue(val);
+                const newKey = this.maskString(k, counts);
+                result[newKey] = this.maskValue(val, counts);
             }
             return result;
         }
         return v;
     }
-    maskString(str) {
+    maskString(str, counts) {
         let result = str;
-        if (this.config.maskApiKeys) {
-            for (const [re, repl] of SECRET_PATTERNS) {
-                result = result.replace(re, repl);
+        if (this.effective.maskApiKeys) {
+            for (const { ruleId, regex, replacement } of SECRET_PATTERNS) {
+                result = replaceCounted(result, regex, replacement, counts, ruleId);
             }
         }
-        if (this.config.maskFilePaths) {
-            result = maskFilePathsInString(result, this.homeDir);
+        if (this.effective.maskFilePaths) {
+            result = this.maskFilePathsInString(result, counts);
         }
-        if (this.config.maskEmails) {
-            result = result.replace(EMAIL_PATTERN, '[MASKED_EMAIL]');
+        if (this.effective.maskEmails) {
+            result = replaceCounted(result, EMAIL_PATTERN, '[MASKED_EMAIL]', counts, exports.RULE_ID_EMAIL);
         }
-        for (const [re, repl] of this.customPatterns) {
-            result = result.replace(re, repl);
+        for (const { ruleId, regex, replacement } of this.customPatterns) {
+            result = replaceCounted(result, regex, replacement, counts, ruleId);
         }
         return result;
     }
+    /** ファイルパス内のユーザー名を匿名化 */
+    maskFilePathsInString(str, counts) {
+        let result = str;
+        // 自分のホーム → ~
+        if (this.homeDir && result.includes(this.homeDir)) {
+            const parts = result.split(this.homeDir);
+            bump(counts, exports.RULE_ID_FILE_PATH, parts.length - 1);
+            result = parts.join('~');
+        }
+        // 他ユーザー (チーム共有時に他のユーザー名が漏れないように)
+        result = replaceCounted(result, /\/Users\/[^/\s"'`]+/g, '/Users/[USER]', counts, exports.RULE_ID_FILE_PATH);
+        result = replaceCounted(result, /\/home\/[^/\s"'`]+/g, '/home/[USER]', counts, exports.RULE_ID_FILE_PATH);
+        return result;
+    }
     isBase64ImageBlock(obj) {
         if (obj.type !== 'image')
             return false;
@@ -133,4 +221,19 @@ class PiiMasker {
     }
 }
 exports.PiiMasker = PiiMasker;
+function bump(counts, ruleId, n) {
+    if (n <= 0)
+        return;
+    counts.set(ruleId, (counts.get(ruleId) ?? 0) + n);
+}
+/** literal 置換 + 置換回数のカウント。replacement 内の $& 等は解釈しない。 */
+function replaceCounted(str, regex, replacement, counts, ruleId) {
+    let n = 0;
+    const result = str.replace(regex, () => {
+        n++;
+        return replacement;
+    });
+    bump(counts, ruleId, n);
+    return result;
+}
 //# sourceMappingURL=pii-masker.js.map

package/dist/pii-masker.js.map

@@ -1 +1 @@
-{"version":3,"file":"pii-masker.js","sourceRoot":"","sources":["../src/pii-masker.ts"],"names":[],"mappings":";;;;;;AAAA,mCAAmC;AACnC,4CAAmB;AAInB;;;;;;GAMG;AACH,MAAM,eAAe,GAA4B;IAC/C,oEAAoE;IACpE,CAAC,6CAA6C,EAAE,wBAAwB,CAAC;IACzE,8DAA8D;IAC9D,CAAC,8BAA8B,EAAE,qBAAqB,CAAC;IACvD,8CAA8C;IAC9C,CAAC,4BAA4B,EAAE,uBAAuB,CAAC;IACvD,kDAAkD;IAClD,CAAC,+BAA+B,EAAE,sBAAsB,CAAC;IACzD,iBAAiB;IACjB,CAAC,uBAAuB,EAAE,kBAAkB,CAAC;IAC7C,cAAc;IACd,CAAC,4BAA4B,EAAE,kBAAkB,CAAC;IAClD,mDAAmD;IACnD,CAAC,+BAA+B,EAAE,uBAAuB,CAAC;CAC3D,CAAA;AAED,qEAAqE;AACrE,2EAA2E;AAC3E,qDAAqD;AACrD,MAAM,aAAa,GAAG,oDAAoD,CAAA;AAE1E,wBAAwB;AACxB,SAAS,qBAAqB,CAAC,GAAW,EAAE,OAAe;IACzD,IAAI,MAAM,GAAG,GAAG,CAAA;IAChB,aAAa;IACb,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC1C,CAAC;IACD,iCAAiC;IACjC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,sBAAsB,EAAE,eAAe,CAAC,CAAA;IAChE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAA;IAC9D,OAAO,MAAM,CAAA;AACf,CAAC;AAMD,MAAa,SAAS;IACH,MAAM,CAAoB;IAC1B,OAAO,CAAQ;IACf,cAAc,CAAyB;IAExD,YAAY,MAA0B,EAAE,OAAyB,EAAE;QACjE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,YAAE,CAAC,OAAO,EAAE,CAAA;QAC3C,IAAI,CAAC,cAAc,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE;YACnF,sCAAsC;YACtC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;YAChD,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,WAAW,CAAC,CAAA;QAClD,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,CAAC,KAAkB;QACrB,OAAO,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAA;IACrD,CAAC;IAED,OAAO,CAAC,OAAsB;QAC5B,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IACzC,CAAC;IAED,kEAAkE;IAC1D,SAAS,CAAC,CAAU;QAC1B,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAC3B,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;QACxC,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,CAA4B,CAAA;YACxC,8CAA8C;YAC9C,IAAI,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;YACjC,CAAC;YACD,MAAM,MAAM,GAA4B,EAAE,CAAA;YAC1C,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3C,iDAAiD;gBACjD,mEAAmE;gBACnE,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;gBACjC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;YACtC,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC;QACD,OAAO,CAAC,CAAA;IACV,CAAC;IAEO,UAAU,CAAC,GAAW;QAC5B,IAAI,MAAM,GAAG,GAAG,CAAA;QAChB,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5B,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,eAAe,EAAE,CAAC;gBACzC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;YACnC,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC9B,MAAM,GAAG,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;QACtD,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAA;QAC1D,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7C,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QACnC,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAEO,kBAAkB,CAAC,GAA4B;QACrD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,KAAK,CAAA;QACtC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAA;QACtB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;QACjD,MAAM,CAAC,GAAG,GAA8B,CAAA;QACxC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAA;IAC1D,CAAC;IAEO,cAAc,CAAC,GAA4B;QACjD,MAAM,GAAG,GAAG,GAAG,CAAC,MAA6D,CAAA;QAC7E,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;QACrB,yDAAyD;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QACnD,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACzE,OAAO;YACL,GAAG,GAAG;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,IAAI,EAAE,sBAAsB,SAAS,YAAY,IAAI,GAAG;aACzD;SACF,CAAA;IACH,CAAC;CACF;AA3FD,8BA2FC"}
+{"version":3,"file":"pii-masker.js","sourceRoot":"","sources":["../src/pii-masker.ts"],"names":[],"mappings":";;;;;;AA4HA,8CAwBC;AApJD,mCAAmC;AACnC,4CAAmB;AAInB,gDAAgD;AAChD,0CAA0C;AAC1C,gDAAgD;AAChD,EAAE;AACF,gDAAgD;AAChD,6CAA6C;AAC7C,qDAAqD;AACrD,wDAAwD;AACxD,wCAAwC;AACxC,qCAAqC;AAErC;;;;;;;GAOG;AACH,MAAM,eAAe,GAAkE;IACrF,oEAAoE;IACpE;QACE,MAAM,EAAE,eAAe;QACvB,KAAK,EAAE,6CAA6C;QACpD,WAAW,EAAE,wBAAwB;KACtC;IACD,8DAA8D;IAC9D;QACE,MAAM,EAAE,YAAY;QACpB,KAAK,EAAE,8BAA8B;QACrC,WAAW,EAAE,qBAAqB;KACnC;IACD,8CAA8C;IAC9C;QACE,MAAM,EAAE,cAAc;QACtB,KAAK,EAAE,4BAA4B;QACnC,WAAW,EAAE,uBAAuB;KACrC;IACD,kDAAkD;IAClD;QACE,MAAM,EAAE,aAAa;QACrB,KAAK,EAAE,+BAA+B;QACtC,WAAW,EAAE,sBAAsB;KACpC;IACD,iBAAiB;IACjB,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,uBAAuB,EAAE,WAAW,EAAE,kBAAkB,EAAE;IAC7F,cAAc;IACd;QACE,MAAM,EAAE,aAAa;QACrB,KAAK,EAAE,4BAA4B;QACnC,WAAW,EAAE,kBAAkB;KAChC;IACD,mDAAmD;IACnD;QACE,MAAM,EAAE,cAAc;QACtB,KAAK,EAAE,+BAA+B;QACtC,WAAW,EAAE,uBAAuB;KACrC;CACF,CAAA;AAED,qEAAqE;AACrE,2EAA2E;AAC3E,qDAAqD;AACrD,MAAM,aAAa,GAAG,oDAAoD,CAAA;AAE1E,8CAA8C;AACjC,QAAA,iBAAiB,GAAG,WAAW,CAAA;AAC/B,QAAA,aAAa,GAAG,OAAO,CAAA;AACvB,QAAA,aAAa,GAAG,cAAc,CAAA;AAE3C,6EAA6E;AAChE,QAAA,wBAAwB,GAAG,EAAE,CAAA;AA0C1C;;;;;GAKG;AACH,SAAgB,iBAAiB,CAC/B,KAAyB,EACzB,MAA+B;IAE/B,MAAM,WAAW,GAAqB,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,MAAM,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE;QAC/B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,OAAO,EAAE,IAAI;KACd,CAAC,CAAC,CAAA;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,WAAW,EAAE,WAAW;SACzB,CAAA;IACH,CAAC;IACD,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;QACvC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa;QAC3C,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;QACrC,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,WAAW,CAAC;KAC9E,CAAA;AACH,CAAC;AAQD,MAAa,SAAS;IACH,SAAS,CAAqB;IAC9B,OAAO,CAAQ;IACf,cAAc,CAA+D;IAE9F,YAAY,MAA0B,EAAE,OAAyB,EAAE;QACjE,IAAI,CAAC,SAAS,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;QAC5D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,YAAE,CAAC,OAAO,EAAE,CAAA;QAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW;aAC7C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACZ,IAAI,CAAC;gBACH,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAA;YACrG,CAAC;YAAC,MAAM,CAAC;gBACP,uCAAuC;gBACvC,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,CAAC,EAA+D,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAA;IAC3F,CAAC;IAED,IAAI,CAAC,KAAkB;QACrB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,CAAA;QAC/C,yCAAyC;QACzC,MAAM,KAAK,GAAe,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;aAC5C,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;aAC7C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;aACjC,KAAK,CAAC,CAAC,EAAE,gCAAwB,CAAC,CAAA;QACrC,OAAO,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;IACjC,CAAC;IAED,OAAO,CAAC,OAAsB;QAC5B,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IACzC,CAAC;IAED,kEAAkE;IAC1D,SAAS,CAAC,CAAU,EAAE,MAA2B;QACvD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACnC,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAA;QAChD,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,CAA4B,CAAA;YACxC,8CAA8C;YAC9C,IAAI,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,MAAM,EAAE,qBAAa,EAAE,CAAC,CAAC,CAAA;gBAC9B,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;YACjC,CAAC;YACD,MAAM,MAAM,GAA4B,EAAE,CAAA;YAC1C,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3C,iDAAiD;gBACjD,mEAAmE;gBACnE,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YAC9C,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC;QACD,OAAO,CAAC,CAAA;IACV,CAAC;IAEO,UAAU,CAAC,GAAW,EAAE,MAA2B;QACzD,IAAI,MAAM,GAAG,GAAG,CAAA;QAChB,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;YAC/B,KAAK,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,eAAe,EAAE,CAAC;gBAC7D,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;YACrE,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;YACjC,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACrD,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;YAC9B,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,EAAE,qBAAa,CAAC,CAAA;QACzF,CAAC;QACD,KAAK,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACjE,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QACrE,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,wBAAwB;IAChB,qBAAqB,CAAC,GAAW,EAAE,MAA2B;QACpE,IAAI,MAAM,GAAG,GAAG,CAAA;QAChB,aAAa;QACb,IAAI,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACxC,IAAI,CAAC,MAAM,EAAE,yBAAiB,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YACjD,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC1B,CAAC;QACD,iCAAiC;QACjC,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,EAAE,yBAAiB,CAAC,CAAA;QACnG,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,EAAE,yBAAiB,CAAC,CAAA;QACjG,OAAO,MAAM,CAAA;IACf,CAAC;IAEO,kBAAkB,CAAC,GAA4B;QACrD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,KAAK,CAAA;QACtC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAA;QACtB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;QACjD,MAAM,CAAC,GAAG,GAA8B,CAAA;QACxC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAA;IAC1D,CAAC;IAEO,cAAc,CAAC,GAA4B;QACjD,MAAM,GAAG,GAAG,GAAG,CAAC,MAA6D,CAAA;QAC7E,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;QACrB,yDAAyD;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QACnD,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACzE,OAAO;YACL,GAAG,GAAG;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,IAAI,EAAE,sBAAsB,SAAS,YAAY,IAAI,GAAG;aACzD;SACF,CAAA;IACH,CAAC;CACF;AAxHD,8BAwHC;AAED,SAAS,IAAI,CAAC,MAA2B,EAAE,MAAc,EAAE,CAAS;IAClE,IAAI,CAAC,IAAI,CAAC;QAAE,OAAM;IAClB,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;AACnD,CAAC;AAED,wDAAwD;AACxD,SAAS,cAAc,CACrB,GAAW,EACX,KAAa,EACb,WAAmB,EACnB,MAA2B,EAC3B,MAAc;IAEd,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE;QACrC,CAAC,EAAE,CAAA;QACH,OAAO,WAAW,CAAA;IACpB,CAAC,CAAC,CAAA;IACF,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;IACvB,OAAO,MAAM,CAAA;AACf,CAAC"}