sdlc-agent-4-enterprise-server 1.0.0

package/dist/modules/memory/masking/__tests__/MaskingMiddleware.test.js

@@ -0,0 +1,65 @@
+import { describe, it, expect } from 'vitest';
+import { MaskingMiddleware } from '../MaskingMiddleware.js';
+import { AllowlistService } from '../services/AllowlistService.js';
+import { AuditService } from '../services/AuditService.js';
+import { ConfigCacheService } from '../services/ConfigCacheService.js';
+function makeEntry(overrides = {}) {
+    return {
+        id: 1, content: 'Clean content', summary: 'Summary',
+        type: 'CONTEXT', tier: 'core', scope: 'USER',
+        user_id: null, source: null, source_ref: null,
+        tags: '', confidence: 1, access_count: 0,
+        created_at: '', updated_at: '', last_accessed_at: null,
+        expires_at: null, pinned: 0, pin_order: 0,
+        structured_map: '', quality_score: null, archived: 0,
+        agent_name: null, owner: null, ...overrides,
+    };
+}
+describe('MaskingMiddleware', () => {
+    const config = new ConfigCacheService();
+    const allowlist = new AllowlistService();
+    const audit = new AuditService();
+    const mw = new MaskingMiddleware(config, allowlist, audit);
+    it('passes clean content unchanged', () => {
+        const entry = makeEntry({ content: 'No sensitive data here' });
+        const r = mw.applyMasking([entry], 'DEVELOPER', 'user-1');
+        expect(r[0].content).toBe('No sensitive data here');
+        expect(r[0].masking_applied).toBe(false);
+    });
+    it('masks email for non-admin', () => {
+        const entry = makeEntry({ content: 'Contact user@example.com' });
+        const r = mw.applyMasking([entry], 'DEVELOPER', 'user-1');
+        expect(r[0].content).not.toContain('user@example.com');
+        expect(r[0].masking_applied).toBe(true);
+    });
+    it('does NOT mask email for admin', () => {
+        const entry = makeEntry({ content: 'Contact user@example.com' });
+        const r = mw.applyMasking([entry], 'ADMIN', 'admin-1');
+        expect(r[0].content).toContain('user@example.com');
+    });
+    it('always masks credentials for admin (no reveal)', () => {
+        const entry = makeEntry({ content: 'sk-abc123xyz789abcdefghijklm' });
+        const r = mw.applyMasking([entry], 'ADMIN', 'admin-1');
+        expect(r[0].content).not.toContain('sk-abc123xyz789abcdefghijklm');
+    });
+    it('reveals credentials for admin with reveal=true', () => {
+        const entry = makeEntry({ content: 'sk-abc123xyz789abcdefghijklm' });
+        const r = mw.applyMasking([entry], 'ADMIN', 'a', { reveal: true });
+        expect(r[0].content).toContain('sk-abc123xyz789abcdefghijklm');
+    });
+    it('hides RESTRICTED for non-admin', () => {
+        const entry = makeEntry({ content: 'sk-abc123xyz789abcdefghijklm' });
+        const r = mw.applyMasking([entry], 'DEVELOPER', 'dev-1');
+        expect(r.length).toBe(0);
+    });
+    it('skips masking for allowlisted entry', () => {
+        const al = new AllowlistService();
+        al.updateRules([{ id: 1, rule_type: 'entry_id', rule_value: '42',
+                description: null, created_by: null, created_at: '' }]);
+        const mw2 = new MaskingMiddleware(config, al, audit);
+        const entry = makeEntry({ id: 42, content: 'user@example.com' });
+        const r = mw2.applyMasking([entry], 'DEVELOPER', 'dev-1');
+        expect(r[0].content).toContain('user@example.com');
+    });
+});
+//# sourceMappingURL=MaskingMiddleware.test.js.map

package/dist/modules/memory/masking/__tests__/MaskingMiddleware.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MaskingMiddleware.test.js","sourceRoot":"","sources":["../../../../../src/modules/memory/masking/__tests__/MaskingMiddleware.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAGvE,SAAS,SAAS,CAAC,YAAqC,EAAE;IACxD,OAAO;QACL,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS;QACnD,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;QAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI;QAC7C,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC;QACxC,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI;QACtD,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;QACzC,cAAc,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACpD,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,SAAS;KAC5C,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,MAAM,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;IACjC,MAAM,EAAE,GAAG,IAAI,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAE3D,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC1D,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACpD,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC1D,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACvD,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACvD,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACvD,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,EAAE,GAAG,IAAI,gBAAgB,EAAE,CAAC;QAClC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI;gBAC9D,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAI,iBAAiB,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QAC1D,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/modules/memory/masking/__tests__/PiiDetector.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/memory/masking/__tests__/PiiDetector.test.js

@@ -0,0 +1,52 @@
+import { describe, it, expect } from 'vitest';
+import { PiiDetector } from '../detectors/PiiDetector.js';
+describe('PiiDetector', () => {
+    const detector = new PiiDetector();
+    describe('email detection', () => {
+        it('detects email in plain text', () => {
+            const results = detector.detect('Contact us at user@example.com for info');
+            expect(results.length).toBeGreaterThanOrEqual(1);
+            expect(results[0].type).toBe('email');
+            expect(results[0].match).toBe('user@example.com');
+        });
+        it('detects multiple emails', () => {
+            const results = detector.detect('Email admin@corp.io or support@corp.io');
+            expect(results.length).toBe(2);
+        });
+        it('returns empty for clean text', () => {
+            const results = detector.detect('Normal text without sensitive data');
+            const emails = results.filter(r => r.type === 'email');
+            expect(emails.length).toBe(0);
+        });
+    });
+    describe('phone detection', () => {
+        it('detects international phone', () => {
+            const results = detector.detect('Call +1-234-567-8901');
+            const phones = results.filter(r => r.type === 'phone');
+            expect(phones.length).toBeGreaterThanOrEqual(1);
+        });
+    });
+    describe('IP detection', () => {
+        it('detects IP address', () => {
+            const results = detector.detect('Server at 192.168.1.100');
+            const ips = results.filter(r => r.type === 'ip');
+            expect(ips.length).toBe(1);
+            expect(ips[0].match).toBe('192.168.1.100');
+        });
+    });
+    describe('credit card detection', () => {
+        it('detects credit card with dashes', () => {
+            const results = detector.detect('Card: 4111-1111-1111-1111');
+            const ccs = results.filter(r => r.type === 'credit_card');
+            expect(ccs.length).toBe(1);
+        });
+    });
+    describe('SSN detection', () => {
+        it('detects SSN', () => {
+            const results = detector.detect('SSN: 123-45-6789');
+            const ssns = results.filter(r => r.type === 'ssn');
+            expect(ssns.length).toBeGreaterThanOrEqual(1);
+        });
+    });
+});
+//# sourceMappingURL=PiiDetector.test.js.map

package/dist/modules/memory/masking/__tests__/PiiDetector.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PiiDetector.test.js","sourceRoot":"","sources":["../../../../../src/modules/memory/masking/__tests__/PiiDetector.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE1D,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC;IAEnC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;YACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,yCAAyC,CAAC,CAAC;YAC3E,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;YACjD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;YACjC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,wCAAwC,CAAC,CAAC;YAC1E,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,oCAAoC,CAAC,CAAC;YACtE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;YACvD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;YACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;YACvD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QAC5B,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;YAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;YAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YACjD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;QACrC,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;YAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;YAC1D,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,aAAa,EAAE,GAAG,EAAE;YACrB,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACpD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/modules/memory/masking/detectors/CredentialDetector.d.ts

@@ -0,0 +1,13 @@
+import { DetectorStrategy } from './DetectorStrategy.js';
+import { DetectionResult, MaskingConfig } from '../models/MaskingTypes.js';
+/**
+ * Detects credential patterns: API keys, JWTs, passwords, connection strings, private keys.
+ * Credentials are ALWAYS masked regardless of user role (BR-01).
+ */
+export declare class CredentialDetector implements DetectorStrategy {
+    readonly category: "credential";
+    private patterns;
+    constructor(configs?: MaskingConfig[]);
+    detect(content: string): DetectionResult[];
+    private compilePatterns;
+}

package/dist/modules/memory/masking/detectors/CredentialDetector.js

@@ -0,0 +1,50 @@
+const DEFAULT_PATTERNS = {
+    api_key: '\\b(sk-[a-zA-Z0-9]{20,}|pk_[a-zA-Z0-9]{20,}|AKIA[A-Z0-9]{16}|ghp_[a-zA-Z0-9]{36}|glpat-[a-zA-Z0-9\\-]{20,})\\b',
+    jwt: 'eyJ[a-zA-Z0-9_\\-]{10,}\\.[a-zA-Z0-9_\\-]{10,}\\.[a-zA-Z0-9_\\-]{10,}',
+    password: '(password|passwd|secret|token|api_key)\\s*[=:]\\s*[^\\s,;]{3,}',
+    connection_string: '(mongodb|postgres|mysql|redis|amqp):\\/\\/[^\\s]+',
+    private_key: '-----BEGIN\\s+(RSA\\s+|EC\\s+)?PRIVATE\\s+KEY-----',
+};
+/**
+ * Detects credential patterns: API keys, JWTs, passwords, connection strings, private keys.
+ * Credentials are ALWAYS masked regardless of user role (BR-01).
+ */
+export class CredentialDetector {
+    category = 'credential';
+    patterns;
+    constructor(configs) {
+        this.patterns = this.compilePatterns(configs);
+    }
+    detect(content) {
+        const results = [];
+        for (const [type, regex] of this.patterns) {
+            const matches = content.matchAll(new RegExp(regex.source, 'g'));
+            for (const m of matches) {
+                if (m.index === undefined)
+                    continue;
+                results.push({
+                    type,
+                    category: 'credential',
+                    match: m[0],
+                    start: m.index,
+                    end: m.index + m[0].length,
+                });
+            }
+        }
+        return results;
+    }
+    compilePatterns(configs) {
+        const map = new Map();
+        const credTypes = ['api_key', 'jwt', 'password', 'connection_string', 'private_key'];
+        for (const t of credTypes) {
+            const cfg = configs?.find(c => c.pattern_type === t && c.enabled);
+            if (configs && !cfg)
+                continue;
+            const pattern = cfg?.regex_pattern ?? DEFAULT_PATTERNS[t];
+            if (pattern)
+                map.set(t, new RegExp(pattern, 'g'));
+        }
+        return map;
+    }
+}
+//# sourceMappingURL=CredentialDetector.js.map

package/dist/modules/memory/masking/detectors/CredentialDetector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialDetector.js","sourceRoot":"","sources":["../../../../../src/modules/memory/masking/detectors/CredentialDetector.ts"],"names":[],"mappings":"AAGA,MAAM,gBAAgB,GAA2B;IAC/C,OAAO,EAAE,gHAAgH;IACzH,GAAG,EAAE,uEAAuE;IAC5E,QAAQ,EAAE,gEAAgE;IAC1E,iBAAiB,EAAE,mDAAmD;IACtE,WAAW,EAAE,oDAAoD;CAClE,CAAC;AAEF;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IACpB,QAAQ,GAAG,YAAqB,CAAC;IAClC,QAAQ,CAA2B;IAE3C,YAAY,OAAyB;QACnC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,CAAC,OAAe;QACpB,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;YAChE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;oBAAE,SAAS;gBACpC,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI;oBACJ,QAAQ,EAAE,YAAY;oBACtB,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;oBACX,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,GAAG,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,eAAe,CAAC,OAAyB;QAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC3C,MAAM,SAAS,GAAkB,CAAC,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,aAAa,CAAC,CAAC;QAEpG,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;YAClE,IAAI,OAAO,IAAI,CAAC,GAAG;gBAAE,SAAS;YAC9B,MAAM,OAAO,GAAG,GAAG,EAAE,aAAa,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAC1D,IAAI,OAAO;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}

package/dist/modules/memory/masking/detectors/DetectorStrategy.d.ts

@@ -0,0 +1,9 @@
+import { DetectionResult, PatternCategory } from '../models/MaskingTypes.js';
+/**
+ * Strategy interface for all detection implementations.
+ * Each detector is responsible for finding one category of sensitive data.
+ */
+export interface DetectorStrategy {
+    readonly category: PatternCategory;
+    detect(content: string): DetectionResult[];
+}

package/dist/modules/memory/masking/detectors/DetectorStrategy.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=DetectorStrategy.js.map

package/dist/modules/memory/masking/detectors/DetectorStrategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DetectorStrategy.js","sourceRoot":"","sources":["../../../../../src/modules/memory/masking/detectors/DetectorStrategy.ts"],"names":[],"mappings":""}

package/dist/modules/memory/masking/detectors/PiiDetector.d.ts

@@ -0,0 +1,13 @@
+import { DetectorStrategy } from './DetectorStrategy.js';
+import { DetectionResult, MaskingConfig } from '../models/MaskingTypes.js';
+/**
+ * Detects PII patterns: email, phone, IP, credit card, SSN.
+ * Uses pre-compiled regex for performance.
+ */
+export declare class PiiDetector implements DetectorStrategy {
+    readonly category: "pii";
+    private patterns;
+    constructor(configs?: MaskingConfig[]);
+    detect(content: string): DetectionResult[];
+    private compilePatterns;
+}

package/dist/modules/memory/masking/detectors/PiiDetector.js

@@ -0,0 +1,50 @@
+const DEFAULT_PATTERNS = {
+    email: '[a-zA-Z0-9._%+\\-]+@[a-zA-Z0-9.\\-]+\\.[a-zA-Z]{2,}',
+    phone: '(\\+?\\d{1,3}[\\-.\\s]?)?\\(?\\d{3}\\)?[\\-.\\s]?\\d{3}[\\-.\\s]?\\d{4}',
+    ip: '\\b\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\b',
+    credit_card: '\\b\\d{4}[\\-\\s]?\\d{4}[\\-\\s]?\\d{4}[\\-\\s]?\\d{4}\\b',
+    ssn: '\\b\\d{3}[\\-\\s]?\\d{2}[\\-\\s]?\\d{4}\\b',
+};
+/**
+ * Detects PII patterns: email, phone, IP, credit card, SSN.
+ * Uses pre-compiled regex for performance.
+ */
+export class PiiDetector {
+    category = 'pii';
+    patterns;
+    constructor(configs) {
+        this.patterns = this.compilePatterns(configs);
+    }
+    detect(content) {
+        const results = [];
+        for (const [type, regex] of this.patterns) {
+            const matches = content.matchAll(new RegExp(regex.source, 'g'));
+            for (const m of matches) {
+                if (m.index === undefined)
+                    continue;
+                results.push({
+                    type,
+                    category: 'pii',
+                    match: m[0],
+                    start: m.index,
+                    end: m.index + m[0].length,
+                });
+            }
+        }
+        return results;
+    }
+    compilePatterns(configs) {
+        const map = new Map();
+        const piiTypes = ['email', 'phone', 'ip', 'credit_card', 'ssn'];
+        for (const t of piiTypes) {
+            const cfg = configs?.find(c => c.pattern_type === t && c.enabled);
+            if (configs && !cfg)
+                continue;
+            const pattern = cfg?.regex_pattern ?? DEFAULT_PATTERNS[t];
+            if (pattern)
+                map.set(t, new RegExp(pattern, 'g'));
+        }
+        return map;
+    }
+}
+//# sourceMappingURL=PiiDetector.js.map

package/dist/modules/memory/masking/detectors/PiiDetector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PiiDetector.js","sourceRoot":"","sources":["../../../../../src/modules/memory/masking/detectors/PiiDetector.ts"],"names":[],"mappings":"AAGA,MAAM,gBAAgB,GAA2B;IAC/C,KAAK,EAAE,qDAAqD;IAC5D,KAAK,EAAE,yEAAyE;IAChF,EAAE,EAAE,iDAAiD;IACrD,WAAW,EAAE,2DAA2D;IACxE,GAAG,EAAE,4CAA4C;CAClD,CAAC;AAEF;;;GAGG;AACH,MAAM,OAAO,WAAW;IACb,QAAQ,GAAG,KAAc,CAAC;IAC3B,QAAQ,CAA2B;IAE3C,YAAY,OAAyB;QACnC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,CAAC,OAAe;QACpB,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;YAChE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;oBAAE,SAAS;gBACpC,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI;oBACJ,QAAQ,EAAE,KAAK;oBACf,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;oBACX,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,GAAG,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,eAAe,CAAC,OAAyB;QAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC3C,MAAM,QAAQ,GAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;QAE/E,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;YAClE,IAAI,OAAO,IAAI,CAAC,GAAG;gBAAE,SAAS;YAC9B,MAAM,OAAO,GAAG,GAAG,EAAE,aAAa,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAC1D,IAAI,OAAO;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}

package/dist/modules/memory/masking/index.d.ts

@@ -0,0 +1,8 @@
+export { MaskingMiddleware } from './MaskingMiddleware.js';
+export { PiiDetector } from './detectors/PiiDetector.js';
+export { CredentialDetector } from './detectors/CredentialDetector.js';
+export { ContentMasker } from './maskers/ContentMasker.js';
+export { AllowlistService } from './services/AllowlistService.js';
+export { AuditService } from './services/AuditService.js';
+export { ConfigCacheService } from './services/ConfigCacheService.js';
+export * from './models/MaskingTypes.js';

package/dist/modules/memory/masking/index.js

@@ -0,0 +1,9 @@
+export { MaskingMiddleware } from './MaskingMiddleware.js';
+export { PiiDetector } from './detectors/PiiDetector.js';
+export { CredentialDetector } from './detectors/CredentialDetector.js';
+export { ContentMasker } from './maskers/ContentMasker.js';
+export { AllowlistService } from './services/AllowlistService.js';
+export { AuditService } from './services/AuditService.js';
+export { ConfigCacheService } from './services/ConfigCacheService.js';
+export * from './models/MaskingTypes.js';
+//# sourceMappingURL=index.js.map

package/dist/modules/memory/masking/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/modules/memory/masking/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,cAAc,0BAA0B,CAAC"}

package/dist/modules/memory/masking/maskers/ContentMasker.d.ts

@@ -0,0 +1,22 @@
+import { CodeBlock, DetectionResult, SensitivityLevel } from '../models/MaskingTypes.js';
+/**
+ * Applies masking transformations to content.
+ * Extracts code blocks first to preserve them, then applies masking.
+ */
+export declare class ContentMasker {
+    applyMasking(content: string, detections: DetectionResult[], role: string, level: SensitivityLevel, reveal: boolean): string;
+    extractCodeBlocks(content: string): {
+        text: string;
+        blocks: CodeBlock[];
+    };
+    restoreCodeBlocks(content: string, blocks: CodeBlock[]): string;
+    private isInCodeBlock;
+    private getMaskFormat;
+    private maskEmail;
+    private maskPhone;
+    private maskIp;
+    private maskCreditCard;
+    private maskSsn;
+    private maskApiKey;
+    private maskConnString;
+}

package/dist/modules/memory/masking/maskers/ContentMasker.js

@@ -0,0 +1,89 @@
+const CODE_BLOCK_RE = /```[\s\S]*?```/g;
+/**
+ * Applies masking transformations to content.
+ * Extracts code blocks first to preserve them, then applies masking.
+ */
+export class ContentMasker {
+    applyMasking(content, detections, role, level, reveal) {
+        if (reveal && role === 'ADMIN')
+            return content;
+        const { text, blocks } = this.extractCodeBlocks(content);
+        let masked = text;
+        const sorted = [...detections].sort((a, b) => b.start - a.start);
+        for (const det of sorted) {
+            if (this.isInCodeBlock(det.start, blocks))
+                continue;
+            const replacement = this.getMaskFormat(det);
+            masked = masked.slice(0, det.start) + replacement + masked.slice(det.end);
+        }
+        return this.restoreCodeBlocks(masked, blocks);
+    }
+    extractCodeBlocks(content) {
+        const blocks = [];
+        let idx = 0;
+        const text = content.replace(CODE_BLOCK_RE, (match, offset) => {
+            const placeholder = `__CODE_BLOCK_${idx}__`;
+            blocks.push({ placeholder, original: match, start: offset, end: offset + match.length });
+            idx++;
+            return placeholder;
+        });
+        return { text, blocks };
+    }
+    restoreCodeBlocks(content, blocks) {
+        let result = content;
+        for (const b of blocks) {
+            result = result.replace(b.placeholder, b.original);
+        }
+        return result;
+    }
+    isInCodeBlock(pos, blocks) {
+        return blocks.some(b => pos >= b.start && pos < b.end);
+    }
+    getMaskFormat(det) {
+        switch (det.type) {
+            case 'email': return this.maskEmail(det.match);
+            case 'phone': return this.maskPhone(det.match);
+            case 'ip': return this.maskIp(det.match);
+            case 'credit_card': return this.maskCreditCard(det.match);
+            case 'ssn': return this.maskSsn(det.match);
+            case 'api_key': return this.maskApiKey(det.match);
+            case 'jwt': return 'eyJ***[REDACTED]';
+            case 'password': return '[REDACTED]';
+            case 'connection_string': return this.maskConnString(det.match);
+            case 'private_key': return '[REDACTED_KEY]';
+            default: return '[REDACTED]';
+        }
+    }
+    maskEmail(email) {
+        const [local, domain] = email.split('@');
+        const parts = domain.split('.');
+        const tld = parts[parts.length - 1];
+        return `${local[0]}***@${parts[0][0]}***.${tld}`;
+    }
+    maskPhone(phone) {
+        const digits = phone.replace(/\D/g, '');
+        const last4 = digits.slice(-4);
+        return `+*-***-***-${last4}`;
+    }
+    maskIp(ip) {
+        const parts = ip.split('.');
+        return `${parts[0]}.${parts[1]}.*.*`;
+    }
+    maskCreditCard(cc) {
+        const digits = cc.replace(/\D/g, '');
+        return `****-****-****-${digits.slice(-4)}`;
+    }
+    maskSsn(ssn) {
+        const digits = ssn.replace(/\D/g, '');
+        return `***-**-${digits.slice(-4)}`;
+    }
+    maskApiKey(key) {
+        const dashIdx = key.indexOf('-');
+        const prefix = dashIdx > 0 ? key.slice(0, dashIdx + 1) : key.slice(0, 4);
+        return `${prefix}***[REDACTED]`;
+    }
+    maskConnString(conn) {
+        return conn.replace(/:\/\/([^:]+):([^@]+)@/, '://***:***@');
+    }
+}
+//# sourceMappingURL=ContentMasker.js.map

package/dist/modules/memory/masking/maskers/ContentMasker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ContentMasker.js","sourceRoot":"","sources":["../../../../../src/modules/memory/masking/maskers/ContentMasker.ts"],"names":[],"mappings":"AAEA,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAExC;;;GAGG;AACH,MAAM,OAAO,aAAa;IAExB,YAAY,CACV,OAAe,EACf,UAA6B,EAC7B,IAAY,EACZ,KAAuB,EACvB,MAAe;QAEf,IAAI,MAAM,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,OAAO,CAAC;QAE/C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,MAAM,GAAG,IAAI,CAAC;QAElB,MAAM,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAEjE,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC;gBAAE,SAAS;YACpD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YAC5C,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5E,CAAC;QAED,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,iBAAiB,CAAC,OAAe;QAC/B,MAAM,MAAM,GAAgB,EAAE,CAAC;QAC/B,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAC5D,MAAM,WAAW,GAAG,gBAAgB,GAAG,IAAI,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACzF,GAAG,EAAE,CAAC;YACN,OAAO,WAAW,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IAED,iBAAiB,CAAC,OAAe,EAAE,MAAmB;QACpD,IAAI,MAAM,GAAG,OAAO,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,aAAa,CAAC,GAAW,EAAE,MAAmB;QACpD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC;IAEO,aAAa,CAAC,GAAoB;QACxC,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;YACjB,KAAK,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/C,KAAK,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/C,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACzC,KAAK,aAAa,CAAC,CAAC,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC1D,KAAK,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3C,KAAK,SAAS,CAAC,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAClD,KAAK,KAAK,CAAC,CAAC,OAAO,kBAAkB,CAAC;YACtC,KAAK,UAAU,CAAC,CAAC,OAAO,YAAY,CAAC;YACrC,KAAK,mBAAmB,CAAC,CAAC,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChE,KAAK,aAAa,CAAC,CAAC,OAAO,gBAAgB,CAAC;YAC5C,OAAO,CAAC,CAAC,OAAO,YAAY,CAAC;QAC/B,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,KAAa;QAC7B,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACpC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC;IACnD,CAAC;IAEO,SAAS,CAAC,KAAa;QAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,OAAO,cAAc,KAAK,EAAE,CAAC;IAC/B,CAAC;IAEO,MAAM,CAAC,EAAU;QACvB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IACvC,CAAC;IAEO,cAAc,CAAC,EAAU;QAC/B,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrC,OAAO,kBAAkB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9C,CAAC;IAEO,OAAO,CAAC,GAAW;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtC,OAAO,UAAU,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtC,CAAC;IAEO,UAAU,CAAC,GAAW;QAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,OAAO,GAAG,MAAM,eAAe,CAAC;IAClC,CAAC;IAEO,cAAc,CAAC,IAAY;QACjC,OAAO,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,aAAa,CAAC,CAAC;IAC9D,CAAC;CACF"}

package/dist/modules/memory/masking/models/MaskingTypes.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Core types for the KB Sensitive Data Masking system.
+ */
+export type PatternType = 'email' | 'phone' | 'ip' | 'credit_card' | 'ssn' | 'api_key' | 'jwt' | 'password' | 'connection_string' | 'private_key';
+export type PatternCategory = 'pii' | 'credential' | 'business';
+export type SensitivityLevel = 'PUBLIC' | 'INTERNAL' | 'CONFIDENTIAL' | 'RESTRICTED';
+export type ClassificationSource = 'auto' | 'manual';
+export type AuditAction = 'mask_pii' | 'mask_credential' | 'summary_only' | 'hide' | 'reveal' | 'skip_allowlist';
+export type AllowlistRuleType = 'entry_id' | 'tag' | 'source' | 'pattern';
+export interface MaskingConfig {
+    id: number;
+    pattern_type: PatternType;
+    enabled: boolean;
+    regex_pattern: string | null;
+    mask_format: string;
+    category: PatternCategory;
+    created_at: string;
+    updated_at: string;
+}
+export interface SensitivityClassification {
+    id: number;
+    entry_id: number;
+    level: SensitivityLevel;
+    source: ClassificationSource;
+    confidence: number;
+    confirmed_by: string | null;
+    confirmed_at: string | null;
+    created_at: string;
+    updated_at: string;
+}
+export interface AllowlistRule {
+    id: number;
+    rule_type: AllowlistRuleType;
+    rule_value: string;
+    description: string | null;
+    created_by: string | null;
+    created_at: string;
+}
+export interface MaskingAuditEntry {
+    id?: number;
+    entry_id: number;
+    requester_id: string;
+    requester_role: string;
+    action: AuditAction;
+    patterns_matched: string;
+    sensitivity_level: string;
+    timestamp?: string;
+}
+export interface DetectionResult {
+    type: PatternType;
+    category: PatternCategory;
+    match: string;
+    start: number;
+    end: number;
+}
+export interface MaskingOptions {
+    reveal?: boolean;
+}
+export interface MaskedEntry {
+    id: number;
+    content: string;
+    summary: string;
+    masking_applied: boolean;
+    sensitivity_level: SensitivityLevel;
+    masked_patterns: string[];
+    hidden: boolean;
+}
+export interface CodeBlock {
+    placeholder: string;
+    original: string;
+    start: number;
+    end: number;
+}

package/dist/modules/memory/masking/models/MaskingTypes.js

@@ -0,0 +1,5 @@
+/**
+ * Core types for the KB Sensitive Data Masking system.
+ */
+export {};
+//# sourceMappingURL=MaskingTypes.js.map

package/dist/modules/memory/masking/models/MaskingTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MaskingTypes.js","sourceRoot":"","sources":["../../../../../src/modules/memory/masking/models/MaskingTypes.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/modules/memory/masking/services/AllowlistService.d.ts

@@ -0,0 +1,11 @@
+import { AllowlistRule } from '../models/MaskingTypes.js';
+import { KnowledgeEntry } from '../../models.js';
+/**
+ * Checks if a KB entry is allowlisted (exempt from masking).
+ * Supports: entry_id, tag, source, pattern matching.
+ */
+export declare class AllowlistService {
+    private rules;
+    updateRules(rules: AllowlistRule[]): void;
+    isAllowlisted(entry: KnowledgeEntry): boolean;
+}

package/dist/modules/memory/masking/services/AllowlistService.js

@@ -0,0 +1,34 @@
+/**
+ * Checks if a KB entry is allowlisted (exempt from masking).
+ * Supports: entry_id, tag, source, pattern matching.
+ */
+export class AllowlistService {
+    rules = [];
+    updateRules(rules) {
+        this.rules = rules;
+    }
+    isAllowlisted(entry) {
+        for (const rule of this.rules) {
+            switch (rule.rule_type) {
+                case 'entry_id':
+                    if (String(entry.id) === rule.rule_value)
+                        return true;
+                    break;
+                case 'tag':
+                    if (entry.tags?.includes(rule.rule_value))
+                        return true;
+                    break;
+                case 'source':
+                    if (entry.source === rule.rule_value)
+                        return true;
+                    break;
+                case 'pattern':
+                    if (new RegExp(rule.rule_value).test(entry.content))
+                        return true;
+                    break;
+            }
+        }
+        return false;
+    }
+}
+//# sourceMappingURL=AllowlistService.js.map

package/dist/modules/memory/masking/services/AllowlistService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AllowlistService.js","sourceRoot":"","sources":["../../../../../src/modules/memory/masking/services/AllowlistService.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,MAAM,OAAO,gBAAgB;IACnB,KAAK,GAAoB,EAAE,CAAC;IAEpC,WAAW,CAAC,KAAsB;QAChC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,aAAa,CAAC,KAAqB;QACjC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;gBACvB,KAAK,UAAU;oBACb,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,UAAU;wBAAE,OAAO,IAAI,CAAC;oBACtD,MAAM;gBACR,KAAK,KAAK;oBACR,IAAI,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;wBAAE,OAAO,IAAI,CAAC;oBACvD,MAAM;gBACR,KAAK,QAAQ;oBACX,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,UAAU;wBAAE,OAAO,IAAI,CAAC;oBAClD,MAAM;gBACR,KAAK,SAAS;oBACZ,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;wBAAE,OAAO,IAAI,CAAC;oBACjE,MAAM;YACV,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/modules/memory/masking/services/AuditService.d.ts

@@ -0,0 +1,14 @@
+import { MaskingAuditEntry } from '../models/MaskingTypes.js';
+/**
+ * Non-blocking audit logging for masking events.
+ * Fire-and-forget writes to avoid adding latency to read path.
+ */
+export declare class AuditService {
+    private buffer;
+    private flushInterval;
+    private writeCallback;
+    constructor(writeCallback?: (entries: MaskingAuditEntry[]) => Promise<void>);
+    logEvent(event: MaskingAuditEntry): void;
+    flush(): Promise<void>;
+    destroy(): void;
+}

package/dist/modules/memory/masking/services/AuditService.js

@@ -0,0 +1,39 @@
+/**
+ * Non-blocking audit logging for masking events.
+ * Fire-and-forget writes to avoid adding latency to read path.
+ */
+export class AuditService {
+    buffer = [];
+    flushInterval = null;
+    writeCallback = null;
+    constructor(writeCallback) {
+        this.writeCallback = writeCallback ?? null;
+        this.flushInterval = setInterval(() => this.flush(), 5000);
+    }
+    logEvent(event) {
+        event.timestamp = event.timestamp ?? new Date().toISOString();
+        this.buffer.push(event);
+        if (this.buffer.length >= 50) {
+            void this.flush();
+        }
+    }
+    async flush() {
+        if (this.buffer.length === 0 || !this.writeCallback)
+            return;
+        const batch = this.buffer.splice(0, this.buffer.length);
+        try {
+            await this.writeCallback(batch);
+        }
+        catch {
+            this.buffer.unshift(...batch);
+        }
+    }
+    destroy() {
+        if (this.flushInterval) {
+            clearInterval(this.flushInterval);
+            this.flushInterval = null;
+        }
+        void this.flush();
+    }
+}
+//# sourceMappingURL=AuditService.js.map

package/dist/modules/memory/masking/services/AuditService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuditService.js","sourceRoot":"","sources":["../../../../../src/modules/memory/masking/services/AuditService.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,OAAO,YAAY;IACf,MAAM,GAAwB,EAAE,CAAC;IACjC,aAAa,GAA0C,IAAI,CAAC;IAC5D,aAAa,GAA6D,IAAI,CAAC;IAEvF,YAAY,aAA+D;QACzE,IAAI,CAAC,aAAa,GAAG,aAAa,IAAI,IAAI,CAAC;QAC3C,IAAI,CAAC,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IAC7D,CAAC;IAED,QAAQ,CAAC,KAAwB;QAC/B,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YAC7B,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO;QAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAClC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;CACF"}