Initial Commit

openspec/archive/2026-04-19-enterprise-data-masking/tasks.md

@@ -0,0 +1,49 @@
+# Tasks: enterprise-data-masking
+
+## 1. Scaffold
+
+- [x] 1.1 `universal/data/data-masking/`; 100/100/100/100; guard tests; CLAUDE/README/FOLDERS.
+
+## 2. Errors + schemas
+
+- [x] 2.1 `src/error-codes.ts` + side-effect register.
+- [x] 2.2 Zod schemas for `MaskingConfig`, `MaskingRule`, `MaskingPolicy`, `AuditEntry`.
+
+## 3. Strategies
+
+- [x] 3.1 `src/strategies/strategies.ts` — `hash` (HMAC-SHA256), `partial`, `redact`, `maskEmail`, `maskPhone`, `maskIp`, `maskCreditCard` (Luhn-aware).
+
+## 4. Detection
+
+- [x] 4.1 `src/detection/type-detector.ts` — `TypeDetector` with built-in `SensitiveDataType` patterns.
+
+## 5. Patterns
+
+- [x] 5.1 `src/patterns/pattern-masker.ts`.
+
+## 6. Registry
+
+- [x] 6.1 `src/registry/registry.ts` — `MaskingRegistry` + registry error codes.
+
+## 7. Conditional rules
+
+- [x] 7.1 `src/rules/conditional-masker.ts` — role + field permissions.
+
+## 8. Masker façade
+
+- [x] 8.1 `src/masker/masker.ts` — `DataMasker` orchestrator; OTel instrumentation.
+- [x] 8.2 `src/types/masking-hooks.ts` — hook surface.
+
+## 9. Audit
+
+- [x] 9.1 `src/audit/masking-audit.ts` — `MaskingAudit`, `AuditSink` interface, filter helpers.
+
+## 10. Docs / barrel / subpath exports / README
+
+## 11. Benchmarks
+
+- [x] 11.1 `mask.bench.ts` on 10 k-record JSON trees.
+
+## 12. Ship gate
+
+- [x] 12.1 Verification sequence; fold + archive.