# Tasks: enterprise-data-masking

## 1. Scaffold

- [x] 1.1 `universal/data/data-masking/`; 100/100/100/100; guard tests; CLAUDE/README/FOLDERS.

## 2. Errors + schemas

- [x] 2.1 `src/error-codes.ts` + side-effect register.
- [x] 2.2 Zod schemas for `MaskingConfig`, `MaskingRule`, `MaskingPolicy`, `AuditEntry`.

## 3. Strategies

- [x] 3.1 `src/strategies/strategies.ts` — `hash` (HMAC-SHA256), `partial`, `redact`, `maskEmail`, `maskPhone`, `maskIp`, `maskCreditCard` (Luhn-aware).

## 4. Detection

- [x] 4.1 `src/detection/type-detector.ts` — `TypeDetector` with built-in `SensitiveDataType` patterns.

## 5. Patterns

- [x] 5.1 `src/patterns/pattern-masker.ts`.

## 6. Registry

- [x] 6.1 `src/registry/registry.ts` — `MaskingRegistry` + registry error codes.

## 7. Conditional rules

- [x] 7.1 `src/rules/conditional-masker.ts` — role + field permissions.

## 8. Masker façade

- [x] 8.1 `src/masker/masker.ts` — `DataMasker` orchestrator; OTel instrumentation.
- [x] 8.2 `src/types/masking-hooks.ts` — hook surface.

## 9. Audit

- [x] 9.1 `src/audit/masking-audit.ts` — `MaskingAudit`, `AuditSink` interface, filter helpers.

## 10. Docs / barrel / subpath exports / README

## 11. Benchmarks

- [x] 11.1 `mask.bench.ts` on 10 k-record JSON trees.

## 12. Ship gate

- [x] 12.1 Verification sequence; fold + archive.