deduplicate task parsing and masking helpers

apps/backend/src/utils/masking.ts

@@ -0,0 +1,51 @@
+type MaskPhoneOptions = {
+  maskShort?: boolean
+  shortMask?: string
+}
+
+type MaskCodeOptions = {
+  shortMask?: string
+}
+
+export function maskSecret(value: unknown): string {
+  const normalized = String(value || '').trim()
+  if (!normalized) {
+    return ''
+  }
+
+  if (normalized.length <= 10) {
+    return `${normalized.slice(0, 2)}****${normalized.slice(-2)}`
+  }
+
+  return `${normalized.slice(0, 6)}****${normalized.slice(-6)}`
+}
+
+export function maskPhone(value: unknown, options: MaskPhoneOptions = {}): string {
+  const text = String(value || '').trim()
+  if (!text) {
+    return ''
+  }
+
+  if (text.length <= 7) {
+    if (options.maskShort === false) {
+      return text
+    }
+
+    return `${text.slice(0, 2)}${options.shortMask || '***'}${text.slice(-2)}`
+  }
+
+  return `${text.slice(0, 3)}****${text.slice(-4)}`
+}
+
+export function maskCode(value: unknown, options: MaskCodeOptions = {}): string {
+  const text = String(value || '').trim()
+  if (!text) {
+    return ''
+  }
+
+  if (text.length <= 8) {
+    return `${text.slice(0, 2)}${options.shortMask || '***'}${text.slice(-2)}`
+  }
+
+  return `${text.slice(0, 4)}****${text.slice(-4)}`
+}

apps/backend/src/utils/task-json.ts

@@ -0,0 +1,26 @@
+export type JsonRecord = Record<string, any>
+
+export function parseJsonObject(value: unknown): JsonRecord {
+  if (!value) {
+    return {}
+  }
+
+  if (typeof value === 'object' && !Array.isArray(value)) {
+    return value as JsonRecord
+  }
+
+  try {
+    const parsed = JSON.parse(String(value || '{}'))
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {}
+  } catch {
+    return {}
+  }
+}
+
+export function parseTaskContext(task: { context_json?: unknown } | null | undefined): JsonRecord {
+  return parseJsonObject(task?.context_json)
+}
+
+export function parseTaskState(task: { state_json?: unknown } | null | undefined): JsonRecord {
+  return parseJsonObject(task?.state_json)
+}