// engine/runtime-security/checkers/sensitive-data.ts — SPEC-084 AC-08
// Detects PII, API keys, passwords, and private keys in tool inputs.
const SENSITIVE_PATTERNS = [
    // PII
    { name: 'email', regex: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g, category: 'pii' },
    { name: 'phone', regex: /(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}/g, category: 'pii' },
    { name: 'ssn', regex: /\b\d{3}-\d{2}-\d{4}\b/g, category: 'pii' },
    { name: 'ip-address', regex: /\b(?:\d{1,3}\.){3}\d{1,3}\b/g, category: 'pii' },
    // API Keys
    { name: 'aws-key', regex: /AKIA[0-9A-Z]{16}/g, category: 'secret' },
    { name: 'gcp-key', regex: /AIza[0-9A-Za-z_-]{35}/g, category: 'secret' },
    { name: 'openai-key', regex: /sk-[a-zA-Z0-9]{20,}/g, category: 'secret' },
    { name: 'anthropic-key', regex: /sk-ant-[a-zA-Z0-9]{20,}/g, category: 'secret' },
    { name: 'github-token', regex: /gh[pousr]_[A-Za-z0-9_]{36,}/g, category: 'secret' },
    { name: 'stripe-key', regex: /sk_(?:live|test)_[A-Za-z0-9]{24,}/g, category: 'secret' },
    { name: 'azure-key', regex: /[a-zA-Z0-9/+=]{44}/g, category: 'secret' },
    // Passwords and tokens in plaintext
    {
        name: 'password-field',
        regex: /(?:password|passwd|pwd|secret|token)\s*[=:]\s*\S+/gi,
        category: 'secret',
    },
    {
        name: 'private-key',
        regex: /-----BEGIN (?:RSA |EC |DSA )?PRIVATE KEY-----/g,
        category: 'secret',
    },
    // URLs with embedded credentials
    {
        name: 'credential-url',
        regex: /https?:\/\/[^:\s]+:[^@\s]+@[^\s]+/g,
        category: 'credential-url',
    },
];
function checkStringForSensitiveData(value, field) {
    const threats = [];
    for (const pattern of SENSITIVE_PATTERNS) {
        // Reset regex lastIndex
        pattern.regex.lastIndex = 0;
        if (pattern.regex.test(value)) {
            threats.push({
                type: 'sensitive-data',
                severity: 'warning',
                message: `Sensitive data detected: ${pattern.name} (${pattern.category})`,
                field,
                pattern: pattern.name,
            });
        }
    }
    return threats;
}
export const sensitiveDataChecker = {
    type: 'sensitive-data',
    check(_toolName, inputs, _config) {
        const threats = [];
        for (const [key, value] of Object.entries(inputs)) {
            if (typeof value === 'string' && value.length > 5) {
                threats.push(...checkStringForSensitiveData(value, key));
            }
            if (Array.isArray(value)) {
                for (const item of value) {
                    if (typeof item === 'string' && item.length > 5) {
                        threats.push(...checkStringForSensitiveData(item, key));
                    }
                }
            }
        }
        return threats;
    },
};
//# sourceMappingURL=sensitive-data.js.map