/**
 * 隐私/机密/数据主权合约 — 常量与查找表
 *
 * 包含所有敏感模式正则、处理规则映射、禁止读取模式等常量。
 */
// ── 敏感标签的默认处理方式 ──
export const DEFAULT_HANDLING = {
    public: "allow",
    internal: "allow",
    confidential: "require_human",
    secret: "forbidden",
    credential: "forbidden",
    pii: "require_human",
    customer_data: "require_human",
    production_data: "require_human",
    unknown: "require_human",
};
// ── 上下文相关处理方式 ──
export const CONTEXT_HANDLING = {
    public: {
        prompt_injection: "allow",
        task_context_store: "allow",
        artifact_store: "allow",
        evidence_store: "allow",
        external_send: "allow",
        read_operation: "allow",
    },
    internal: {
        prompt_injection: "allow",
        task_context_store: "allow",
        artifact_store: "allow",
        evidence_store: "allow",
        external_send: "forbidden",
        read_operation: "allow",
    },
    confidential: {
        prompt_injection: "summarize_only",
        task_context_store: "redact",
        artifact_store: "redact",
        evidence_store: "redact",
        external_send: "require_human",
        read_operation: "require_human",
    },
    secret: {
        prompt_injection: "forbidden",
        task_context_store: "forbidden",
        artifact_store: "forbidden",
        evidence_store: "forbidden",
        external_send: "forbidden",
        read_operation: "forbidden",
    },
    credential: {
        prompt_injection: "forbidden",
        task_context_store: "forbidden",
        artifact_store: "forbidden",
        evidence_store: "forbidden",
        external_send: "forbidden",
        read_operation: "forbidden",
    },
    pii: {
        prompt_injection: "redact",
        task_context_store: "redact",
        artifact_store: "redact",
        evidence_store: "redact",
        external_send: "require_human",
        read_operation: "require_human",
    },
    customer_data: {
        prompt_injection: "summarize_only",
        task_context_store: "summarize_only",
        artifact_store: "summarize_only",
        evidence_store: "summarize_only",
        external_send: "require_human",
        read_operation: "require_human",
    },
    production_data: {
        prompt_injection: "summarize_only",
        task_context_store: "summarize_only",
        artifact_store: "summarize_only",
        evidence_store: "summarize_only",
        external_send: "require_human",
        read_operation: "require_human",
    },
    unknown: {
        prompt_injection: "summarize_only",
        task_context_store: "summarize_only",
        artifact_store: "summarize_only",
        evidence_store: "summarize_only",
        external_send: "require_human",
        read_operation: "require_human",
    },
};
// ── 禁止读取模式（内容读取禁止，仅允许存在性检查） ──
export const FORBIDDEN_READ_PATTERNS = [
    { pattern: /\.env($|\.)/, label: "credential", reason: ".env 文件默认禁止读取内容" },
    { pattern: /id_rsa/, label: "secret", reason: "SSH 私钥默认禁止读取" },
    { pattern: /\.pem$/, label: "secret", reason: "PEM 私钥默认禁止读取" },
    { pattern: /\.key$/, label: "secret", reason: "密钥文件默认禁止读取" },
    { pattern: /\.aws[\\/]credentials/, label: "credential", reason: "AWS 凭证默认禁止读取" },
    { pattern: /\.npmrc$/, label: "credential", reason: "npmrc 可能包含 token" },
    { pattern: /\.pypirc$/, label: "credential", reason: "PyPI 配置可能包含凭证" },
    { pattern: /kubeconfig/, label: "credential", reason: "kubeconfig 可能包含集群凭证" },
    { pattern: /\.docker[\\/]config\.json/, label: "credential", reason: "Docker 配置可能包含 registry 凭证" },
    { pattern: /tokens\.json|token_store|\.token/, label: "credential", reason: "token store 文件默认禁止读取" },
    { pattern: /cookies\.sqlite|cookies\.db|\.cookie[\\/]/, label: "secret", reason: "浏览器 cookie/session 默认禁止读取" },
    { pattern: /login\.keychain|\.keychain|\.keystore/, label: "secret", reason: "系统钥匙串默认禁止读取" },
    { pattern: /ssh[\\/]config$/i, label: "secret", reason: "SSH config 可能包含敏感主机/代理配置" },
];
// ── 需确认读取模式 ──
export const CONFIRMATION_READ_PATTERNS = [
    { pattern: /\.log$/, label: "production_data", reason: "日志文件可能包含敏感信息" },
    { pattern: /\.sql$/, label: "production_data", reason: "SQL 文件可能是数据库 dump" },
    { pattern: /\.csv$/, label: "customer_data", reason: "CSV 可能包含客户数据" },
    { pattern: /dump/, label: "production_data", reason: "dump 文件可能包含生产数据" },
    { pattern: /[\\/]export[\\/]/, label: "customer_data", reason: "export 目录可能包含客户导出数据" },
    { pattern: /figma[\\/]|notion[\\/]|drive[\\/]|slack[\\/]|github[\\/]private/, label: "confidential", reason: "私有云文档/协作平台数据需确认" },
    { pattern: /api[_-]?response|_response\.json|_result\.json/, label: "confidential", reason: "外部系统返回数据需确认" },
    { pattern: new RegExp('\\b(Users|home)\\/[\\w.-]+\\/(Desktop|Documents|Downloads|Pictures)', 's'), label: "confidential", reason: "用户 home 大范围目录需确认" },
    { pattern: /sample.*\.json|fixture.*\.json/, label: "confidential", reason: "真实 API 响应样本需确认" },
    { pattern: /\.vcf$|\. contacts$/, label: "pii", reason: "包含联系方式/PII 的文件需确认" },
];
// ── 文本内容敏感模式（用于 scanTextSensitivity） ──
export const TEXT_SECRET_PATTERNS = [
    { pattern: /sk-[a-zA-Z0-9]{32,}/, label: "secret", fields: ["api_key"] },
    { pattern: /AKIA[0-9A-Z]{16}/, label: "credential", fields: ["aws_access_key"] },
    { pattern: /aws_secret_access_key\s*=\s*['"][^'"]+['"]/, label: "credential", fields: ["aws_secret"] },
    { pattern: /password\s*=\s*['"][^'"]{4,}['"]/, label: "credential", fields: ["password"] },
    { pattern: /secret_key\s*=\s*['"][^'"]+['"]/, label: "secret", fields: ["secret_key"] },
    { pattern: /jwt_secret\s*=\s*['"][^'"]+['"]/, label: "secret", fields: ["jwt_secret"] },
    { pattern: /1[3-9]\d{9}/, label: "pii", fields: ["phone"] },
    { pattern: /[\w.+-]+@[\w-]+\.[\w.]+/, label: "pii", fields: ["email"] },
    { pattern: /\b\d{17}[\dXx]\b/, label: "pii", fields: ["id_number"] },
    // 生产数据模式
    { pattern: /production\.log|prod-\w+\.\w+|\bproduction\s+data\b/i, label: "production_data", fields: ["production_log"] },
    { pattern: /SELECT\s+.{1,}?\s+FROM\s+/is, label: "production_data", fields: ["sql_query"] },
    { pattern: /database\s+dump|db\s+dump|\bdb_dump\b/i, label: "production_data", fields: ["database_dump"] },
    { pattern: /API\s+Response:\s*\{/i, label: "production_data", fields: ["api_response"] },
    // 客户数据模式
    { pattern: /email,\s*phone,\s*name|name,\s*email,\s*phone/i, label: "customer_data", fields: ["customer_csv"] },
    { pattern: /user_id["']?\s*:\s*\d+.*["']?email["']?\s*:/i, label: "customer_data", fields: ["user_export"] },
    { pattern: /customer.*export|export.*customer/i, label: "customer_data", fields: ["customer_export"] },
];
//# sourceMappingURL=privacy_patterns.js.map