Jj dZddlmZddlZddlmZddlmZmZedGdd Z edGd d Z Gd d Z gdZ y)zGLocal heuristic PII/secret redaction for text entering persistent data.) annotationsN) dataclass)AuditEventTypeAuditLogT)frozenc"eZdZUded<ded<y)PrivacyFindingstrcategoryintcountN)__name__ __module__ __qualname____annotations__Q/home/oem/CyberBrain26-unified/src/cyberbrain26/security_plane/privacy_gateway.pyr r s M Jrr c4eZdZUded<ded<eddZy) PrivacyResultr textztuple[PrivacyFinding, ...]findingsc,t|jSN)boolr)selfs rredactedzPrivacyResult.redactedsDMM""rN)returnr)rrrrpropertyrrrrrrs I(( ##rrceZdZUdZdej ddfdej ddfdej dd fd ej d d ffZd ed<ddddZddddZ y)PrivacyGatewayzDetect and redact common text PII and secret patterns locally. This deterministic filter is a privacy aid, not complete PII detection. It records categories and counts without copying matched source values into audit events. secret_assignmentz](?i)\b(password|passwd|secret|api[_-]?key|token|authorization)\s*[:=]\s*(['\"]?)[^\s,'\";]+\2z[REDACTED:SECRET] api_tokenzC\b(?:ghp_[A-Za-z0-9]{20,}|sk-[A-Za-z0-9_-]{20,}|AKIA[A-Z0-9]{16})\bemailz-(?i)\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\bz[REDACTED:EMAIL]phonez!(?rFseM" !F $  $###7G7Gt @r