/**
 * Best-effort scrubber for secrets pasted into prompts, search queries, and
 * other user-supplied text that ends up in audit logs. Replaces matched
 * patterns with `[REDACTED]` so we don't store live keys/tokens in plain
 * `details` JSON.
 *
 * This is defensive, not exhaustive — clients should never paste secrets
 * into prompts in the first place. The patterns favour false negatives over
 * false positives so we don't mangle legitimate content.
 */
const PATTERNS = [
    // OpenAI / Anthropic / Google API keys
    { name: 'openai-key', regex: /\bsk-[A-Za-z0-9_-]{20,}\b/g },
    { name: 'anthropic-key', regex: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g },
    // Actuate API keys
    { name: 'actuate-key', regex: /\bact_[A-Za-z0-9_]{20,}\b/g },
    // GitHub tokens
    { name: 'github-token', regex: /\bgh[opsu]_[A-Za-z0-9]{30,}\b/g },
    // AWS access keys
    { name: 'aws-access-key', regex: /\bAKIA[0-9A-Z]{16}\b/g },
    // AWS secret access keys (40 char base64-ish, prefixed with common context words)
    {
        name: 'aws-secret',
        regex: /\b(?:aws_secret_access_key|aws_secret|secret_key)\s*[:=]\s*["']?([A-Za-z0-9/+]{40})["']?/gi,
    },
    // JWTs (3 base64url segments)
    { name: 'jwt', regex: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g },
    // Slack tokens
    { name: 'slack-token', regex: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
    // Stripe keys
    { name: 'stripe-key', regex: /\b(?:sk|pk|rk)_(?:test|live)_[A-Za-z0-9]{20,}\b/g },
    // Generic password assignment
    { name: 'password-assign', regex: /\b(?:password|passwd|pwd)\s*[:=]\s*["']([^"']{6,})["']/gi },
];
export function redactSecrets(input) {
    if (!input)
        return input;
    let result = input;
    for (const { regex } of PATTERNS) {
        result = result.replace(regex, '[REDACTED]');
    }
    return result;
}
//# sourceMappingURL=redact.js.map