import {
  listEntries
} from "./chunk-JU6ELMEH.js";
import {
  getConfig
} from "./chunk-2MAQ6JFL.js";

// src/observability/redactor.ts
var REDACTED = "[REDACTED]";
var MIN_SECRET_LEN = 4;
function collectSecrets() {
  const cfg = getConfig();
  const secrets = [];
  const push = (v) => {
    if (v && v.length >= MIN_SECRET_LEN) secrets.push(v);
  };
  push(cfg.anthropicApiKey);
  push(cfg.claudeToken);
  push(cfg.openAiApiKey);
  push(cfg.geminiApiKey);
  push(cfg.factoryApiKey);
  push(cfg.spriteToken);
  for (const key of cfg.redactEnvKeys) {
    push(process.env[key]);
  }
  return secrets;
}
var cachedProcessSecrets = null;
function getProcessSecrets() {
  if (cachedProcessSecrets == null) {
    cachedProcessSecrets = collectSecrets();
  }
  return cachedProcessSecrets;
}
function invalidateRedactorCache() {
  cachedProcessSecrets = null;
}
var vaultSecrets = /* @__PURE__ */ new Set();
function seedVaultSecrets(vaultId) {
  try {
    const entries = listEntries(vaultId);
    for (const e of entries) {
      if (e.value && e.value.length >= MIN_SECRET_LEN) vaultSecrets.add(e.value);
    }
  } catch {
  }
}
function resetVaultSecrets() {
  vaultSecrets.clear();
}
function scrub(value, secrets) {
  if (value == null) return value;
  if (typeof value === "string") {
    let out = value;
    for (const s of secrets) {
      if (out.includes(s)) {
        out = out.split(s).join(REDACTED);
      }
    }
    return out;
  }
  if (Array.isArray(value)) {
    return value.map((v) => scrub(v, secrets));
  }
  if (typeof value === "object") {
    const out = {};
    for (const [k, v] of Object.entries(value)) {
      out[k] = scrub(v, secrets);
    }
    return out;
  }
  return value;
}
function redactAppendInput(input) {
  const secrets = [...getProcessSecrets(), ...vaultSecrets];
  if (secrets.length === 0) return input;
  const scrubbedPayload = scrub(input.payload, secrets);
  if (scrubbedPayload === input.payload) return input;
  return { ...input, payload: scrubbedPayload };
}

export {
  invalidateRedactorCache,
  seedVaultSecrets,
  resetVaultSecrets,
  redactAppendInput
};
