//#region extensions/crypto/src/services/credential-vault.ts
const SECRET_REGISTRY = {
	"wallet.privateKey": {
		envVar: "CLAWNCHER_PRIVATE_KEY",
		description: "Wallet private key for auto-signing",
		sensitive: "critical"
	},
	"wallet.keychainMnemonic": {
		envVar: "CLAWNCHER_WALLET_PASSWORD",
		description: "Password for Keychain-encrypted wallet mnemonic",
		sensitive: "critical"
	},
	"walletconnect.projectId": {
		envVar: "WALLETCONNECT_PROJECT_ID",
		description: "WalletConnect cloud project ID",
		sensitive: "high"
	},
	"bankr.apiKey": {
		envVar: "BANKR_API_KEY",
		description: "Bankr Agent API key",
		sensitive: "high"
	},
	"dex.0x.apiKey": {
		envVar: "ZEROX_API_KEY",
		description: "0x DEX aggregator API key",
		sensitive: "high"
	},
	"dex.1inch.apiKey": {
		envVar: "ONEINCH_API_KEY",
		description: "1inch DEX aggregator API key",
		sensitive: "high"
	},
	"bridge.lifi.apiKey": {
		envVar: "LIFI_API_KEY",
		description: "LI.FI bridge aggregator API key",
		sensitive: "high"
	},
	"rpc.alchemy.apiKey": {
		envVar: "ALCHEMY_API_KEY",
		description: "Alchemy RPC provider API key",
		sensitive: "medium"
	},
	"price.coingecko.apiKey": {
		envVar: "COINGECKO_API_KEY",
		description: "CoinGecko price feed API key",
		sensitive: "medium"
	},
	"price.cmc.apiKey": {
		envVar: "CMC_API_KEY",
		description: "CoinMarketCap price feed API key",
		sensitive: "medium"
	},
	"price.birdeye.apiKey": {
		envVar: "BIRDEYE_API_KEY",
		description: "Birdeye price feed API key",
		sensitive: "medium"
	},
	"explorer.basescan.apiKey": {
		envVar: "BASESCAN_API_KEY",
		description: "Basescan block explorer API key",
		sensitive: "medium"
	},
	"explorer.etherscan.apiKey": {
		envVar: "ETHERSCAN_API_KEY",
		description: "Etherscan block explorer API key",
		sensitive: "medium"
	},
	"intel.herd.accessToken": {
		envVar: "HERD_ACCESS_TOKEN",
		description: "Herd Intelligence access token",
		sensitive: "medium"
	},
	"social.x.apiKey": {
		envVar: "X_API_KEY",
		description: "X/Twitter API key",
		sensitive: "high"
	},
	"social.x.apiSecret": {
		envVar: "X_API_SECRET",
		description: "X/Twitter API secret",
		sensitive: "high"
	},
	"social.x.accessToken": {
		envVar: "X_ACCESS_TOKEN",
		description: "X/Twitter access token",
		sensitive: "high"
	},
	"social.x.accessTokenSecret": {
		envVar: "X_ACCESS_TOKEN_SECRET",
		description: "X/Twitter access token secret",
		sensitive: "high"
	},
	"llm.anthropic.apiKey": {
		envVar: "ANTHROPIC_API_KEY",
		description: "Anthropic LLM API key",
		sensitive: "high"
	},
	"llm.bankr.key": {
		envVar: "BANKR_LLM_KEY",
		description: "Bankr LLM gateway key",
		sensitive: "high"
	},
	"llm.openrouter.apiKey": {
		envVar: "OPENROUTER_API_KEY",
		description: "OpenRouter LLM API key",
		sensitive: "high"
	},
	"llm.openai.apiKey": {
		envVar: "OPENAI_API_KEY",
		description: "OpenAI LLM API key",
		sensitive: "high"
	},
	"deploy.fly.apiToken": {
		envVar: "FLY_API_TOKEN",
		description: "Fly.io deployment API token",
		sensitive: "high"
	},
	"bot.molten.apiKey": {
		envVar: "MOLTEN_API_KEY",
		description: "Molten agent matching API key",
		sensitive: "medium"
	},
	"bot.wayfinder.apiKey": {
		envVar: "WAYFINDER_API_KEY",
		description: "Wayfinder routing API key",
		sensitive: "medium"
	},
	"clawnch.apiKey": {
		envVar: "CLAWNCH_API_KEY",
		description: "Clawnch platform API key",
		sensitive: "high"
	},
	"clawnch.launcherApiKey": {
		envVar: "CLAWNCHER_API_KEY",
		description: "Clawnch token launcher API key",
		sensitive: "high"
	},
	"bot.hummingbot.username": {
		envVar: "HUMMINGBOT_USERNAME",
		description: "Hummingbot gateway username",
		sensitive: "high"
	},
	"bot.hummingbot.password": {
		envVar: "HUMMINGBOT_PASSWORD",
		description: "Hummingbot gateway password",
		sensitive: "critical"
	},
	"bot.telegram.botToken": {
		envVar: "TELEGRAM_BOT_TOKEN",
		description: "Telegram bot API token",
		sensitive: "high"
	},
	"nft.reservoir.apiKey": {
		envVar: "RESERVOIR_API_KEY",
		description: "Reservoir NFT API key (free tier: 4 req/sec)",
		sensitive: "medium"
	},
	"social.neynar.apiKey": {
		envVar: "NEYNAR_API_KEY",
		description: "Neynar Farcaster API key",
		sensitive: "high"
	},
	"social.neynar.signerUuid": {
		envVar: "NEYNAR_SIGNER_UUID",
		description: "Neynar managed signer UUID (write operations)",
		sensitive: "high"
	}
};
var CredentialVault = class {
	accessLog = [];
	MAX_LOG_SIZE = 1e3;
	/**
	* Get a secret value by its logical name.
	* Returns null if not configured.
	*/
	getSecret(name, tool) {
		const entry = SECRET_REGISTRY[name];
		if (!entry) return null;
		const value = process.env[entry.envVar] ?? null;
		this.logAccess(name, tool);
		return value;
	}
	/**
	* Check if a secret is configured (without revealing its value).
	*/
	hasSecret(name) {
		const entry = SECRET_REGISTRY[name];
		if (!entry) return false;
		return !!process.env[entry.envVar];
	}
	/**
	* Get the raw env var for a logical secret name.
	* Use this only when you need to pass the env var name (not value) to something.
	*/
	getEnvVarName(name) {
		return SECRET_REGISTRY[name]?.envVar ?? null;
	}
	/**
	* Scan text for credential leaks.
	* Returns a result with any detected leaks and a redacted version of the text.
	*/
	scanForLeaks(text) {
		const leaks = [];
		let redacted = text;
		for (const [name, entry] of Object.entries(SECRET_REGISTRY)) {
			const value = process.env[entry.envVar];
			if (!value || value.length < 8) continue;
			const idx = text.indexOf(value);
			if (idx !== -1) {
				leaks.push({
					type: `secret:${name}`,
					pattern: `${entry.envVar} value`,
					position: idx
				});
				redacted = redacted.replaceAll(value, `[REDACTED:${entry.envVar}]`);
			}
		}
		const LEAK_PATTERNS = [
			{
				type: "private_key",
				regex: /\b(0x)?[0-9a-fA-F]{64}\b/g
			},
			{
				type: "wc_secret",
				regex: /wc:[0-9a-f]{32}@/gi
			},
			{
				type: "api_key_pattern",
				regex: /\b(sk-|bk_|xai-|pk_|sk_live_|rk_live_)[a-zA-Z0-9_\-]{20,}\b/g
			},
			{
				type: "bip39_mnemonic",
				regex: /\b([a-zA-Z]{3,8}\s+){11,}[a-zA-Z]{3,8}\b/gi
			}
		];
		const patternMatches = [];
		for (const { type, regex } of LEAK_PATTERNS) {
			let match;
			regex.lastIndex = 0;
			while ((match = regex.exec(text)) !== null) {
				if (leaks.some((l) => l.position === match.index)) continue;
				if (type === "private_key") {
					const hexPart = match[0].replace(/^0x/, "");
					if (new Set(hexPart.toLowerCase().split("")).size < 8) continue;
					if (/^0{24}[0-9a-fA-F]{40}$/.test(hexPart)) continue;
					const contextStart = Math.max(0, match.index - 80);
					const contextEnd = Math.min(text.length, match.index + match[0].length + 80);
					const surrounding = text.slice(contextStart, contextEnd);
					const DANGER_CONTEXT = /\b(private\s*key|secret\s*key|priv\s*key|mnemonic|seed\s*phrase|signing\s*key|wallet\s*key|export\s*key|my\s*key|your\s*key)\b/i;
					const SAFE_CONTEXT = /\b(tx|transaction|hash|block|receipt|data|calldata|input|encoded|abi|selector|topics|event|log|proof|merkle|root|salt|create2|slot|storage|token[_\s]?id|nft|signature|sig\b|nonce|commitment|returndata|output|result|param|arg|swap|transfer|balance|0x[0-9a-fA-F]{40})\b/i;
					if (!DANGER_CONTEXT.test(surrounding)) continue;
					if (SAFE_CONTEXT.test(surrounding)) continue;
				}
				patternMatches.push({
					type,
					matchStr: match[0],
					index: match.index
				});
			}
		}
		patternMatches.sort((a, b) => b.index - a.index);
		for (const pm of patternMatches) {
			leaks.push({
				type: pm.type,
				pattern: pm.matchStr.slice(0, 20) + "...",
				position: pm.index
			});
			redacted = redacted.slice(0, pm.index) + `[REDACTED:${pm.type}]` + redacted.slice(pm.index + pm.matchStr.length);
		}
		return {
			clean: leaks.length === 0,
			leaks,
			redactedText: redacted
		};
	}
	/**
	* Get recent access log entries (for diagnostics).
	*/
	getAccessLog(limit = 50) {
		return this.accessLog.slice(-limit);
	}
	/**
	* Get a summary of configured vs unconfigured secrets.
	*/
	getConfigurationSummary() {
		return Object.entries(SECRET_REGISTRY).map(([name, entry]) => ({
			name,
			envVar: entry.envVar,
			description: entry.description,
			configured: !!process.env[entry.envVar],
			sensitive: entry.sensitive
		}));
	}
	logAccess(key, tool) {
		this.accessLog.push({
			key,
			tool,
			timestamp: Date.now()
		});
		if (this.accessLog.length > this.MAX_LOG_SIZE) this.accessLog = this.accessLog.slice(-this.MAX_LOG_SIZE / 2);
	}
};
let _instance = null;
function getCredentialVault() {
	if (!_instance) _instance = new CredentialVault();
	return _instance;
}
//#endregion
export { getCredentialVault as t };

//# sourceMappingURL=credential-vault-UHPbPQ5Y.mjs.map