/**
 * Redactor — scrubs live credential values from any text that might be logged
 * or echoed back to the user / LLM.
 *
 * Usage: the store registers every active secret string; any output routed
 * through `redact()` has those substrings replaced with "[REDACTED]".
 */
const active = new Set();
/** Register a live secret. Ignores empty strings. */
export function trackSecret(s) {
    if (!s || s.length < 3)
        return;
    active.add(s);
}
/** Release a secret (call when the handle is forgotten). */
export function untrackSecret(s) {
    active.delete(s);
}
/** Replace every tracked secret in `text` with "[REDACTED]". */
export function redact(text) {
    if (!text)
        return text;
    let out = text;
    for (const secret of active) {
        if (!secret)
            continue;
        // Global, exact replacement. Not regex — secrets may contain special chars.
        let idx = out.indexOf(secret);
        while (idx !== -1) {
            out = out.slice(0, idx) + "[REDACTED]" + out.slice(idx + secret.length);
            idx = out.indexOf(secret, idx + "[REDACTED]".length);
        }
    }
    return out;
}
export function _clearAllForTesting() {
    active.clear();
}
//# sourceMappingURL=redactor.js.map