const SECRET_CREDENTIAL_FIELD_TYPES = /* @__PURE__ */ new Set([
  "secret",
  "oauth",
  "ssh_keypair"
]);
const MASKED_SECRET_VALUE = "__om_secret_unchanged__";
function isSecretField(type) {
  return SECRET_CREDENTIAL_FIELD_TYPES.has(type);
}
function redactUrlUserinfo(value) {
  if (typeof value !== "string") return value;
  try {
    const parsed = new URL(value);
    if (!parsed.username && !parsed.password) return value;
    parsed.username = "";
    parsed.password = "";
    return parsed.toString();
  } catch {
    return value;
  }
}
function hasPresentValue(value) {
  if (value === void 0 || value === null) return false;
  if (typeof value === "string") return value.length > 0;
  if (typeof value === "object") return Object.keys(value).length > 0;
  return true;
}
function maskSecretCredentials(schema, values) {
  const credentials = { ...values };
  const secretFieldsConfigured = {};
  for (const field of schema?.fields ?? []) {
    if (field.type === "url") {
      credentials[field.key] = redactUrlUserinfo(credentials[field.key]);
      continue;
    }
    if (!isSecretField(field.type)) continue;
    const configured = hasPresentValue(credentials[field.key]);
    secretFieldsConfigured[field.key] = configured;
    if (configured) {
      credentials[field.key] = MASKED_SECRET_VALUE;
    } else {
      delete credentials[field.key];
    }
  }
  return { credentials, secretFieldsConfigured };
}
function mergeMaskedSecretCredentials(schema, incoming, existing) {
  const merged = { ...incoming };
  for (const field of schema?.fields ?? []) {
    if (!isSecretField(field.type)) continue;
    if (merged[field.key] !== MASKED_SECRET_VALUE) continue;
    if (hasPresentValue(existing[field.key])) {
      merged[field.key] = existing[field.key];
    } else {
      delete merged[field.key];
    }
  }
  return merged;
}
export {
  MASKED_SECRET_VALUE,
  SECRET_CREDENTIAL_FIELD_TYPES,
  maskSecretCredentials,
  mergeMaskedSecretCredentials
};
//# sourceMappingURL=credentials-masking.js.map
