import { basename } from 'node:path';
const SENSITIVE_PATH_SEGMENTS = new Set([
    '.ssh',
    '.aws',
    '.gnupg',
    '.kube',
    '.docker',
    'secrets',
    'credentials',
]);
const SENSITIVE_FILE_PATTERNS = [
    /^\.env(?:\.|$)/i,
    /^\.npmrc$/i,
    /(?:secret|credential|password|token|private[-_]?key|api[-_]?key)/i,
    /\.(?:p12|pfx|pem|key)$/i,
];
const PRESERVE_PATTERNS = [
    { label: 'spec-id', pattern: /\bSPEC-\d+\b/g },
    { label: 'acceptance-criteria', pattern: /^-\s*\[[ xX]\]\s+.+$/gm },
    { label: 'fenced-code', pattern: /```[\s\S]*?```|~~~[\s\S]*?~~~/g },
    { label: 'inline-code', pattern: /`[^`\n]+`/g },
    { label: 'url', pattern: /\bhttps?:\/\/[^\s)]+/g },
    { label: 'file-path', pattern: /\b[\w.-]+(?:\/[\w.-]+)+\.[A-Za-z0-9]+\b/g },
    { label: 'command', pattern: /\b(?:pnpm|npm|bun|node|git|gh|npx|tsx|tsc)\s+[^\n]+/g },
    { label: 'hash', pattern: /\b[a-f0-9]{32,64}\b/gi },
    {
        label: 'validation-failure',
        pattern: /\b(?:error|failed|failure|blocked|validate|validation)\b[^\n]*/gi,
    },
    { label: 'approval-request', pattern: /\b(?:approve|approval|approved|forceApprove)\b[^\n]*/gi },
    {
        label: 'security-warning',
        pattern: /\b(?:security|secret|credential|token|password|destructive)\b[^\n]*/gi,
    },
];
export function getSensitivePathRefusal(path) {
    const normalized = path.replace(/\\/g, '/');
    const segments = normalized.split('/').filter(Boolean);
    if (segments.some((segment) => SENSITIVE_PATH_SEGMENTS.has(segment.toLowerCase()))) {
        return `Refusing sensitive path segment in ${path}`;
    }
    const fileName = basename(normalized);
    if (SENSITIVE_FILE_PATTERNS.some((pattern) => pattern.test(fileName))) {
        return `Refusing sensitive file name ${path}`;
    }
    return null;
}
export function collectPreservedFragments(content) {
    const fragments = new Map();
    for (const { label, pattern } of PRESERVE_PATTERNS) {
        const matches = [...content.matchAll(pattern)].map((match) => match[0]);
        if (matches.length > 0) {
            fragments.set(label, [...new Set(matches)]);
        }
    }
    return fragments;
}
export function verifyPreservedFragments(original, candidate) {
    const fragments = collectPreservedFragments(original);
    const checks = [];
    for (const [label, values] of fragments.entries()) {
        for (const value of values) {
            if (!candidate.includes(value)) {
                return { ok: false, checks: [`missing:${label}:${value.slice(0, 80)}`] };
            }
        }
        checks.push(label);
    }
    return { ok: true, checks };
}
export function shouldBypassLeanMode(flow) {
    return /\b(security|validation|validate|approval|approved|release|destructive|delete|rollback|force)\b/i.test(flow);
}
//# sourceMappingURL=compression-guards.js.map