// engine/audit-trail/formatter.ts — Builds AuditTrailEntry records for SPEC-387
import { randomUUID } from 'node:crypto';
/** Maximum length of the sanitized inputSummary field. */
const INPUT_SUMMARY_MAX = 200;
/**
 * Patterns that look like secret tokens/keys in serialized args.
 * Replaces the value with [REDACTED] to prevent credential leakage.
 */
const SECRET_PATTERN = /(token|key|secret|password|auth)["']?\s*[:=]\s*["'][^"']{4,}/gi;
/**
 * Build a partial AuditTrailEntry (without the `hash` field) from a tool invocation.
 * The caller must compute and attach `hash` via `hashEntry()` before storing.
 */
export function buildAuditEntry(params) {
    const raw = JSON.stringify(params.args ?? {}).slice(0, INPUT_SUMMARY_MAX);
    const sanitized = raw.replace(SECRET_PATTERN, '[REDACTED]');
    return {
        id: randomUUID(),
        timestamp: new Date().toISOString(),
        toolName: params.toolName,
        inputSummary: sanitized,
        outputType: params.outputType,
        durationMs: params.durationMs,
        specId: extractSpecId(params.args),
        projectPath: extractProjectPath(params.args),
        prevHash: params.prevHash,
    };
}
function extractSpecId(args) {
    if (typeof args === 'object' && args !== null && 'specId' in args) {
        const val = args.specId;
        return typeof val === 'string' ? val : undefined;
    }
    return undefined;
}
function extractProjectPath(args) {
    if (typeof args === 'object' && args !== null && 'projectPath' in args) {
        const val = args.projectPath;
        return typeof val === 'string' ? val : undefined;
    }
    return undefined;
}
//# sourceMappingURL=formatter.js.map