/**
 * Pure JSON serialiser for `olam keys --json`.
 *
 * Kept separate from the command action so the wire contract is
 * unit-testable without a filesystem round-trip (mirrors the pattern
 * used by `auth-list-json.ts`, `repos-list-json.ts`, and
 * `servicesStatusJson` in services.ts).
 *
 * WHY this exists: agent/script drivers (CI pipelines, Rico, flywheel
 * chain skills) need to discover which LLM API keys are configured before
 * spawning worlds that rely on them. The human table is colorized and
 * already applies redaction for display; this serialiser gives drivers a
 * stable, color-free array with the same redaction contract.
 *
 * Secret redaction: key VALUES are sensitive (e.g. `sk-proj-...` for
 * OpenAI, provider tokens, etc.). The serialiser ALWAYS emits redacted
 * values — same `first-8-chars + "..."` convention used by the human
 * renderer — so `olam keys --json` is safe to pipe to CI logs, agent
 * reasoning traces, or Rico digests without leaking secrets.
 *
 * The key NAMES are not secrets (e.g. "OPENAI", "ANTHROPIC") — they are
 * emitted verbatim to let drivers check which providers are configured.
 */
/**
 * Redact a secret value: keep first 8 chars, replace the rest with "...".
 * Matches the `redact()` helper in keys.ts — deliberately inline so the
 * serialiser has no runtime dependency on the command module.
 */
export function redactKeyValue(value) {
    if (value.length <= 8)
        return value + '...';
    return value.slice(0, 8) + '...';
}
/**
 * Serialise the keys map to the stable `--json` wire shape.
 * Accepts null (no file / empty file) and returns an empty payload.
 * Returns a JSON string (no trailing newline — caller adds it).
 */
export function renderKeysListJson(keys) {
    if (!keys) {
        const payload = { count: 0, keys: [] };
        return JSON.stringify(payload);
    }
    const rows = Object.entries(keys).map(([name, value]) => ({
        name,
        redactedValue: redactKeyValue(value),
    }));
    const payload = {
        count: rows.length,
        keys: rows,
    };
    return JSON.stringify(payload);
}
//# sourceMappingURL=keys-list-json.js.map