const MAX_LINE_LENGTH = 2000;
const MAX_CLIENT_LOGS = 200;
const REDACTIONS = [
    // Bearer / Basic auth headers
    { pattern: /\b(Bearer|Basic)\s+[A-Za-z0-9._\-+/=]{8,}/gi, replace: "$1 <redacted>" },
    // Authorization: header value
    { pattern: /(authorization"?\s*[:=]\s*"?)([^",\s]{8,})/gi, replace: "$1<redacted>" },
    // Key/token/secret in KEY=value, "key":"value", key: value (JSON + env style)
    {
        pattern: /((?:api[_-]?key|access[_-]?token|secret|password|passwd|github[_-]?token|auth[_-]?token|session[_-]?id|cookie|refresh[_-]?token|client[_-]?secret)"?\s*[:=]\s*"?)([^",\s}]{4,})/gi,
        replace: "$1<redacted>",
    },
    // GitHub tokens
    { pattern: /\bgh[pousr]_[A-Za-z0-9]{20,}/g, replace: "<redacted-gh-token>" },
    // Generic high-entropy *_KEY / *_TOKEN env-style values
    {
        pattern: /\b([A-Z][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD))=([^\s"]{4,})/g,
        replace: "$1=<redacted>",
    },
    // JWT (3 dot-separated base64url segments)
    {
        pattern: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g,
        replace: "<redacted-jwt>",
    },
    // Emails (except the reporter's — reporter is handled separately upstream)
    {
        pattern: /\b([A-Za-z0-9_.+-]{1,3})[A-Za-z0-9_.+-]*(@[A-Za-z0-9.-]+\.[A-Za-z]{2,})/g,
        replace: "$1***$2",
    },
    // macOS / Linux user home paths
    { pattern: /\/Users\/[^/\s"']+/g, replace: "/Users/<user>" },
    { pattern: /\/home\/[^/\s"']+/g, replace: "/home/<user>" },
    // Windows user path
    { pattern: /C:\\Users\\[^\\\s"']+/g, replace: "C:\\Users\\<user>" },
];
function redactString(raw) {
    let out = raw;
    for (const { pattern, replace } of REDACTIONS) {
        out = out.replace(pattern, replace);
    }
    if (out.length > MAX_LINE_LENGTH) {
        out = out.slice(0, MAX_LINE_LENGTH) + "…[truncated]";
    }
    return out;
}
export function redactLogLine(msg) {
    return redactString(msg);
}
export function redactClientLogs(logs) {
    if (!logs)
        return undefined;
    const tail = logs.slice(-MAX_CLIENT_LOGS);
    return tail.map((l) => ({ level: l.level, ts: l.ts, msg: redactString(l.msg) }));
}
export function redactDaemonLogTail(tail) {
    if (!tail)
        return undefined;
    return tail
        .split("\n")
        .map((line) => redactString(line))
        .join("\n");
}
//# sourceMappingURL=bug-report-redact.js.map