const MAX_LINE_LENGTH = 2000;
const MAX_CLIENT_LOGS = 200;
const REDACTIONS = [
    // URL userinfo: `scheme://user:pass@host…` — strip both user and pass
    // entirely. Must run before the email rule, otherwise `user:pass@` would
    // be partially absorbed as an email-like token (leaving `user` and the
    // password's leading characters visible). `bun install` stderr quotes
    // the active registry verbatim, so a corp Nexus mirror configured with
    // basic auth would otherwise leak credentials here.
    {
        pattern: /(\b[a-z][a-z0-9+.\-]*:\/\/)[^/\s"'@]+@/gi,
        replace: "$1<redacted>@",
    },
    // Bearer / Basic auth headers
    { pattern: /\b(Bearer|Basic)\s+[A-Za-z0-9._\-+/=]{8,}/gi, replace: "$1 <redacted>" },
    // Authorization: header value
    { pattern: /(authorization"?\s*[:=]\s*"?)([^",\s]{8,})/gi, replace: "$1<redacted>" },
    // Key/token/secret in KEY=value, "key":"value", key: value (JSON + env style)
    {
        pattern: /((?:api[_-]?key|access[_-]?token|secret|password|passwd|github[_-]?token|auth[_-]?token|session[_-]?id|cookie|refresh[_-]?token|client[_-]?secret)"?\s*[:=]\s*"?)([^",\s}]{4,})/gi,
        replace: "$1<redacted>",
    },
    // GitHub tokens
    { pattern: /\bgh[pousr]_[A-Za-z0-9]{20,}/g, replace: "<redacted-gh-token>" },
    // Generic high-entropy *_KEY / *_TOKEN env-style values
    {
        pattern: /\b([A-Z][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD))=([^\s"]{4,})/g,
        replace: "$1=<redacted>",
    },
    // JWT (3 dot-separated base64url segments)
    {
        pattern: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g,
        replace: "<redacted-jwt>",
    },
    // Emails (except the reporter's — reporter is handled separately upstream)
    {
        pattern: /\b([A-Za-z0-9_.+-]{1,3})[A-Za-z0-9_.+-]*(@[A-Za-z0-9.-]+\.[A-Za-z]{2,})/g,
        replace: "$1***$2",
    },
    // macOS / Linux user home paths
    { pattern: /\/Users\/[^/\s"']+/g, replace: "/Users/<user>" },
    { pattern: /\/home\/[^/\s"']+/g, replace: "/home/<user>" },
    // Windows user path
    { pattern: /C:\\Users\\[^\\\s"']+/g, replace: "C:\\Users\\<user>" },
];
function redactString(raw) {
    let out = raw;
    for (const { pattern, replace } of REDACTIONS) {
        out = out.replace(pattern, replace);
    }
    if (out.length > MAX_LINE_LENGTH) {
        out = out.slice(0, MAX_LINE_LENGTH) + "…[truncated]";
    }
    return out;
}
export function redactLogLine(msg) {
    return redactString(msg);
}
export function redactClientLogs(logs) {
    if (!logs)
        return undefined;
    const tail = logs.slice(-MAX_CLIENT_LOGS);
    return tail.map((l) => ({ level: l.level, ts: l.ts, msg: redactString(l.msg) }));
}
export function redactDaemonLogTail(tail) {
    if (!tail)
        return undefined;
    return tail
        .split("\n")
        .map((line) => redactString(line))
        .join("\n");
}
/**
 * Sanitize each free-text field of an install attempt before sending to
 * bug-intake. `stderrTail` from `bun install` regularly carries the active
 * registry URL (which on corp networks may include `https://user:pass@host`),
 * and `cmd` / `args` may surface user-home paths. We run them through the
 * same redaction the daemon uses for client/daemon logs.
 */
export function redactDesktopInstallAttempts(attempts) {
    if (!attempts)
        return undefined;
    return attempts.map((a) => ({
        ts: a.ts,
        agent: a.agent,
        cmd: redactString(a.cmd),
        args: a.args.map((arg) => redactString(arg)),
        code: a.code,
        reason: a.reason,
        stderrTail: redactString(a.stderrTail),
        spawnError: a.spawnError ? redactString(a.spawnError) : undefined,
    }));
}
//# sourceMappingURL=bug-report-redact.js.map