const SECRET_KEY = /(api[_-]?key|token|secret|password|authorization|cookie|credential|refresh|access[_-]?token|session[_-]?token|private[_-]?key|reasoning[_-]?encrypted[_-]?content|encrypted[_-]?content)/i;
const SECRET_VALUE_PATTERNS = [
    [/\bsk-[a-zA-Z0-9_-]{16,}\b/g, "[OPENAI_KEY_REDACTED]"],
    [/\bBearer\s+[a-zA-Z0-9._-]+\b/g, "Bearer [TOKEN_REDACTED]"],
    [/\bghp_[a-zA-Z0-9_]{16,}\b/g, "[GITHUB_TOKEN_REDACTED]"],
    [/\bgithub_pat_[a-zA-Z0-9_]{20,}\b/g, "[GITHUB_TOKEN_REDACTED]"],
    [/\bxox[baprs]-[a-zA-Z0-9-]{16,}\b/g, "[SLACK_TOKEN_REDACTED]"],
    [/\bAKIA[0-9A-Z]{16}\b/g, "[AWS_ACCESS_KEY_REDACTED]"],
    [/\bAIza[0-9A-Za-z_-]{20,}\b/g, "[GOOGLE_API_KEY_REDACTED]"],
    [/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, "[JWT_REDACTED]"],
];
const SECRET_ENV_LINE = /^([A-Z0-9_]*(?:API[_-]?KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|AUTH)[A-Z0-9_]*)=(.*)$/gim;
const LOCAL_PATHS = [
    /\/home\/[A-Za-z0-9._-]+\/[^\s"'`<>)]*/g,
    /\/Users\/[A-Za-z0-9._-]+\/[^\s"'`<>)]*/g,
    /\b[A-Za-z]:\\Users\\[A-Za-z0-9._-]+\\[^\s"'`<>)]*/g,
];
const REASONING_MARKERS = [
    /<\s*(?:thinking|reasoning)[^>]*>[\s\S]*?<\s*\/\s*(?:thinking|reasoning)\s*>/gi,
    /\b(?:reasoning|thinking)[_-]?encrypted[_-]?content\b\s*[:=]\s*["']?[^"',}\n]+/gi,
];
export function redactSeedText(input) {
    let output = input;
    for (const [pattern, replacement] of SECRET_VALUE_PATTERNS)
        output = output.replace(pattern, replacement);
    output = output.replace(SECRET_ENV_LINE, (_match, key) => `${key}=[REDACTED]`);
    for (const pattern of LOCAL_PATHS)
        output = output.replace(pattern, "[LOCAL_PATH_REDACTED]");
    for (const pattern of REASONING_MARKERS)
        output = output.replace(pattern, "[REASONING_REDACTED]");
    return output;
}
export function redactSeedJson(input) {
    if (Array.isArray(input))
        return input.map((item) => redactSeedJson(item));
    if (typeof input === "string")
        return redactSeedText(input);
    if (typeof input !== "object" || input === null)
        return input;
    const output = {};
    for (const [key, value] of Object.entries(input)) {
        output[key] = SECRET_KEY.test(key) ? "[REDACTED]" : redactSeedJson(value);
    }
    return output;
}
export function countSeedRedactions(input) {
    const redacted = redactSeedText(input);
    return (redacted.match(/\[[A-Z_]+REDACTED\]/g) ?? []).length;
}
//# sourceMappingURL=redact.js.map