import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
//#region src/utils/logger/redact.ts
function isLogRedactionEnabled() {
	return process.env.XOPC_LOG_REDACTION !== "false";
}
function redactSecret(secret) {
	if (!secret || secret.length < MIN_REDACT_LENGTH) return "***";
	return `${secret.slice(0, KEEP_PREFIX_LENGTH)}…${secret.slice(-KEEP_SUFFIX_LENGTH)}`;
}
function redactPemBlock(text) {
	return text.replace(/(-----BEGIN\s+\w+\s+PRIVATE KEY-----)[\s\S]*?(-----END\s+\w+\s+PRIVATE KEY-----)/g, (_match, begin, end) => {
		return `${begin}\n[REDACTED]\n${end}`;
	});
}
function redactSensitiveInfo(text) {
	if (!text || !isLogRedactionEnabled()) return text;
	let redacted = redactPemBlock(text);
	for (const pattern of DEFAULT_REDACT_PATTERNS) redacted = redacted.replace(pattern, (match, ...groups) => {
		const secret = groups.find((g) => typeof g === "string" && g.length >= MIN_REDACT_LENGTH);
		if (secret) return match.replace(secret, redactSecret(secret));
		return match;
	});
	return redacted;
}
function redactObject(obj, depth = 0) {
	if (!isLogRedactionEnabled() || obj === null || obj === void 0) return obj;
	if (depth > 12) return "[MaxDepth]";
	if (typeof obj === "string") return redactSensitiveInfo(obj);
	if (typeof obj !== "object") return obj;
	if (Array.isArray(obj)) return obj.map((item) => redactObject(item, depth + 1));
	const record = obj;
	const out = {};
	for (const [key, value] of Object.entries(record)) {
		const lowerKey = key.toLowerCase();
		if (SENSITIVE_KEYS.has(lowerKey)) out[key] = typeof value === "string" ? redactSecret(value) : "***";
		else if (typeof value === "object" && value !== null) out[key] = redactObject(value, depth + 1);
		else if (typeof value === "string") out[key] = redactSensitiveInfo(value);
		else out[key] = value;
	}
	return out;
}
/**
* Apply redaction to a pino log object (mutates a shallow clone safe for return).
*/
function redactLogRecord(object) {
	if (!isLogRedactionEnabled()) return object;
	const base = redactObject(object, 0);
	if (typeof base.msg === "string") base.msg = redactSensitiveInfo(base.msg);
	return base;
}
var MIN_REDACT_LENGTH, KEEP_PREFIX_LENGTH, KEEP_SUFFIX_LENGTH, DEFAULT_REDACT_PATTERNS, SENSITIVE_KEYS;
var init_redact = __esmMin((() => {
	MIN_REDACT_LENGTH = 18;
	KEEP_PREFIX_LENGTH = 6;
	KEEP_SUFFIX_LENGTH = 4;
	DEFAULT_REDACT_PATTERNS = [
		/\b[A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD)\b\s*[=:]\s*(["']?)([^\s"'\\]+)\1/gi,
		/"(?:apiKey|token|secret|password|passwd|accessToken|refreshToken|privateKey)"\s*:\s*"([^"]+)"/gi,
		/Authorization\s*[:=]\s*Bearer\s+([A-Za-z0-9._\-+=]+)/gi,
		/\b(sk-[A-Za-z0-9_-]{8,})\b/gi,
		/\b(ghp_[A-Za-z0-9]{20,})\b/gi,
		/\b(github_pat_[A-Za-z0-9_]{20,})\b/gi,
		/\b(xox[baprs]-[A-Za-z0-9-]+)\b/gi,
		/\b(\d+:[A-Za-z0-9_-]{35,})\b/g
	];
	SENSITIVE_KEYS = new Set([
		"apikey",
		"api_key",
		"token",
		"secret",
		"password",
		"passwd",
		"accesstoken",
		"refreshtoken",
		"refresh_token",
		"privatekey",
		"private_key",
		"authorization",
		"credential",
		"credentials"
	]);
}));
//#endregion
init_redact();
export { init_redact, isLogRedactionEnabled, redactLogRecord, redactObject, redactPemBlock, redactSecret, redactSensitiveInfo };

//# sourceMappingURL=redact.js.map