"use strict";
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    var desc = Object.getOwnPropertyDescriptor(m, k);
    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
      desc = { enumerable: true, get: function() { return m[k]; } };
    }
    Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
    Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
    o["default"] = v;
});
var __importStar = (this && this.__importStar) || (function () {
    var ownKeys = function(o) {
        ownKeys = Object.getOwnPropertyNames || function (o) {
            var ar = [];
            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
            return ar;
        };
        return ownKeys(o);
    };
    return function (mod) {
        if (mod && mod.__esModule) return mod;
        var result = {};
        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
        __setModuleDefault(result, mod);
        return result;
    };
})();
Object.defineProperty(exports, "__esModule", { value: true });
exports.redactSecrets = redactSecrets;
exports.redactEnvFile = redactEnvFile;
exports.isEnvFile = isEnvFile;
exports.getSecretSummary = getSecretSummary;
const fs = __importStar(require("fs"));
const path = __importStar(require("path"));
const SECRET_PATTERNS = [
    { name: 'API_KEY', pattern: /(?:api[_-]?key|apikey)\s*[:=]\s*["']?([A-Za-z0-9_\-]{20,})["']?/gi, replacement: 'API_KEY=<REDACTED>' },
    { name: 'TOKEN', pattern: /(?:token|access[_-]?token|auth[_-]?token)\s*[:=]\s*["']?([A-Za-z0-9_\-.]{20,})["']?/gi, replacement: 'TOKEN=<REDACTED>' },
    { name: 'SECRET', pattern: /(?:secret|client[_-]?secret|app[_-]?secret)\s*[:=]\s*["']?([A-Za-z0-9_\-]{20,})["']?/gi, replacement: 'SECRET=<REDACTED>' },
    { name: 'PASSWORD', pattern: /(?:password|passwd|pwd)\s*[:=]\s*["']?([^\s"']{8,})["']?/gi, replacement: 'PASSWORD=<REDACTED>' },
    { name: 'PRIVATE_KEY', pattern: /-----BEGIN [A-Z ]+PRIVATE KEY-----[\s\S]*?-----END [A-Z ]+PRIVATE KEY-----/g, replacement: '<PRIVATE_KEY_REDACTED>' },
    { name: 'SSH_KEY', pattern: /-----BEGIN OPENSSH PRIVATE KEY-----[\s\S]*?-----END OPENSSH PRIVATE KEY-----/g, replacement: '<SSH_KEY_REDACTED>' },
    { name: 'JWT', pattern: /eyJ[A-Za-z0-9_\-]+\.eyJ[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+/g, replacement: '<JWT_REDACTED>' },
    { name: 'NPM_TOKEN', pattern: /npm_[A-Za-z0-9]{36}/g, replacement: '<NPM_TOKEN_REDACTED>' },
    { name: 'AWS_KEY', pattern: /AKIA[0-9A-Z]{16}/g, replacement: '<AWS_KEY_REDACTED>' },
    { name: 'GITHUB_TOKEN', pattern: /ghp_[A-Za-z0-9]{36}/g, replacement: '<GITHUB_TOKEN_REDACTED>' },
    { name: 'OPENAI_KEY', pattern: /sk-[A-Za-z0-9]{48}/g, replacement: '<OPENAI_KEY_REDACTED>' },
    { name: 'CONNECTION_STRING', pattern: /(?:mongodb|postgres|mysql|redis|amqp):\/\/[^\s"']+/gi, replacement: '<CONNECTION_STRING_REDACTED>' },
    { name: 'BEARER', pattern: /Bearer\s+[A-Za-z0-9_\-\.]{20,}/g, replacement: 'Bearer <REDACTED>' },
];
const ENV_FILE_NAMES = ['.env', '.env.local', '.env.production', '.env.development', '.env.staging'];
function redactSecrets(content) {
    let redacted = content;
    let count = 0;
    const found = [];
    for (const rule of SECRET_PATTERNS) {
        const matches = redacted.match(rule.pattern);
        if (matches && matches.length > 0) {
            count += matches.length;
            if (!found.includes(rule.name))
                found.push(rule.name);
            redacted = redacted.replace(rule.pattern, rule.replacement);
        }
    }
    return { content: redacted, redacted: count, secrets: found };
}
function redactEnvFile(filePath) {
    try {
        const content = fs.readFileSync(filePath, 'utf-8');
        return redactSecrets(content);
    }
    catch {
        return { content: '', redacted: 0, secrets: [] };
    }
}
function isEnvFile(filePath) {
    const base = path.basename(filePath);
    return ENV_FILE_NAMES.includes(base) || base.startsWith('.env.');
}
function getSecretSummary() {
    const secrets = [
        'OPENAI_API_KEY',
        'ANTHROPIC_API_KEY',
        'GITHUB_TOKEN',
        'NPM_TOKEN',
        'AWS_ACCESS_KEY_ID',
        'MONGODB_URI',
        'DATABASE_URL',
        'REDIS_URL',
    ];
    return secrets.map(name => {
        let present = false;
        try {
            const envPath = path.join(process.cwd(), '.env');
            if (fs.existsSync(envPath)) {
                const content = fs.readFileSync(envPath, 'utf-8');
                present = content.includes(name + '=') && !content.includes(name + '=\n');
            }
        }
        catch { /* ignore */ }
        return { name, required: false, present };
    });
}
//# sourceMappingURL=redactor.js.map