import { o as coerceSecretRef } from "./types.secrets-DdS3-UHE.js";
//#region src/secrets/runtime-secret-scan.ts
const CREDENTIAL_FIELD_NAMES = new Set([
	"apikey",
	"key",
	"token",
	"secret",
	"password"
]);
function hasRecursiveSecretValue(params) {
	if (coerceSecretRef(params.value, params.defaults)) return true;
	if (!params.value || typeof params.value !== "object") return false;
	if (params.seen.has(params.value)) return false;
	params.seen.add(params.value);
	if (Array.isArray(params.value)) return params.value.some((entry) => hasRecursiveSecretValue({
		...params,
		value: entry
	}));
	return Object.entries(params.value).some(([key, entry]) => {
		if (params.matchesEntry?.(key, entry)) return true;
		return hasRecursiveSecretValue({
			...params,
			value: entry
		});
	});
}
function hasSecretRefCandidate(value, defaults, seen = /* @__PURE__ */ new WeakSet()) {
	return hasRecursiveSecretValue({
		value,
		defaults,
		seen
	});
}
function hasCredentialBearingObjectValue(value, defaults, seen = /* @__PURE__ */ new WeakSet()) {
	return hasRecursiveSecretValue({
		value,
		defaults,
		seen,
		matchesEntry: (rawKey, entry) => {
			const key = rawKey.toLowerCase();
			return CREDENTIAL_FIELD_NAMES.has(key) && entry != null && entry !== "";
		}
	});
}
//#endregion
export { hasSecretRefCandidate as n, hasCredentialBearingObjectValue as t };
