const REDACTION = "[REDACTED]";
const SECRET_PATTERNS = [
    /\b(?:sk|pk)-[A-Za-z0-9_-]{20,}\b/g,
    /\b(?:ghp|github_pat|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\b/g,
    /\b(?:xoxb|xoxp|xoxa|xoxr)-[A-Za-z0-9-]{20,}\b/g,
    /\b[A-Za-z0-9._%+-]+:([A-Za-z0-9._~+/=-]{16,})@/g,
    /\b(?:api[_-]?key|token|secret|password|passwd|authorization)\s*[:=]\s*['"]?[^'"\s]+/gi,
    /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}\b/gi,
    /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
];
export function redactMemoryText(text) {
    let redacted = text;
    for (const pattern of SECRET_PATTERNS) {
        redacted = redacted.replace(pattern, (match) => {
            if (match.includes(":")) {
                const [prefix] = match.split(/[:=]/, 1);
                return `${prefix}: ${REDACTION}`;
            }
            return REDACTION;
        });
    }
    return redacted;
}
function redactMetadata(metadata) {
    if (!metadata)
        return undefined;
    const redacted = {};
    for (const [key, value] of Object.entries(metadata)) {
        if (/api[_-]?key|token|secret|password|passwd|authorization/i.test(key)) {
            redacted[key] = REDACTION;
        }
        else if (typeof value === "string") {
            redacted[key] = redactMemoryText(value);
        }
        else {
            redacted[key] = value;
        }
    }
    return redacted;
}
export function redactMemoryEventInput(event) {
    return {
        ...event,
        summary: redactMemoryText(event.summary),
        content: event.content ? redactMemoryText(event.content) : undefined,
        metadata: redactMetadata(event.metadata),
    };
}
//# sourceMappingURL=redaction.js.map