copperhead

/**
 * Write-time secret redaction for transcripts and summaries (AC-4.1).
 * Patterns are deliberately broad: losing a few characters of log fidelity
 * beats leaking a key.
 */
const PATTERNS: RegExp[] = [
  /sk-[A-Za-z0-9_-]+/g,
  // Auth schemes are case-insensitive (RFC 7235 §2.1), and the token charset has
  // to include base64's +, / and = or the match stops at the first one and the
  // tail of the secret gets written out verbatim.
  /Bearer\s+[A-Za-z0-9._+/=-]{16,}/gi,
  // Registry and forge tokens: a transcript that quotes a publish command or a
  // failing CI log can carry these just as easily as a model API key.
  // npm also issues UUID-shaped tokens, so the charset allows dashes.
  /npm_[A-Za-z0-9-]{36,}/g,
  /gh[pousr]_[A-Za-z0-9]{36,}/g,
  /github_pat_[A-Za-z0-9_]{22,}/g,
];

export function redactSecrets(text: string): string {
  let out = text;
  for (const re of PATTERNS) out = out.replace(re, '[REDACTED]');
  return out;
}