// {{ display_name }} MCP server — generated by mcpify. Do not hand-edit.

const SENSITIVE_KEY_PATTERN = /(password|token|secret|authorization|api[-_]?key|credentials?)/i;

/** Redaction paths pino's `redact` option looks for on every log call — REQ-2.3.1. */
export const REDACT_PATHS = [
  'password',
  'token',
  'secret',
  'authorization',
  'apiKey',
  'credentials',
  '*.password',
  '*.token',
  '*.secret',
  '*.authorization',
  '*.apiKey',
  '*.credentials',
];

/** Deep-clones `value`, replacing any key matching a sensitive pattern with `[REDACTED]`. */
export function sanitize(value: unknown): unknown {
  if (Array.isArray(value)) {
    return value.map(sanitize);
  }
  if (value !== null && typeof value === 'object') {
    return Object.fromEntries(
      Object.entries(value as Record<string, unknown>).map(([key, val]) => [
        key,
        SENSITIVE_KEY_PATTERN.test(key) ? '[REDACTED]' : sanitize(val),
      ]),
    );
  }
  return value;
}
