src/lib/security.ts

/**
 * HARNESS: Server-side PII Sanitization Utility.
 * Ensures sensitive data is scrubbed before being persisted or processed.
 */
export function sanitizeLogContent(content: string): string {
  if (!content) return content;
  
  // Mask Emails
  let scrubbed = content.replace(/[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g, "[EMAIL_MASKED]");
  
  // Mask Secrets (OpenAI, AWS, GCP, generic sk-)
  scrubbed = scrubbed.replace(/(sk-|AIza|AKIA|SG\.|ghp_)[a-zA-Z0-9]{20,}/g, "[SECRET_MASKED]");
  
  // Mask Credit Cards (Basic regex for 13-16 digit numbers)
  scrubbed = scrubbed.replace(/\b(?:\d[ -]*?){13,16}\b/g, "[CARD_MASKED]");
  
  // Mask Potential Passwords in JSON/KV pairs
  scrubbed = scrubbed.replace(/("password"|"passwd"|"secret")\s*:\s*"[^"]+"/gi, '$1: "[VALUE_MASKED]"');
  
  return scrubbed;
}