replay

var (
	// ErrCheckpointNotFound is returned when a checkpoint doesn't exist
	ErrCheckpointNotFound = errors.New("checkpoint not found")

	// ErrCheckpointLimitExceeded is returned when session has too many checkpoints
	ErrCheckpointLimitExceeded = errors.New("checkpoint limit exceeded")

	// ErrCheckpointTooLarge is returned when workspace is too large for checkpoint
	ErrCheckpointTooLarge = errors.New("checkpoint size exceeds limit")

	// ErrOrgStorageLimitExceeded is returned when org has too much checkpoint storage
	ErrOrgStorageLimitExceeded = errors.New("org checkpoint storage limit exceeded")

	// ErrCheckpointTampered is returned when HMAC signature is invalid
	ErrCheckpointTampered = errors.New("checkpoint signature invalid - possible tampering")

	// ErrActiveCommandsRunning is returned when trying to restore with active commands
	ErrActiveCommandsRunning = errors.New("cannot restore: active commands running")

	// ErrSessionNotFound is returned when the session a checkpoint refers to
	// does not exist
	ErrSessionNotFound = errors.New("session not found")

	// ErrReplayDisabled is returned when a session has not opted into replay
	ErrReplayDisabled = errors.New("replay is not enabled for this session")

	// ErrInvalidCheckpoint is returned when checkpoint input fails validation
	ErrInvalidCheckpoint = errors.New("invalid checkpoint")

	// SensitivePathPatterns are excluded from checkpoints for security
	SensitivePathPatterns = []string{
		"**/*.key", "**/*.pem", "**/.ssh/*", "**/.aws/*",
		"**/id_rsa", "**/id_ed25519", "**/.env",
		"**/credentials", "**/secrets.yaml", "**/secret.*",
	}

	// SensitiveEnvVars are substrings that mark an environment variable as
	// secret; a matching variable is replaced with [REDACTED] in checkpoint
	// snapshots. Matching is substring-based and case-insensitive, so short
	// generic fragments cover many concrete names: "KEY" covers
	// AWS_ACCESS_KEY_ID, SSH_KEY and API_KEY alike.
	//
	// Erring toward over-redaction is deliberate: a redacted non-secret is a
	// minor annoyance during debugging, a leaked credential is not.
	SensitiveEnvVars = []string{
		"PASSWORD", "PASSWD", "PWD",
		"SECRET", "TOKEN", "KEY",
		"CREDENTIAL", "AUTH",
		"SALT", "PASSPHRASE", "CIPHER",
		"SESSION", "COOKIE",
		"CERT", "SIGNATURE", "SIGNING",
		"PRIVATE", "APIKEY",
		"DSN", "CONNECTION_STRING",
	}
)

var (
	// DefaultCheckpointLimit is the default number of checkpoints to return
	DefaultCheckpointLimit = 50

	// MaxCheckpointsPerSession is the maximum checkpoints allowed per session
	MaxCheckpointsPerSession = 50

	// MaxCheckpointListLimit is the largest page a list request may ask for.
	MaxCheckpointListLimit = 100

	// MaxCheckpointSizeBytes is the maximum size of a single checkpoint
	MaxCheckpointSizeBytes = int64(2 * 1024 * 1024 * 1024) // 2GB

	// MaxTotalCheckpointStoragePerOrg is the maximum total checkpoint storage per org
	MaxTotalCheckpointStoragePerOrg = int64(100 * 1024 * 1024 * 1024) // 100GB
)