/**
 * Audit log constants — tenant-audit-log spec.
 *
 * SENSITIVE_FIELD_BLOCKLIST: field names whose values must be redacted before
 * enqueueing a settings.updated audit event. Masking is applied in logAuditEvent.
 */

export const SENSITIVE_FIELD_BLOCKLIST = [
  'smtp_password_encrypted',
  'api_key_secret',
  'webhook_secret',
  'oauth_token',
  'dkim_private_key',
] as const

export const REDACTED = '[redacted]'