const SECRET_PATTERNS: Array<[RegExp, string]> = [
  [/\b(Bearer)\s+[A-Za-z0-9._~+/=-]+/gi, "$1 [REDACTED]"],
  [/\b(sk-[A-Za-z0-9_-]{12,})\b/g, "[REDACTED_API_KEY]"],
  [/\b(gh[opurs]_[A-Za-z0-9]{12,})\b/g, "[REDACTED_GITHUB_TOKEN]"],
  [/\b([A-Z][A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|API_KEY))\s*=\s*([^\s]+)/g, "$1=[REDACTED]"],
  [/(https?:\/\/[^\s?#]+)\?[^\s#]*/g, "$1?[REDACTED_QUERY]"],
];

export function redactText(input: string): string {
  let output = input;
  for (const [pattern, replacement] of SECRET_PATTERNS) output = output.replace(pattern, replacement);
  return output;
}