const PRIVATE_KEY_BLOCK_PATTERN = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
const LOCAL_UI_HANDOFF_FRAGMENT_PATTERN = /patchTrailLocalHandoff=[^\s"'&#)]+/g;
const LOCAL_UI_SESSION_TOKEN_PATTERN = /\bpt_lui_sess_[A-Za-z0-9_-]{4,}\b/g;
const LOCAL_UI_CAPABILITY_TOKEN_PATTERN = /\bpt_lui_(?!sess_)[A-Za-z0-9_-]{4,}\b/g;
const PROVIDER_API_KEY_PATTERN = /\b(?:sk-(?:proj-|ant-api03-|or-v1-)?[A-Za-z0-9_-]{8,}|gsk_[A-Za-z0-9]{8,}|AIza[0-9A-Za-z_-]{16,})\b/g;
const PROVIDER_TOKEN_PATTERN = /\b(?:ghp_[A-Za-z0-9_]{8,}|github_pat_[A-Za-z0-9_]{8,}|glpat-[A-Za-z0-9_-]{8,}|xox[baprs]-[A-Za-z0-9-]{8,})\b/g;
const BEARER_TOKEN_PATTERN = /(authorization:\s*bearer\s+|bearer\s+)([A-Za-z0-9._~+\/-]{8,}=*)/gi;
const URL_CREDENTIAL_PATTERN = /(https?:\/\/)[^\s:@/]+:[^\s@/]+@/gi;
const SECRET_ENV_ASSIGNMENT_PATTERN = /\b([A-Za-z0-9_]*(?:TOKEN|KEY|SECRET|PASSWORD|CREDENTIAL)[A-Za-z0-9_]*=)[^\s"']+/gi;
const PASSWORD_ASSIGNMENT_PATTERN = /\b(password=)[^\s"']+/gi;
const TOKEN_CLI_ARG_PATTERN = /(--?(?:token|password|api-key|apikey|key|secret)(?:\s+|=))[^\s"']+/gi;
export function redactSecretText(value) {
    return value
        .replace(PRIVATE_KEY_BLOCK_PATTERN, "[redacted-private-key]")
        .replace(LOCAL_UI_HANDOFF_FRAGMENT_PATTERN, "patchTrailLocalHandoff=[redacted]")
        .replace(BEARER_TOKEN_PATTERN, "$1[redacted-token]")
        .replace(PROVIDER_TOKEN_PATTERN, "[redacted-token]")
        .replace(PROVIDER_API_KEY_PATTERN, "[redacted-token]")
        .replace(LOCAL_UI_SESSION_TOKEN_PATTERN, "[redacted-token]")
        .replace(LOCAL_UI_CAPABILITY_TOKEN_PATTERN, "[redacted-token]")
        .replace(URL_CREDENTIAL_PATTERN, "$1[redacted-credentials]@")
        .replace(SECRET_ENV_ASSIGNMENT_PATTERN, "$1[redacted]")
        .replace(PASSWORD_ASSIGNMENT_PATTERN, "$1[redacted]")
        .replace(TOKEN_CLI_ARG_PATTERN, "$1[redacted]");
}
