<?php
declare(strict_types=1);

/** Strip URLs, paths with secrets, and credential-like tokens from user-visible build errors. */
final class BuildErrorSanitizer {
    public static function sanitize(string $message): string {
        if ($message === '') {
            return '';
        }
        $out = $message;
        $out = preg_replace('#https?://[^\s\'"<>]+#i', '***', $out) ?? $out;
        $out = preg_replace('#git://[^\s\'"<>]+#i', '***', $out) ?? $out;
        $out = preg_replace('#ssh://[^\s\'"<>]+#i', '***', $out) ?? $out;
        $out = preg_replace(
            '/\b(password|passwd|pass|token|secret|api[_-]?key|bearer|authorization)\s*[:=]\s*\S+/i',
            '$1=***',
            $out
        ) ?? $out;
        $out = preg_replace(
            '/(?:\/[^\s]+)?\/(?:\.env|credentials(?:\.json)?|secrets?\.(?:json|ya?ml|env))[^\s]*/i',
            '***',
            $out
        ) ?? $out;
        $out = preg_replace('#/var/www/[^\s\'"]+#', '***', $out) ?? $out;
        $out = preg_replace('#/home/[^\s\'"]+#', '***', $out) ?? $out;
        return trim(preg_replace('/\s{2,}/', ' ', $out) ?? $out);
    }
}