const EMAIL_PATTERN = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
const PHONE_PATTERN = /(?:\+?\d{1,3}[\s.-]?)?\(?\d{3,4}\)?[\s.-]?\d{3}[\s.-]?\d{3,4}\b/g;
// CNP romanesc: 1 cifra sex/secol + 6 cifre data + 6 cifre judet/secventa
const RO_CNP_PATTERN = /\b[12]\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])\d{6}\b/g;

/**
 * Redactie deterministica de PII inainte ca orice continut untrusted sa ajunga
 * la un provider extern (blueprint 18: "PII redaction inainte de trimiterea
 * catre API extern"). Regex, nu ML -- Strat 0/1 din design doc: determinist
 * inainte de probabilistic.
 */
export function redactPii(text: string): string {
  return text
    .replace(EMAIL_PATTERN, '[EMAIL_REDACTED]')
    .replace(RO_CNP_PATTERN, '[CNP_REDACTED]')
    .replace(PHONE_PATTERN, '[PHONE_REDACTED]');
}