import { scrubStringValue } from '@/server/observability/pii-scrub.js';

/**
 * Build a leak-safe error string for returning/persisting from a monitor adapter or check.
 * Redacts every occurrence of each provided secret/URL (literal, regex-safe), then scrubs
 * DSN / password / phone / email via the shared scrubber. NEVER return a raw err.message.
 */
export function redactError(
  err: unknown,
  fallback: string,
  ...secrets: (string | null | undefined)[]
): string {
  let s = err instanceof Error ? err.message : fallback;
  for (const sec of secrets) {
    if (sec) s = s.replaceAll(sec, '[redacted]');
  }
  return scrubStringValue(s);
}