from __future__ import annotations

import re
from typing import Any


SECRET_PATTERNS = [
    re.compile(r"(?i)(api[_-]?key|secret|password|bearer)\s*[:=]\s*[^\s,]+"),
    re.compile(r"\b\d{6}-\d{7}\b"),
    re.compile(r"(?<![A-Za-z0-9.])(?:\d[ -]?){13,16}(?![A-Za-z0-9.])"),
]


def redact(value: Any) -> Any:
    if isinstance(value, dict):
        return {key: ("[REDACTED]" if key.lower() in {"secret", "password", "token", "api_key"} else redact(item)) for key, item in value.items()}
    if isinstance(value, list):
        return [redact(item) for item in value]
    if isinstance(value, str):
        clean = value
        for pattern in SECRET_PATTERNS:
            clean = pattern.sub("[REDACTED]", clean)
        return clean
    return value


def sensitive_match_count(text: str) -> int:
    return sum(len(pattern.findall(text)) for pattern in SECRET_PATTERNS)
