/**
 * Snapshots capture normalized rendered output only. These patterns mark the
 * non-deterministic or opaque content that must be normalized away first:
 * machine paths, timestamps, random IDs, and bundled/minified code.
 */
const FORBIDDEN: ReadonlyArray<{ label: string; re: RegExp }> = [
	{
		label: "absolute path",
		re: /(?:\/(?:home|Users|root|tmp|var|opt)\/|[A-Za-z]:\\)/,
	},
	{ label: "ISO timestamp", re: /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}/ },
	{
		label: "UUID",
		re: /[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/,
	},
	{ label: "content hash", re: /\b[0-9a-f]{16,}\b/ },
	{ label: "bundle chunk reference", re: /-[a-z0-9]{8}\.js\b/ },
	{ label: "bundle marker", re: /sourceMappingURL|__esModule/ },
];

/** Labels of every snapshot policy the text violates. */
export function snapshotViolations(content: string): string[] {
	const found = FORBIDDEN.filter((rule) => rule.re.test(content)).map(
		(rule) => rule.label,
	);
	// Any leak of the checkout root is an absolute-path violation too.
	if (content.includes(process.cwd()) && !found.includes("absolute path"))
		found.push("absolute path");
	return found;
}