Function redact_secrets 

pub fn redact_secrets(text: &str) -> Redacted

Every credential in text replaced by a marker that names its shape.

Byte for byte what mj_capture_redact makes of the same text: each shape in table order over the whole text, every non-overlapping leftmost-longest match replaced as sed -E with g replaces it, then the assignment rule, which keeps the name and the separator and replaces only the value. Text with nothing credential-shaped in it comes back unchanged, prose that merely talks about a password included.

use majordomus_cli::redaction::redact_secrets;

let value = "d".repeat(16);
let out = redact_secrets(&format!("export API_KEY={value}"));
assert_eq!(out.text, "export API_KEY=[redacted:assignment]");
assert_eq!(out.kinds, ["assignment"]);

let prose = "the password is in the manual";
assert_eq!(redact_secrets(prose).text, prose);
assert!(redact_secrets(prose).kinds.is_empty());