/**
 * sanitizeSnippet escapes all HTML in a Manticore snippet, then re-enables
 * the only markup we trust: <b>…</b> wrappers around match words.
 *
 * Manticore SNIPPET()/HIGHLIGHT() output is otherwise plain text plus
 * configurable `<b>` markers, so this is sufficient for safe rendering
 * via dangerouslySetInnerHTML.
 */
export function sanitizeSnippet(input: string): string {
  if (!input) return "";

  // 1. Escape every HTML-special character.
  const escaped = input
    .replace(/&/g, "&amp;")
    .replace(/</g, "&lt;")
    .replace(/>/g, "&gt;")
    .replace(/"/g, "&quot;")
    .replace(/'/g, "&#39;");

  // 2. Re-allow our two whitelisted tags. After step 1 they appear as
  //    "&lt;b&gt;" / "&lt;/b&gt;" — restore them verbatim.
  return escaped
    .replace(/&lt;b&gt;/g, "<b>")
    .replace(/&lt;\/b&gt;/g, "</b>");
}
