import "./redact-Dqy6lYx_.js";
import "./errors-BaENkGSr.js";
import "./fs-safe-defaults-C5XkOq6n.js";
import "./advanced-B7QGBYXk.js";
import { b as root } from "./secure-temp-dir-BK_Pe2D-.js";
import "./fs-safe-C2q5XV2R.js";
import "./path-guards-D1MtGHpX.js";
import "./replace-file-CLtGqJvU.js";
import "./fs-safe-advanced-Kp5l3qnm.js";
import "./private-file-store-BNeBHDje.js";
import "./shared-OOGW4swF.js";
import "./ports-BxkolIna.js";
import "./ssrf-GVL829g5.js";
import "./sibling-temp-file-BSa1707s.js";
import "./runtime-shared-CwdqDwT9.js";
import { i as wrapExternalContent } from "./external-content-Bg8zhQIo.js";
import "./channel-access-compat-Ta3iou6u.js";
import "./channel-secret-collector-runtime-D2_Hj5WE.js";
//#region src/security/channel-metadata.ts
const DEFAULT_MAX_CHARS = 800;
const DEFAULT_MAX_ENTRY_CHARS = 400;
function normalizeEntry(entry) {
	return entry.replace(/\s+/g, " ").trim();
}
function truncateText(value, maxChars) {
	if (maxChars <= 0) return "";
	if (value.length <= maxChars) return value;
	return `${value.slice(0, Math.max(0, maxChars - 3)).trimEnd()}...`;
}
function buildUntrustedChannelMetadata(params) {
	const deduped = params.entries.map((entry) => typeof entry === "string" ? normalizeEntry(entry) : "").filter((entry) => Boolean(entry)).map((entry) => truncateText(entry, DEFAULT_MAX_ENTRY_CHARS)).filter((entry, index, list) => list.indexOf(entry) === index);
	if (deduped.length === 0) return;
	const body = deduped.join("\n");
	return wrapExternalContent(truncateText(`${`UNTRUSTED channel metadata (${params.source})`}\n${`${params.label}:\n${body}`}`, params.maxChars ?? DEFAULT_MAX_CHARS), {
		source: "channel_metadata",
		includeWarning: false
	});
}
//#endregion
//#region src/plugin-sdk/security-runtime.ts
/**
* @deprecated Broad public SDK barrel. Prefer focused security/SSRF/secret
* subpaths and avoid adding new imports here.
*/
async function openFileWithinRoot(params) {
	return await (await root(params.rootDir)).open(params.relativePath, {
		hardlinks: params.rejectHardlinks === false ? "allow" : "reject",
		nonBlockingRead: params.nonBlockingRead,
		symlinks: params.allowSymlinkTargetWithinRoot === true ? "follow-within-root" : "reject"
	});
}
async function writeFileFromPathWithinRoot(params) {
	await (await root(params.rootDir)).copyIn(params.relativePath, params.sourcePath, {
		mkdir: params.mkdir,
		sourceHardlinks: "reject"
	});
}
//#endregion
export { writeFileFromPathWithinRoot as n, buildUntrustedChannelMetadata as r, openFileWithinRoot as t };
