"use strict";
/* Socket Lib - Built with rolldown */
Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
const require_primordials_number = require('../primordials/number.js');
const require_primordials_array = require('../primordials/array.js');
const require_primordials_date = require('../primordials/date.js');
const require_primordials_object = require('../primordials/object.js');
const require_primordials_globals = require('../primordials/globals.js');

//#region src/http-request/headers.ts
/**
* @file Header utilities for HTTP/HTTPS requests. Two pure-data helpers:
*
*   - `parseRetryAfterHeader` turns a `Retry-After` header value (delay-seconds
*     OR HTTP-date per RFC 7231 §7.1.3) into a millisecond delay for `onRetry`
*     callbacks.
*   - `sanitizeHeaders` redacts `Authorization`, `Cookie`, and the other
*     credential-bearing headers before they reach a logger or telemetry
*     payload. No I/O — these can be imported anywhere without dragging the
*     Node.js `http`/`https` modules into the bundle.
*/
const RETRY_AFTER_INT_RE = /^\d+$/;
/**
* Build an HTTP Basic `Authorization` header value from a Socket API token.
*
* The Socket API uses the token as the username with an empty password, so the
* credential pair is `<token>:`. Centralized here so every fleet caller emits
* the identical shape instead of hand-rolling `btoa(\`${token}:`)`.
*
* @example
*   ;```ts
*   const headers = { Authorization: basicAuthHeader(apiToken) }
*   // { Authorization: 'Basic c2t0X3h4eHg6' }
*   ```
*
* @param token - The Socket API token (used as the Basic-auth username).
*
* @returns The `Authorization` header value, e.g. `Basic <base64>`.
*/
/*@__NO_SIDE_EFFECTS__*/
function basicAuthHeader(token) {
	return `Basic ${require_primordials_globals.btoa(`${token}:`)}`;
}
const SENSITIVE_HEADER_NAME_RE = /auth|cookie|credential|key|password|secret|token/i;
/**
* Whether a header name looks credential-bearing and should be redacted from
* logs and telemetry. Case-insensitive substring match on the name only — the
* value is never inspected.
*
* @param name - The header name (e.g. `Authorization`, `x-api-key`).
*
* @returns `true` when the value should be replaced with `[REDACTED]`.
*/
function isSensitiveHeaderName(name) {
	return SENSITIVE_HEADER_NAME_RE.test(name);
}
/**
* Parse a `Retry-After` HTTP header value into milliseconds.
*
* Supports both formats defined in RFC 7231 §7.1.3:
*
* - **delay-seconds**: integer number of seconds (e.g., `"120"`)
* - **HTTP-date**: an absolute date/time (e.g., `"Fri, 31 Dec 2027 23:59:59
*   GMT"`)
*
* When the header is an array (multiple values), the first element is used.
*
* @example
*   ;```ts
*   import { setTimeout as delay } from 'node:timers/promises'
*   const ms = parseRetryAfterHeader(response.headers['retry-after'])
*   if (ms !== undefined) {
*     await delay(ms)
*   }
*   ```
*
* @param value - The raw Retry-After header value(s)
*
* @returns Delay in milliseconds, or `undefined` if the value cannot be parsed
*/
function parseRetryAfterHeader(value) {
	if (!value) return;
	const raw = require_primordials_array.ArrayIsArray(value) ? value[0] : value;
	if (!raw) return;
	const trimmed = raw.trim();
	if (RETRY_AFTER_INT_RE.test(trimmed)) return Number(trimmed) * 1e3;
	const date = new require_primordials_date.DateCtor(raw);
	if (!require_primordials_number.NumberIsNaN(date.getTime())) {
		const delayMs = date.getTime() - require_primordials_date.DateNow();
		if (delayMs > 0) return delayMs;
	}
}
/**
* Redact sensitive HTTP headers for safe logging and telemetry.
*
* Replaces values of credential-bearing headers with `[REDACTED]`, matching the
* header name by shape (see `isSensitiveHeaderName`) so custom token headers
* are covered without an enumerated list. Non-sensitive headers pass through
* unchanged. Array values are joined with `', '`.
*
* @example
*   ;```ts
*   const safe = sanitizeHeaders({
*     authorization: 'Bearer secret',
*     'content-type': 'application/json',
*   })
*   // { authorization: '[REDACTED]', 'content-type': 'application/json' }
*   ```
*
* @param headers - HTTP headers to sanitize.
*
* @returns A new object with sensitive values redacted
*/
function sanitizeHeaders(headers) {
	if (!headers) return {};
	const result = { __proto__: null };
	for (const key of require_primordials_object.ObjectKeys(headers)) {
		const value = headers[key];
		if (isSensitiveHeaderName(key)) result[key] = "[REDACTED]";
		else if (require_primordials_array.ArrayIsArray(value)) result[key] = value.join(", ");
		else if (value !== void 0 && value !== null) result[key] = String(value);
	}
	return result;
}

//#endregion
exports.basicAuthHeader = basicAuthHeader;
exports.isSensitiveHeaderName = isSensitiveHeaderName;
exports.parseRetryAfterHeader = parseRetryAfterHeader;
exports.sanitizeHeaders = sanitizeHeaders;