//#region extensions/weixin/src/util/redact.ts
const DEFAULT_BODY_MAX_LEN = 200;
const DEFAULT_TOKEN_PREFIX_LEN = 6;
/**
* Truncate a string, appending a length indicator when trimmed.
* Returns `""` for empty/undefined input.
*/
function truncate(s, max) {
	if (!s) return "";
	if (s.length <= max) return s;
	return `${s.slice(0, max)}…(len=${s.length})`;
}
/**
* Redact a token/secret: show only the first few chars + total length.
* Returns `"(none)"` when absent.
*/
function redactToken(token, prefixLen = DEFAULT_TOKEN_PREFIX_LEN) {
	if (!token) return "(none)";
	if (token.length <= prefixLen) return `****(len=${token.length})`;
	return `${token.slice(0, prefixLen)}…(len=${token.length})`;
}
/**
* Truncate a JSON body string to `maxLen` chars for safe logging.
* Redacts known sensitive fields before truncating.
*/
function redactBody(body, maxLen = DEFAULT_BODY_MAX_LEN) {
	if (!body) return "(empty)";
	const redacted = body.replace(/"(context_token|bot_token|token|authorization|Authorization)"\s*:\s*"[^"]*"/g, "\"$1\":\"<redacted>\"");
	if (redacted.length <= maxLen) return redacted;
	return `${redacted.slice(0, maxLen)}…(truncated, totalLen=${redacted.length})`;
}
/**
* Strip query string (which often contains signatures/tokens) from a URL,
* keeping only origin + pathname.
*/
function redactUrl(rawUrl) {
	try {
		const u = new URL(rawUrl);
		const base = `${u.origin}${u.pathname}`;
		return u.search ? `${base}?<redacted>` : base;
	} catch {
		return truncate(rawUrl, 80);
	}
}
//#endregion
export { redactBody, redactToken, redactUrl, truncate };

//# sourceMappingURL=redact.js.map