import "./redact-BqsJZBuS.js";
import "./errors-MtvAMHJ_.js";
import { _ as uniqueStrings } from "./string-normalization-WNUDCpXX.js";
import "./fs-safe-defaults-DGhQoQd8.js";
import "./fs-safe-DX9lk8sj.js";
import { a as root } from "./secure-temp-dir-DPE3dAbS.js";
import "./replace-file-y1NWhWbT.js";
import "./path-guards-CEhdqRNe.js";
import "./private-file-store-nV9uHFLd.js";
import "./shared-DEvKPICl.js";
import "./runtime-shared-D5IVdd2o.js";
import "./fs-safe-advanced-CEhdqRNe.js";
import "./ports-DPRfSD9s.js";
import "./ssrf-BexmkCsD.js";
import "./sibling-temp-file-CEhdqRNe.js";
import "./channel-secret-collector-runtime-BTKSaEq3.js";
import { i as wrapExternalContent } from "./external-content-BdbdWtKm.js";
import "./channel-access-compat-DHqUC5gt.js";
//#region src/security/channel-metadata.ts
const DEFAULT_MAX_CHARS = 800;
const DEFAULT_MAX_ENTRY_CHARS = 400;
function normalizeEntry(entry) {
	return entry.replace(/\s+/g, " ").trim();
}
function truncateText(value, maxChars) {
	if (maxChars <= 0) return "";
	if (value.length <= maxChars) return value;
	return `${value.slice(0, Math.max(0, maxChars - 3)).trimEnd()}...`;
}
function buildUntrustedChannelMetadata(params) {
	const deduped = uniqueStrings(params.entries.map((entry) => typeof entry === "string" ? normalizeEntry(entry) : "").filter((entry) => Boolean(entry)).map((entry) => truncateText(entry, DEFAULT_MAX_ENTRY_CHARS)));
	if (deduped.length === 0) return;
	const body = deduped.join("\n");
	return wrapExternalContent(truncateText(`${`UNTRUSTED channel metadata (${params.source})`}\n${`${params.label}:\n${body}`}`, params.maxChars ?? DEFAULT_MAX_CHARS), {
		source: "channel_metadata",
		includeWarning: false
	});
}
//#endregion
//#region src/plugin-sdk/security-runtime.ts
/**
* @deprecated Broad public SDK barrel. Prefer focused security/SSRF/secret
* subpaths and avoid adding new imports here.
*/
async function openFileWithinRoot(params) {
	return await (await root(params.rootDir)).open(params.relativePath, {
		hardlinks: params.rejectHardlinks === false ? "allow" : "reject",
		nonBlockingRead: params.nonBlockingRead,
		symlinks: params.allowSymlinkTargetWithinRoot === true ? "follow-within-root" : "reject"
	});
}
async function writeFileFromPathWithinRoot(params) {
	await (await root(params.rootDir)).copyIn(params.relativePath, params.sourcePath, {
		mkdir: params.mkdir,
		sourceHardlinks: "reject"
	});
}
//#endregion
export { writeFileFromPathWithinRoot as n, buildUntrustedChannelMetadata as r, openFileWithinRoot as t };
