import "./redact-CozhggBi.js";
import "./errors-Cq_Pdh35.js";
import { _ as uniqueStrings } from "./string-normalization-B8G0vlWE.js";
import "./fs-safe-defaults-A4awSMom.js";
import { A as withTimeout$1, B as resolveStrictExistingPathsWithinRoot$1, C as resolveRegularFileAppendFlags$1, D as statRegularFileSync$1, E as statRegularFile$1, I as pathScope$1, L as resolveExistingPathsWithinRoot$1, R as resolvePathWithinRoot$1, V as resolveWritablePathWithinRoot$1, _ as readRegularFileSync$1, d as pathExists$1, f as pathExistsSync$1, g as readRegularFile$1, j as writeExternalFileWithinRoot$1, n as appendRegularFile$1, r as appendRegularFileSync$1, t as FsSafeError$1, u as openLocalFileSafely$1, w as root$1, x as resolveLocalPathFromRootsSync$1, z as resolvePathsWithinRoot$1 } from "./fs-safe-CmlZlB6k.js";
import "./replace-file-DlzIPzco.js";
import "./path-guards-DYDM1EyF.js";
import "./private-file-store-CkExsGri.js";
import "./shared-6wL17I4Y.js";
import "./runtime-shared-21CeYSM0.js";
import "./fs-safe-advanced-d2XEMzjt.js";
import "./ports-J-OFxyiQ.js";
import "./ssrf-DHSaCLE-.js";
import "./sibling-temp-file-ByfkeKYe.js";
import "./channel-secret-collector-runtime-DYkPXLo_.js";
import { i as wrapExternalContent } from "./external-content-DjKXXY5B.js";
import "./channel-access-compat-B30I4dx6.js";
//#region src/security/channel-metadata.ts
const DEFAULT_MAX_CHARS = 800;
const DEFAULT_MAX_ENTRY_CHARS = 400;
function normalizeEntry(entry) {
	return entry.replace(/\s+/g, " ").trim();
}
function truncateText(value, maxChars) {
	if (maxChars <= 0) return "";
	if (value.length <= maxChars) return value;
	return `${value.slice(0, Math.max(0, maxChars - 3)).trimEnd()}...`;
}
function buildUntrustedChannelMetadata(params) {
	const deduped = uniqueStrings(params.entries.map((entry) => typeof entry === "string" ? normalizeEntry(entry) : "").filter((entry) => Boolean(entry)).map((entry) => truncateText(entry, DEFAULT_MAX_ENTRY_CHARS)));
	if (deduped.length === 0) return;
	const body = deduped.join("\n");
	return wrapExternalContent(truncateText(`${`UNTRUSTED channel metadata (${params.source})`}\n${`${params.label}:\n${body}`}`, params.maxChars ?? DEFAULT_MAX_CHARS), {
		source: "channel_metadata",
		includeWarning: false
	});
}
//#endregion
//#region src/infra/root-paths.ts
function pathScope(...args) {
	return pathScope$1(...args);
}
function resolveExistingPathsWithinRoot(...args) {
	return resolveExistingPathsWithinRoot$1(...args);
}
function resolvePathWithinRoot(...args) {
	return resolvePathWithinRoot$1(...args);
}
function resolvePathsWithinRoot(...args) {
	return resolvePathsWithinRoot$1(...args);
}
function resolveStrictExistingPathsWithinRoot(...args) {
	return resolveStrictExistingPathsWithinRoot$1(...args);
}
function resolveWritablePathWithinRoot(...args) {
	return resolveWritablePathWithinRoot$1(...args);
}
//#endregion
//#region src/plugin-sdk/security-runtime.ts
/**
* @deprecated Broad public SDK barrel. Prefer focused security/SSRF/secret
* subpaths and avoid adding new imports here.
*/
function appendRegularFile(...args) {
	return appendRegularFile$1(...args);
}
function appendRegularFileSync(...args) {
	return appendRegularFileSync$1(...args);
}
const FsSafeError = FsSafeError$1;
const SafeOpenError = FsSafeError;
function openLocalFileSafely(...args) {
	return openLocalFileSafely$1(...args);
}
function pathExists(...args) {
	return pathExists$1(...args);
}
function pathExistsSync(...args) {
	return pathExistsSync$1(...args);
}
function readRegularFile(...args) {
	return readRegularFile$1(...args);
}
function resolveLocalPathFromRootsSync(...args) {
	return resolveLocalPathFromRootsSync$1(...args);
}
function readRegularFileSync(...args) {
	return readRegularFileSync$1(...args);
}
function resolveRegularFileAppendFlags(...args) {
	return resolveRegularFileAppendFlags$1(...args);
}
function root(...args) {
	return root$1(...args);
}
function statRegularFile(...args) {
	return statRegularFile$1(...args);
}
function statRegularFileSync(...args) {
	return statRegularFileSync$1(...args);
}
async function writeExternalFileWithinRoot(...args) {
	return await writeExternalFileWithinRoot$1(...args);
}
function withTimeout(promise, ms) {
	return withTimeout$1(promise, ms);
}
async function openFileWithinRoot(params) {
	return await (await root$1(params.rootDir)).open(params.relativePath, {
		hardlinks: params.rejectHardlinks === false ? "allow" : "reject",
		nonBlockingRead: params.nonBlockingRead,
		symlinks: params.allowSymlinkTargetWithinRoot === true ? "follow-within-root" : "reject"
	});
}
async function writeFileFromPathWithinRoot(params) {
	await (await root$1(params.rootDir)).copyIn(params.relativePath, params.sourcePath, {
		mkdir: params.mkdir,
		sourceHardlinks: "reject"
	});
}
//#endregion
export { resolveStrictExistingPathsWithinRoot as C, resolvePathsWithinRoot as S, buildUntrustedChannelMetadata as T, writeExternalFileWithinRoot as _, openFileWithinRoot as a, resolveExistingPathsWithinRoot as b, pathExistsSync as c, resolveLocalPathFromRootsSync as d, resolveRegularFileAppendFlags as f, withTimeout as g, statRegularFileSync as h, appendRegularFileSync as i, readRegularFile as l, statRegularFile as m, SafeOpenError as n, openLocalFileSafely as o, root as p, appendRegularFile as r, pathExists as s, FsSafeError as t, readRegularFileSync as u, writeFileFromPathWithinRoot as v, resolveWritablePathWithinRoot as w, resolvePathWithinRoot as x, pathScope as y };
