/**
 * Canonical Axis-A subject-token sanitizer.
 *
 * Byte-identical to the Go `internal/subject.SanitizeToken` (sesh#147/#148):
 * replace each disallowed character `[^A-Za-z0-9_-]` with a single `-`,
 * ASCII-lowercase, then trim leading/trailing `-`. Internal `-` runs are
 * preserved. An all-disallowed or empty input yields `""`; callers apply
 * their own per-token fallback.
 *
 * This is DISTINCT from the bucket-name sanitizer in `scope.ts`
 * (`[.\s-]` → `_`, lowercase) — do not conflate them. That rule produces
 * KV/Object-store bucket names; this rule produces NATS subject tokens.
 *
 * The regex is intentionally NOT unicode-aware (no `u` flag): it operates on
 * UTF-16 code units, so an astral/supplementary-plane char (e.g. an emoji,
 * one code point but two code units) becomes two `-`. This matches the Go
 * implementation and the shared golden-vector fixture
 * (`test/fixtures/sanitize-vectors.json`). Do not add the `u` flag without
 * updating Go and the fixture in lockstep, or the two stacks will drift.
 */
export function sanitizeSubjectToken(s: string): string {
  return s
    .replace(/[^a-zA-Z0-9_-]/g, "-")
    .toLowerCase()
    .replace(/^-+|-+$/g, "");
}