/** Number of leading characters shown for identification on credential display surfaces. */
export const CREDENTIAL_PREFIX_LENGTH = 4;

/** Fixed asterisk pad length for masked credentials (does not encode secret length). */
export const CREDENTIAL_MASK_PAD_LENGTH = 14;

/**
 * Mask a credential for UI display: first {@link CREDENTIAL_PREFIX_LENGTH} characters
 * plus a fixed asterisk pad. The full secret must never be returned on ordinary reads.
 */
export const maskCredential = (key: string): string => {
  const prefix = key.slice(0, CREDENTIAL_PREFIX_LENGTH);
  return `${prefix}${'*'.repeat(CREDENTIAL_MASK_PAD_LENGTH)}`;
};