/**
 * Shared hygiene for provider HTTP error bodies embedded in thrown error
 * messages. Provider error responses can echo request headers/bodies, so a
 * raw `await response.text()` in an error message can leak bearer tokens into
 * logs, events.jsonl, and execution reports. Truncation also keeps a huge
 * HTML error page from drowning the actual failure.
 */
export function safeErrorBody(body: string, maxLength = 300): string {
  const redacted = body
    .replace(/bearer\s+[A-Za-z0-9._~+/=-]+/gi, 'bearer ***')
    .replace(/"(api[_-]?key|apikey|token|authorization|password|secret)"\s*:\s*"[^"]*"/gi, '"$1":"***"');
  return redacted.length > maxLength ? `${redacted.slice(0, maxLength)}…` : redacted;
}