@iislee/opencodex 2.11.0

package/src/lib/gcp-adc.ts

@@ -0,0 +1,341 @@
+/**
+ * Application Default Credentials (ADC) resolution for Vertex AI.
+ *
+ * Direct WebCrypto + REST implementation (no `google-auth-library`). Sources, in priority order:
+ *   1. `GOOGLE_APPLICATION_CREDENTIALS` env → file with `type: "service_account"` (RS256 JWT
+ *      exchange) or `type: "authorized_user"` (refresh-token exchange).
+ *   2. gcloud user ADC (`CLOUDSDK_CONFIG`, else `%APPDATA%\gcloud` on Windows, else
+ *      `~/.config/gcloud`) `application_default_credentials.json` (authorized_user flow).
+ *   3. GCE / Cloud Run metadata server.
+ *
+ * Tokens are cached per source key and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` (default 60s)
+ * before expiry. Concurrent callers waiting on a refresh share one in-flight promise.
+ *
+ * Security: never logs the access token, private key, or refresh token.
+ */
+
+import { Buffer } from "node:buffer";
+import * as os from "node:os";
+import * as path from "node:path";
+import { readFileSync, existsSync, statSync } from "node:fs";
+import {
+  captureConfigGeneration,
+  sweepExpiredOnWrite,
+  type GenerationContext,
+} from "./state-store-sweeper";
+
+/** Injectable fetch (tests pass a mock); defaults to the global fetch. */
+export type FetchImpl = typeof fetch;
+
+const OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token";
+const METADATA_TOKEN_URL = "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token";
+const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform";
+const JWT_BEARER_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+
+const TOKEN_TIMEOUT_MS = 15_000;
+const TOKEN_ATTEMPTS = 3;
+const TOKEN_RETRY_BASE_MS = 300;
+
+interface CachedToken {
+  token: string;
+  expiresAtMs: number;
+}
+
+interface ServiceAccountCredentials {
+  type: "service_account";
+  client_email: string;
+  private_key: string;
+  private_key_id?: string;
+}
+
+interface AuthorizedUserCredentials {
+  type: "authorized_user";
+  client_id: string;
+  client_secret: string;
+  refresh_token: string;
+}
+
+type AdcFileCredentials = ServiceAccountCredentials | AuthorizedUserCredentials;
+
+interface TokenResponse {
+  access_token: string;
+  expires_in: number;
+  token_type?: string;
+}
+
+const tokenCache = new Map<string, CachedToken>();
+const inflight = new Map<string, Promise<string>>();
+let lastReconciledGeneration = 0;
+let liveSources = new Set<string>();
+
+export function sweepExpiredGcpAdcTokens(now = Date.now()): number {
+  const skew = getRefreshSkewMs();
+  let removed = 0;
+  for (const [source, cached] of tokenCache) {
+    if (cached.expiresAtMs - skew > now) continue;
+    tokenCache.delete(source);
+    removed += 1;
+  }
+  return removed;
+}
+
+export function reconcileGcpAdcTokens(context: GenerationContext): number {
+  if (context.generation <= lastReconciledGeneration) return 0;
+  const currentSource = currentAdcSourceKey();
+  let removed = 0;
+  for (const source of tokenCache.keys()) {
+    if (source === currentSource) continue;
+    tokenCache.delete(source);
+    removed += 1;
+  }
+  liveSources = new Set([currentSource]);
+  lastReconciledGeneration = context.generation;
+  return removed;
+}
+
+function getRefreshSkewMs(): number {
+  const raw = Number(process.env.GOOGLE_VERTEX_REFRESH_SKEW_MS);
+  return Number.isFinite(raw) && raw > 0 ? raw : 60_000;
+}
+
+/** gcloud config dir, matching the SDK's own resolution order. */
+function gcloudConfigDir(): string {
+  const explicit = process.env.CLOUDSDK_CONFIG?.trim();
+  if (explicit) return explicit;
+  if (process.platform === "win32" && process.env.APPDATA) {
+    return path.join(process.env.APPDATA, "gcloud");
+  }
+  return path.join(os.homedir(), ".config", "gcloud");
+}
+
+function userAdcPath(): string {
+  return path.join(gcloudConfigDir(), "application_default_credentials.json");
+}
+
+/**
+ * A content-freshness fingerprint for a credential file, so an in-place rewrite (e.g.
+ * `gcloud auth application-default login`, or a rotated service-account key at the same path)
+ * changes the cache key and invalidates the stale token. Falls back to the bare path when stat fails.
+ */
+function fileSourceTag(prefix: string, filePath: string): string {
+  try {
+    const st = statSync(filePath);
+    return `${prefix}:${filePath}:${st.size}:${Math.floor(st.mtimeMs)}`;
+  } catch {
+    return `${prefix}:${filePath}`;
+  }
+}
+
+function readJsonFile<T>(filePath: string): T | undefined {
+  if (!existsSync(filePath)) return undefined;
+  return JSON.parse(readFileSync(filePath, "utf8")) as T;
+}
+
+function loadAdcCredentials(): { source: string; creds: AdcFileCredentials } | undefined {
+  const gacPath = process.env.GOOGLE_APPLICATION_CREDENTIALS;
+  if (gacPath) {
+    const creds = readJsonFile<AdcFileCredentials>(gacPath);
+    if (!creds) throw new Error(`GOOGLE_APPLICATION_CREDENTIALS points to a missing file: ${gacPath}`);
+    return { source: fileSourceTag("gac", gacPath), creds };
+  }
+  const userPath = userAdcPath();
+  const creds = readJsonFile<AdcFileCredentials>(userPath);
+  if (creds) return { source: fileSourceTag("user", userPath), creds };
+  return undefined;
+}
+
+/**
+ * The cache key for the source the NEXT resolve would use, computed cheaply (no network). Lets the
+ * cache return a token only when it still matches the active credential source, so an in-process
+ * change to GOOGLE_APPLICATION_CREDENTIALS (or the user ADC file) does not keep serving a stale
+ * token from a different source. Falls back to "metadata" when no file/env ADC is present.
+ */
+function currentAdcSourceKey(): string {
+  const gacPath = process.env.GOOGLE_APPLICATION_CREDENTIALS;
+  if (gacPath) return fileSourceTag("gac", gacPath);
+  const userPath = userAdcPath();
+  if (existsSync(userPath)) return fileSourceTag("user", userPath);
+  return "metadata";
+}
+
+function base64UrlEncode(bytes: Uint8Array | string): string {
+  const buf = typeof bytes === "string" ? Buffer.from(bytes, "utf8") : Buffer.from(bytes);
+  return buf.toString("base64url");
+}
+
+function pemToPkcs8(pem: string): ArrayBuffer {
+  const body = pem
+    .replace(/-----BEGIN [^-]+-----/g, "")
+    .replace(/-----END [^-]+-----/g, "")
+    .replace(/\s+/g, "");
+  if (!body) throw new Error("Invalid PEM: empty body");
+  const buf = Buffer.from(body, "base64");
+  return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength) as ArrayBuffer;
+}
+
+async function signJwtRs256(claims: Record<string, unknown>, privateKeyPem: string, keyId?: string): Promise<string> {
+  const header: Record<string, unknown> = { alg: "RS256", typ: "JWT" };
+  if (keyId) header.kid = keyId;
+  const payload = `${base64UrlEncode(JSON.stringify(header))}.${base64UrlEncode(JSON.stringify(claims))}`;
+  const key = await globalThis.crypto.subtle.importKey(
+    "pkcs8",
+    pemToPkcs8(privateKeyPem),
+    { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+    false,
+    ["sign"],
+  );
+  const signature = new Uint8Array(
+    await globalThis.crypto.subtle.sign("RSASSA-PKCS1-v1_5", key, new TextEncoder().encode(payload)),
+  );
+  return `${payload}.${base64UrlEncode(signature)}`;
+}
+
+function tokenRetryDelayMs(attempt: number): number {
+  const exp = TOKEN_RETRY_BASE_MS * 2 ** attempt;
+  return Math.floor(exp * (0.8 + Math.random() * 0.4));
+}
+
+function isRetryableTokenStatus(status: number): boolean {
+  return status === 429 || status === 500 || status === 502 || status === 503 || status === 504;
+}
+
+function tokenTimeoutSignal(parent: AbortSignal | undefined): AbortSignal {
+  const timeout = AbortSignal.timeout(TOKEN_TIMEOUT_MS);
+  return parent ? AbortSignal.any([parent, timeout]) : timeout;
+}
+
+/**
+ * Exchange a grant for a Google access token, hardened with a per-attempt timeout + bounded retry
+ * on transient failures (network errors and 429/5xx). Non-retryable statuses (e.g. 400/401 from a
+ * bad grant) fail fast. The error message carries only the status code, never the response body
+ * (which can leak grant/account details) or the token/key.
+ */
+async function postForToken(body: URLSearchParams, signal: AbortSignal | undefined, fetchImpl: FetchImpl): Promise<TokenResponse> {
+  let lastError: unknown;
+  for (let attempt = 0; attempt < TOKEN_ATTEMPTS; attempt++) {
+    if (signal?.aborted) throw signal.reason ?? new Error("Google OAuth token exchange aborted");
+    let response: Response;
+    try {
+      response = await fetchImpl(OAUTH_TOKEN_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: body.toString(),
+        signal: tokenTimeoutSignal(signal),
+      });
+    } catch (err) {
+      if (signal?.aborted) throw err;
+      lastError = err;
+      if (attempt === TOKEN_ATTEMPTS - 1) break;
+      await new Promise(resolve => setTimeout(resolve, tokenRetryDelayMs(attempt)));
+      continue;
+    }
+    if (response.ok) return (await response.json()) as TokenResponse;
+    if (!isRetryableTokenStatus(response.status) || attempt === TOKEN_ATTEMPTS - 1) {
+      throw new Error(`Google OAuth token exchange failed (${response.status})`);
+    }
+    lastError = new Error(`Google OAuth token exchange failed (${response.status})`);
+    await response.body?.cancel().catch(() => {});
+    await new Promise(resolve => setTimeout(resolve, tokenRetryDelayMs(attempt)));
+  }
+  throw lastError instanceof Error ? lastError : new Error("Google OAuth token exchange failed");
+}
+
+async function exchangeJwtForToken(creds: ServiceAccountCredentials, signal: AbortSignal | undefined, fetchImpl: FetchImpl): Promise<TokenResponse> {
+  const now = Math.floor(Date.now() / 1000);
+  const assertion = await signJwtRs256(
+    { iss: creds.client_email, scope: CLOUD_PLATFORM_SCOPE, aud: OAUTH_TOKEN_URL, exp: now + 3600, iat: now },
+    creds.private_key,
+    creds.private_key_id,
+  );
+  return postForToken(new URLSearchParams({ grant_type: JWT_BEARER_GRANT, assertion }), signal, fetchImpl);
+}
+
+async function exchangeRefreshToken(creds: AuthorizedUserCredentials, signal: AbortSignal | undefined, fetchImpl: FetchImpl): Promise<TokenResponse> {
+  return postForToken(
+    new URLSearchParams({
+      client_id: creds.client_id,
+      client_secret: creds.client_secret,
+      refresh_token: creds.refresh_token,
+      grant_type: "refresh_token",
+    }),
+    signal,
+    fetchImpl,
+  );
+}
+
+async function fetchMetadataToken(signal: AbortSignal | undefined, fetchImpl: FetchImpl): Promise<TokenResponse | undefined> {
+  const timeout = AbortSignal.timeout(2000);
+  const combined = signal ? AbortSignal.any([signal, timeout]) : timeout;
+  try {
+    const response = await fetchImpl(METADATA_TOKEN_URL, {
+      method: "GET",
+      headers: { "Metadata-Flavor": "Google" },
+      signal: combined,
+    });
+    if (!response.ok) return undefined;
+    return (await response.json()) as TokenResponse;
+  } catch {
+    return undefined;
+  }
+}
+
+async function resolveAccessTokenUncached(signal: AbortSignal | undefined, fetchImpl: FetchImpl): Promise<{ source: string; token: TokenResponse }> {
+  const adc = loadAdcCredentials();
+  if (adc) {
+    const token = adc.creds.type === "service_account"
+      ? await exchangeJwtForToken(adc.creds, signal, fetchImpl)
+      : await exchangeRefreshToken(adc.creds, signal, fetchImpl);
+    return { source: adc.source, token };
+  }
+  const metadata = await fetchMetadataToken(signal, fetchImpl);
+  if (metadata) return { source: "metadata", token: metadata };
+  throw new Error(
+    "Vertex AI requires Application Default Credentials. Set GOOGLE_APPLICATION_CREDENTIALS, run `gcloud auth application-default login`, or run on a GCE/Cloud Run instance with a service account.",
+  );
+}
+
+/** Returns a Bearer access token for the `Authorization` header on Vertex AI calls (cached + refreshed). */
+export async function getVertexAccessToken(options?: { signal?: AbortSignal; fetch?: FetchImpl }): Promise<string> {
+  const fetchImpl = options?.fetch ?? globalThis.fetch.bind(globalThis);
+  const skew = getRefreshSkewMs();
+  const now = Date.now();
+
+  // Only serve a cached token that matches the source the next resolve would actually use; prune
+  // expired or now-stale (different-source) entries so a credential-source change is honored.
+  const expectedSource = currentAdcSourceKey();
+  const writerGeneration = captureConfigGeneration();
+  for (const [source, cached] of tokenCache) {
+    if (source === expectedSource && cached.expiresAtMs - skew > now) return cached.token;
+    if (cached.expiresAtMs - skew <= now) tokenCache.delete(source);
+  }
+
+  // Dedup in-flight fetches PER source, not globally: if the credential source changes while a
+  // fetch is in flight, a new caller must not reuse the old source's promise (cross-source bleed).
+  const cacheKey = expectedSource;
+  const existing = inflight.get(cacheKey);
+  if (existing) return existing;
+
+  const promise = (async () => {
+    try {
+      const { source, token } = await resolveAccessTokenUncached(options?.signal, fetchImpl);
+      const expiresAtMs = Date.now() + Math.max(0, token.expires_in * 1000);
+      if (writerGeneration >= lastReconciledGeneration || liveSources.has(source)) {
+        tokenCache.set(source, { token: token.access_token, expiresAtMs });
+        sweepExpiredOnWrite(Date.now());
+      }
+      return token.access_token;
+    } finally {
+      inflight.delete(cacheKey);
+    }
+  })();
+  inflight.set(cacheKey, promise);
+  return promise;
+}
+
+/** Test seam: restores complete process-local token and reconciliation state. */
+export function __resetVertexTokenCache(): void {
+  tokenCache.clear();
+  inflight.clear();
+  lastReconciledGeneration = 0;
+  liveSources = new Set();
+}

package/src/lib/injection-debug-log.ts

@@ -0,0 +1,58 @@
+/** In-memory ring buffer of multi-agent guidance-injection / effort-cap log lines.
+ *
+ * Injection debug lines were previously console-only, so the GUI had an "Injection log"
+ * toggle with nothing to display. This buffer mirrors the provider debug buffer so the
+ * management API and GUI can tail injection lines the same way. Callers keep their own
+ * `isInjectionDebugEnabled()` guard; this module only stores what it is given. */
+
+import type { DebugLogEntry } from "./debug-log-buffer";
+import { retainedUtf8Bytes, truncateRetainedUtf8 } from "./admission";
+import { enforceAppOwnedMemoryBudget } from "./app-owned-memory";
+
+const MAX_LINES = 2_000;
+const MAX_DEBUG_LINE_BYTES = 16 * 1024;
+const buffer: DebugLogEntry[] = [];
+let nextSeq = 1;
+let bufferBytes = 0;
+
+function removeOldestEntry(): number {
+  const entry = buffer.shift();
+  if (!entry) return 0;
+  const bytes = retainedUtf8Bytes(entry.line);
+  bufferBytes -= bytes;
+  return bytes;
+}
+
+/** Append a line to the injection buffer and echo it to the server console. */
+export function injectionDebugLog(line: string): void {
+  const retainedLine = truncateRetainedUtf8(line, MAX_DEBUG_LINE_BYTES);
+  const entry: DebugLogEntry = { seq: nextSeq++, at: Date.now(), line: retainedLine };
+  buffer.push(entry);
+  bufferBytes += retainedUtf8Bytes(retainedLine);
+  while (buffer.length > MAX_LINES) removeOldestEntry();
+  enforceAppOwnedMemoryBudget();
+  console.log(line);
+}
+
+export function getInjectionDebugLogEntries(options?: { after?: number; limit?: number }): DebugLogEntry[] {
+  const after = options?.after ?? 0;
+  const limit = options?.limit ?? 500;
+  const filtered = after > 0 ? buffer.filter(entry => entry.seq > after) : buffer;
+  if (filtered.length <= limit) return filtered;
+  return filtered.slice(-limit);
+}
+
+export function injectionBufferMetrics(): { entries: number; bytes: number; oldestAt: number | null } {
+  return { entries: buffer.length, bytes: bufferBytes, oldestAt: buffer[0]?.at ?? null };
+}
+
+export function evictOldestInjectionEntryForBudget(): number {
+  return removeOldestEntry();
+}
+
+/** Test isolation. */
+export function resetInjectionDebugLogBufferForTests(): void {
+  buffer.length = 0;
+  bufferBytes = 0;
+  nextSeq = 1;
+}

package/src/lib/open-url.ts

@@ -0,0 +1,25 @@
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+
+function windowsRundll32(): string {
+  const windowsRoot = process.env.SystemRoot || process.env.WINDIR || "C:\\Windows";
+  const candidate = join(windowsRoot, "System32", "rundll32.exe");
+  return existsSync(candidate) ? candidate : "rundll32";
+}
+
+export function openUrl(url: string): void {
+  if (!/^https?:\/\//i.test(url)) return;
+  const cmd =
+    process.platform === "darwin" ? "open"
+    : process.platform === "win32" ? windowsRundll32()
+    : "xdg-open";
+  const args = process.platform === "win32"
+    ? ["url.dll,FileProtocolHandler", url]
+    : [url];
+  const child = spawn(cmd, args, { detached: true, stdio: "ignore", shell: false });
+  // Headless hosts (no xdg-open) emit ENOENT as an async 'error' event; without a
+  // listener that is an uncaught exception that kills the whole proxy/login flow.
+  child.on("error", () => {});
+  child.unref();
+}

package/src/lib/pinned-http.ts

@@ -0,0 +1,151 @@
+import http, { type IncomingMessage, type RequestOptions } from "node:http";
+import https from "node:https";
+
+export type PinnedAddress = { address: string; family: number };
+
+export interface PinnedHttpGetOptions {
+  headers?: HeadersInit;
+  maxBytes?: number;
+  idleTimeoutMs?: number;
+  rejectUnauthorized?: boolean;
+  context?: string;
+}
+
+/**
+ * GET a URL through one previously validated address. The original hostname
+ * remains authoritative for Host, SNI, and certificate verification.
+ */
+export function pinnedHttpGet(
+  url: string,
+  pinned: PinnedAddress,
+  signal?: AbortSignal,
+  options?: PinnedHttpGetOptions,
+): Promise<Response> {
+  const parsed = new URL(url);
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error(`${options?.context ?? "request"} must use HTTP or HTTPS, got ${parsed.protocol}`);
+  }
+  const context = options?.context ?? "request";
+  const idleTimeoutMs = options?.idleTimeoutMs ?? 60_000;
+  const maxBytes = options?.maxBytes;
+  const headers = new Headers(options?.headers);
+  headers.set("host", parsed.host);
+  const requestHeaders: Record<string, string> = {};
+  headers.forEach((value, key) => { requestHeaders[key] = value; });
+
+  return new Promise<Response>((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(signal.reason instanceof Error ? signal.reason : new Error("aborted"));
+      return;
+    }
+
+    let settled = false;
+    const fail = (error: unknown) => {
+      try { req.destroy(); } catch { /* ignore */ }
+      if (settled) return;
+      settled = true;
+      reject(error instanceof Error ? error : new Error(String(error)));
+    };
+    const requestOptions: RequestOptions & { servername?: string } = {
+      protocol: parsed.protocol,
+      hostname: parsed.hostname,
+      port: parsed.port || (parsed.protocol === "https:" ? 443 : 80),
+      path: `${parsed.pathname}${parsed.search}`,
+      method: "GET",
+      headers: requestHeaders,
+      ...(parsed.protocol === "https:"
+        ? {
+          servername: parsed.hostname,
+          rejectUnauthorized: options?.rejectUnauthorized ?? true,
+        }
+        : {}),
+      lookup(_hostname, lookupOptions, callback) {
+        const opts = typeof lookupOptions === "function" ? undefined : lookupOptions;
+        const cb = typeof lookupOptions === "function" ? lookupOptions : callback;
+        if (!cb) return;
+        if (opts && typeof opts === "object" && "all" in opts && opts.all) {
+          (cb as (error: NodeJS.ErrnoException | null, addresses: PinnedAddress[]) => void)(
+            null,
+            [{ address: pinned.address, family: pinned.family }],
+          );
+          return;
+        }
+        (cb as (error: NodeJS.ErrnoException | null, address: string, family: 4 | 6) => void)(
+          null,
+          pinned.address,
+          pinned.family as 4 | 6,
+        );
+      },
+    };
+
+    const onResponse = (response: IncomingMessage) => {
+      const status = response.statusCode ?? 0;
+      const responseHeaders = new Headers();
+      for (const [key, value] of Object.entries(response.headers)) {
+        if (value === undefined || value === null) continue;
+        if (Array.isArray(value)) {
+          for (const item of value) responseHeaders.append(key, String(item));
+        } else {
+          responseHeaders.set(key, String(value));
+        }
+      }
+
+      if (status < 200 || status >= 300) {
+        try { response.destroy(); } catch { /* ignore */ }
+        try { req.destroy(); } catch { /* ignore */ }
+        if (settled) return;
+        settled = true;
+        resolve(new Response(null, { status, headers: responseHeaders }));
+        return;
+      }
+
+      let received = 0;
+      const stream = new ReadableStream<Uint8Array>({
+        start(controller) {
+          response.setTimeout(idleTimeoutMs, () => {
+            const error = new Error(`${context} stalled`);
+            fail(error);
+            try { controller.error(error); } catch { /* closed */ }
+          });
+          response.on("data", (chunk: Buffer | string) => {
+            const buffer = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+            received += buffer.byteLength;
+            if (maxBytes !== undefined && received > maxBytes) {
+              const error = new Error(`${context} exceeds ${maxBytes} byte cap`);
+              fail(error);
+              try { controller.error(error); } catch { /* closed */ }
+              return;
+            }
+            try { controller.enqueue(buffer); } catch { /* closed */ }
+          });
+          response.on("end", () => {
+            try { controller.close(); } catch { /* closed */ }
+          });
+          response.on("error", (error: Error) => {
+            fail(error);
+            try { controller.error(error); } catch { /* closed */ }
+          });
+        },
+        cancel() {
+          req.destroy();
+        },
+      });
+
+      if (settled) return;
+      settled = true;
+      resolve(new Response(stream, { status, headers: responseHeaders }));
+    };
+
+    const requestFn = parsed.protocol === "https:" ? https.request : http.request;
+    const req = requestFn(requestOptions, onResponse);
+    const onAbort = () => fail(signal?.reason instanceof Error ? signal.reason : new Error("aborted"));
+    signal?.addEventListener("abort", onAbort, { once: true });
+    req.setTimeout(idleTimeoutMs, () => fail(new Error(`${context} timed out`)));
+    req.on("error", error => {
+      signal?.removeEventListener("abort", onAbort);
+      fail(error);
+    });
+    req.on("close", () => signal?.removeEventListener("abort", onAbort));
+    req.end();
+  });
+}

package/src/lib/privacy.ts

@@ -0,0 +1,20 @@
+export function maskEmail(value: string | null | undefined): string | null {
+  if (!value) return null;
+  const at = value.indexOf("@");
+  if (at <= 0) return value;
+  const local = value.slice(0, at);
+  const domain = value.slice(at + 1);
+  if (!domain) return value;
+  if (local.length === 1) return `*@${domain}`;
+  if (local.length === 2) return `${local[0]}*@${domain}`;
+  return `${local[0]}***${local[local.length - 1]}@${domain}`;
+}
+
+export function maskAccountId(value: string | null | undefined): string | null {
+  if (!value) return null;
+  const id = value.trim();
+  if (!id) return null;
+  // Short IDs would disclose the entire identifier via the suffix; use a non-identifying placeholder.
+  if (id.length <= 4) return "account-…";
+  return `account-…${id.slice(-4)}`;
+}