///|
/// Replace a secret with a fixed placeholder so it never appears in logs.
pub fn redact_secret(value : String) -> String {
  if value.is_empty() {
    ""
  } else {
    "***"
  }
}

///|
/// Redact a SASL payload by returning a constant placeholder. The original
/// payload bytes never reach logs or traces.
pub fn redact_sasl_payload(payload : Bytes) -> Bytes {
  if payload.is_empty() {
    Bytes::new(0)
  } else {
    @utf8.encode("")
  }
}

///|
/// Redact a bind password regardless of length.
pub fn redact_password(_password : String) -> String {
  "***"
}

///|
/// Mask a SASL mechanism credentials description for safe display.
pub fn redact_sasl_credentials(mechanism : String, payload : Bytes) -> String {
  "SASL\{mechanism} payload=\{redact_sasl_payload(payload).length()} bytes (redacted)"
}