const PREFIX = "ox1.";

/** 本机混淆，不是保险箱。专业客户端最终应走 OS Keychain。 */
export function encodeSecret(plain: string): string {
  if (!plain || plain.startsWith(PREFIX)) return plain;
  try {
    return PREFIX + btoa(unescape(encodeURIComponent(plain)));
  } catch {
    return plain;
  }
}

export function decodeSecret(stored: string): string {
  if (!stored) return "";
  if (!stored.startsWith(PREFIX)) return stored;
  try {
    return decodeURIComponent(escape(atob(stored.slice(PREFIX.length))));
  } catch {
    return stored;
  }
}

export function sanitizeSecret(raw: string): string {
  return raw.replace(/[\u200B-\u200D\uFEFF]/g, "").trim();
}