// Package mask provides value-masking for env values shown to humans.
// Rule: values of length <= 4 are fully replaced with "***"; longer values
// show their first 4 characters followed by "***".
//
// Values that are `env:VAR` references (parent-env indirections) are NOT
// masked; callers should detect those via config.IsEnvRef and print them
// as-is. This helper intentionally stays unaware of that distinction.
package mask

// Value returns a masked representation of v.
func Value(v string) string {
	if len(v) <= 4 {
		return "***"
	}
	return v[:4] + "***"
}