/**
 * Lightweight HTML sanitization for displayed donor messages.
 * We never use innerHTML; React renders text nodes safely. This helper
 * trims, collapses whitespace, and strips control characters as a defensive
 * extra layer (e.g., when feeding into <title> attributes).
 */
export function sanitizeForDisplay(input: string): string {
  return input
    // strip control characters except newline
    // eslint-disable-next-line no-control-regex
    .replace(/[\u0000-\u0008\u000B-\u001F\u007F]/g, "")
    .replace(/\s+/g, " ")
    .trim()
    .slice(0, 60);
}

/** Validate a URL (allow http/https only). Returns null if invalid. */
export function safeUrl(input: string | null | undefined): string | null {
  if (!input) return null;
  try {
    const u = new URL(input);
    if (u.protocol !== "http:" && u.protocol !== "https:") return null;
    return u.toString();
  } catch {
    return null;
  }
}
