Attaches the handler to every event it renders, unconditionally.

Idempotent: a second call is a no-op, so a test that detached in setup can re-attach on exit without coordinating with boot.

A value made safe to put on a log line: a string cut to 256 bytes with a codepoint repair and its control characters replaced; an integer of up to 256 digits as it is, a larger one as <integer of more than 256 digits>; any other term inspected through a visitor that applies the same integer rule at any depth and never lists a wide map whole, then cut like a string. Total on every byte sequence, and its work bounded by the constant, never by the input — except for a consumer's own term that inspect/2 walks or copies before its limit applies: a struct with an Inspect implementation of its own above all, a keyword list, a tuple — none of which a JSON body decodes to.

256 is read in the value's own unit: bytes for a string and for a rendering, digits for an integer, and codepoints for a string inside an inspected term, which inspect/2's :printable_limit counts before the rendering is cut.

The cut is String.byte_slice/3, never a grapheme function such as String.slice/3, for two reasons. A grapheme cut walks to the end of the cluster it stops in, and one cluster can be the whole value: a letter followed by a megabyte of combining marks is walked whole and returned whole. And on OTP 28.4, String.slice/3 and String.length/1 raise on a zero-width joiner followed by a byte no UTF-8 sequence admits — a header value reaches this function as the client sent it, and a raising handler is detached from every event. String.byte_slice/3 cuts the bytes and drops a malformed sequence at either end of what it keeps — the bytes of a codepoint split there, and at the tail a whole codepoint followed by stray continuation bytes — so a cluster cut at the bound renders as its parts, and a header value that opens or ends partway through a codepoint renders without those bytes. It finds continuation bytes at the front by scanning them, so it is handed the first 256 bytes and no more: a value opening on 256 or more continuation bytes renders as the empty string, and one opening on a megabyte of them costs what 256 do.

An integer is compared by magnitude and never rendered, because rendering one costs time quadratic in its digits; the placeholder is fixed text, since a digit count would cost the render it avoids. Inside a term the visitor replaces such an integer wherever inspect/2 meets it — a list or tuple element, a map key or value, a struct field — and cuts a map wider than inspect's limit before inspect would list it whole. That limit is a budget over the whole term, so a term's depth and breadth past it cost nothing. A list renders as a list, never as a charlist: left to infer, inspect/2 reads a list opening on printable integers as text and converts it whole, outside the visitor and its limit, raising on the first element that is no codepoint. A struct with an Inspect implementation of its own renders as that implementation makes it — MapSet lists every member, and one that formats an integer itself renders every digit — and one that raises reads #Inspect.Error<…>, which renders the struct again with inspect's defaults. Inspect also walks a keyword list whole to tell it from a plain list, and copies a tuple to a list, before its limit applies. Such terms reach this function only from a consumer's own code, as a server.reject reason; a JSON body decodes to no struct, tuple or keyword list.

A float, boolean or nil passes through — none can be long or carry a control character — and so does any other atom, which is the consumer's own: no client value decodes to one beyond those three, and a consumer that writes a control character into a reason atom writes it onto its own line.

The replacement is what stops a client forging log lines. A JSON-RPC string may decode to an embedded newline, and several of the values bounded here come straight out of the client's body or headers, so rendering one raw would let a client write a whole line of its own into the operator's stream — including a line that looks like one of wymcp's. The scrub runs after the cut and replaces byte for byte, so it keeps the bound. It is byte-wise rather than a regex because a header value need not be valid UTF-8 and a ~r/.../u match raises on the bytes that are not. A rendering is scrubbed too: inspect/2 escapes a control character inside any string it renders, but a struct's own Inspect implementation can emit one raw.

Examples

iex> Wymcp.Telemetry.Logger.bounded("tools/call")
"tools/call"

iex> Wymcp.Telemetry.Logger.bounded("id\n[error] forged line")
"id [error] forged line"

iex> Wymcp.Telemetry.Logger.bounded(:invalid_token)
:invalid_token

iex> Wymcp.Telemetry.Logger.bounded(42)
42

iex> Wymcp.Telemetry.Logger.bounded(Integer.pow(10, 256))
"<integer of more than 256 digits>"

iex> Wymcp.Telemetry.Logger.bounded(nil)
nil

iex> Wymcp.Telemetry.Logger.bounded(%{"a" => 1})
"%{\"a\" => 1}"

iex> Wymcp.Telemetry.Logger.bounded({:error, %{"id" => Integer.pow(10, 256)}})
"{:error, %{\"id\" => <integer of more than 256 digits>}}"

Detaches the handler. Idempotent: detaching when nothing is attached answers :ok.

Whether the handler is attached at boot — the config :wymcp, logger: … key, default true.

Wymcp.Application is the only caller: attach/0 and detach/0 deliberately do not consult it.