import { env } from "../env.js";
import runDbClient_default from "../data/db/runDbClient.js";
import { getLogger as getLogger$1 } from "../logger.js";
import { deriveKidFromPublicKey, getAppById, updateApp } from "@inkeep/agents-core";

//#region src/startup/playground-app.ts
const logger = getLogger$1("playground-app");
function derivePlaygroundDomains() {
	const manageUiUrl = env.INKEEP_AGENTS_MANAGE_UI_URL;
	if (manageUiUrl) try {
		const url = new URL(manageUiUrl);
		if (url.hostname === "localhost" || url.hostname === "127.0.0.1") return ["localhost", "127.0.0.1"];
		return [url.hostname];
	} catch {
		logger.warn({ manageUiUrl }, "Invalid INKEEP_AGENTS_MANAGE_UI_URL, falling back to environment defaults");
	}
	if (env.ENVIRONMENT === "production") {
		logger.error({}, "INKEEP_AGENTS_MANAGE_UI_URL not set in production — cannot derive playground allowed domains");
		return [];
	}
	return ["localhost", "127.0.0.1"];
}
async function ensurePlaygroundAppConfig() {
	const appId = env.INKEEP_PLAYGROUND_APP_ID || "app_playground";
	logger.info({ appId }, "Checking playground app configuration");
	const app = await getAppById(runDbClient_default)(appId);
	if (!app) {
		logger.info({ appId }, "Playground app not found, skipping configuration");
		return;
	}
	if (app.config.type !== "web_client") {
		logger.warn({
			appId,
			type: app.config.type
		}, "Playground app is not a web_client app");
		return;
	}
	const webClient = { ...app.config.webClient };
	let configChanged = false;
	const derivedDomains = derivePlaygroundDomains();
	const currentDomains = webClient.allowedDomains ?? [];
	const hasWildcard = currentDomains.includes("*");
	const specificDomains = currentDomains.filter((d) => d !== "*");
	const newDomains = derivedDomains.filter((d) => !specificDomains.includes(d));
	if (hasWildcard && derivedDomains.length > 0) {
		const mergedDomains = [...specificDomains, ...newDomains];
		logger.info({
			appId,
			previousDomains: currentDomains,
			removedWildcard: true,
			mergedDomains
		}, "Replacing wildcard with explicit domains on playground app");
		webClient.allowedDomains = mergedDomains;
		configChanged = true;
	} else if (newDomains.length > 0) {
		const mergedDomains = [...currentDomains, ...newDomains];
		logger.info({
			appId,
			currentDomains,
			addedDomains: newDomains,
			mergedDomains
		}, "Adding new domains to playground app allowed domains");
		webClient.allowedDomains = mergedDomains;
		configChanged = true;
	} else if (derivedDomains.length === 0) logger.warn({
		appId,
		currentDomains
	}, "No playground domains could be derived — allowedDomains not updated");
	else logger.info({
		appId,
		domains: currentDomains
	}, "Playground app domains are up to date");
	const publicKeyB64 = env.INKEEP_AGENTS_TEMP_JWT_PUBLIC_KEY;
	if (publicKeyB64) {
		const publicKeyPem = Buffer.from(publicKeyB64, "base64").toString("utf-8");
		const kid = await deriveKidFromPublicKey(publicKeyPem);
		const existingKeys = webClient.publicKeys ?? [];
		if (!existingKeys.some((k) => k.kid === kid)) {
			const newKey = {
				kid,
				publicKey: publicKeyPem,
				algorithm: "RS256",
				addedAt: (/* @__PURE__ */ new Date()).toISOString()
			};
			webClient.publicKeys = [...existingKeys, newKey];
			configChanged = true;
			logger.info({
				appId,
				kid
			}, "Registering playground public key");
		} else logger.info({
			appId,
			kid
		}, "Playground key already registered");
	}
	if (configChanged) {
		const updatedConfig = {
			type: "web_client",
			webClient
		};
		await updateApp(runDbClient_default)({
			id: appId,
			data: { config: updatedConfig }
		});
		logger.info({
			appId,
			allowedDomains: updatedConfig.webClient.allowedDomains
		}, "Playground app configuration updated");
	}
}

//#endregion
export { ensurePlaygroundAppConfig };