import { a as resolveGatewayPort } from "./paths-aMBPuCJR.js";
import { d as GATEWAY_CLIENT_NAMES, u as GATEWAY_CLIENT_MODES } from "./message-channel-BCPYwYUJ.js";
import { n as loadConfig } from "./config-i4b9k_EZ.js";
import { u as readStringParam } from "./common-BkBiFnII.js";
import { n as callGateway } from "./call-BGOaSJvj.js";

//#region src/agents/tools/automation/gateway.ts
function readGatewayCallOptions(params) {
	return {
		gatewayUrl: readStringParam(params, "gatewayUrl", { trim: false }),
		gatewayToken: readStringParam(params, "gatewayToken", { trim: false }),
		timeoutMs: typeof params.timeoutMs === "number" ? params.timeoutMs : void 0
	};
}
function canonicalizeToolGatewayWsUrl(raw) {
	const input = raw.trim();
	let url;
	try {
		url = new URL(input);
	} catch (error) {
		const message = error instanceof Error ? error.message : String(error);
		throw new Error(`invalid gatewayUrl: ${input} (${message})`, { cause: error });
	}
	if (url.protocol !== "ws:" && url.protocol !== "wss:") throw new Error(`invalid gatewayUrl protocol: ${url.protocol} (expected ws:// or wss://)`);
	if (url.username || url.password) throw new Error("invalid gatewayUrl: credentials are not allowed");
	if (url.search || url.hash) throw new Error("invalid gatewayUrl: query/hash not allowed");
	if (url.pathname && url.pathname !== "/") throw new Error("invalid gatewayUrl: path not allowed");
	return {
		origin: url.origin,
		key: `${url.protocol}//${url.host.toLowerCase()}`
	};
}
function validateGatewayUrlOverrideForAgentTools(urlOverride) {
	const cfg = loadConfig();
	const port = resolveGatewayPort(cfg);
	const allowed = new Set([
		`ws://127.0.0.1:${port}`,
		`wss://127.0.0.1:${port}`,
		`ws://localhost:${port}`,
		`wss://localhost:${port}`,
		`ws://[::1]:${port}`,
		`wss://[::1]:${port}`
	]);
	const remoteUrl = typeof cfg.gateway?.remote?.url === "string" ? cfg.gateway.remote.url.trim() : "";
	if (remoteUrl) try {
		const remote = canonicalizeToolGatewayWsUrl(remoteUrl);
		allowed.add(remote.key);
	} catch {}
	const parsed = canonicalizeToolGatewayWsUrl(urlOverride);
	if (!allowed.has(parsed.key)) throw new Error([
		"gatewayUrl override rejected.",
		`Allowed: ws(s) loopback on port ${port} (127.0.0.1/localhost/[::1])`,
		"Or: configure gateway.remote.url and omit gatewayUrl to use the configured remote gateway."
	].join(" "));
	return parsed.origin;
}
function resolveGatewayOptions(opts) {
	return {
		url: typeof opts?.gatewayUrl === "string" && opts.gatewayUrl.trim() ? validateGatewayUrlOverrideForAgentTools(opts.gatewayUrl) : void 0,
		token: typeof opts?.gatewayToken === "string" && opts.gatewayToken.trim() ? opts.gatewayToken.trim() : void 0,
		timeoutMs: typeof opts?.timeoutMs === "number" && Number.isFinite(opts.timeoutMs) ? Math.max(1, Math.floor(opts.timeoutMs)) : 3e4
	};
}
async function callGatewayTool(method, opts, params, extra) {
	const gateway = resolveGatewayOptions(opts);
	return await callGateway({
		url: gateway.url,
		token: gateway.token,
		method,
		params,
		timeoutMs: gateway.timeoutMs,
		expectFinal: extra?.expectFinal,
		clientName: GATEWAY_CLIENT_NAMES.GATEWAY_CLIENT,
		clientDisplayName: "agent",
		mode: GATEWAY_CLIENT_MODES.BACKEND
	});
}

//#endregion
export { readGatewayCallOptions as n, resolveGatewayOptions as r, callGatewayTool as t };