import { writeFileSync, readFileSync, existsSync, mkdirSync, renameSync, rmSync, statSync } from "node:fs";
import { join, dirname } from "node:path";
import { randomBytes } from "node:crypto";
import {
  readPersistedConfig,
  writePersistedConfig,
  SETTINGS_SECRETS_DENYLIST
} from "../../../persisted-config.js";
const MAX_IMPORT_BYTES = 1e6;
function stripSecrets(settings) {
  const out = {};
  for (const [k, v] of Object.entries(settings)) {
    if (SETTINGS_SECRETS_DENYLIST.has(k)) continue;
    const lower = k.toLowerCase();
    if (lower.includes("apikey") || lower.includes("token") || lower.includes("secret")) {
      continue;
    }
    out[k] = v;
  }
  return out;
}
async function exportConfig(exportPath, configPath) {
  try {
    const cfg = readPersistedConfig(configPath);
    const settings = stripSecrets(
      typeof cfg.settings === "object" && cfg.settings !== null ? cfg.settings : {}
    );
    const envelope = {
      version: cfg.version,
      exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
      settings
    };
    if (cfg.provider) {
      envelope.provider = {
        name: cfg.provider.name,
        keyLocation: cfg.provider.keyLocation
      };
    }
    const dir = dirname(exportPath);
    mkdirSync(dir, { recursive: true });
    const tmp = join(dir, `.export-${randomBytes(6).toString("hex")}.tmp`);
    try {
      writeFileSync(tmp, JSON.stringify(envelope, null, 2), { mode: 384 });
      renameSync(tmp, exportPath);
    } catch (writeErr) {
      try {
        rmSync(tmp, { force: true });
      } catch {
      }
      throw writeErr;
    }
    return { ok: true, path: exportPath };
  } catch (err) {
    return {
      ok: false,
      error: err instanceof Error ? err.message : String(err)
    };
  }
}
async function importConfig(importPath, configPath) {
  try {
    if (!existsSync(importPath)) {
      return { ok: false, error: `Import file not found: ${importPath}` };
    }
    try {
      if (statSync(importPath).size > MAX_IMPORT_BYTES) {
        return {
          ok: false,
          error: `Import file exceeds ${MAX_IMPORT_BYTES} bytes; refusing to read`
        };
      }
    } catch (statErr) {
      return {
        ok: false,
        error: statErr instanceof Error ? statErr.message : String(statErr)
      };
    }
    let raw;
    try {
      raw = JSON.parse(readFileSync(importPath, "utf-8"));
    } catch {
      return { ok: false, error: "Import file is not valid JSON" };
    }
    if (typeof raw !== "object" || raw === null) {
      return { ok: false, error: "Import file is not a valid config envelope" };
    }
    const envelope = raw;
    if (typeof envelope.settings !== "object" || envelope.settings === null) {
      return { ok: false, error: "Import file missing settings field" };
    }
    const cleanSettings = stripSecrets(envelope.settings);
    writePersistedConfig(configPath, { settings: cleanSettings });
    return { ok: true };
  } catch (err) {
    return {
      ok: false,
      error: err instanceof Error ? err.message : String(err)
    };
  }
}
export {
  exportConfig,
  importConfig
};
//# sourceMappingURL=export-import-config.js.map