//#region src/tunnel/env.ts
const DEV_REGISTRATION_SECRET = "dev-registration-secret";
const TUNNEL_MASKED_SECRET_SENTINELS = ["***", "••••••••••••"];
function brokerHostname(brokerUrl) {
	try {
		const normalized = brokerUrl.includes("://") ? brokerUrl : `https://${brokerUrl}`;
		return new URL(normalized.replace(/\/+$/, "")).hostname;
	} catch {
		return null;
	}
}
/** True when the broker is the public frp.xopc.ai service (not local dev). */
function isProductionTunnelBroker(brokerUrl) {
	const host = brokerHostname(brokerUrl);
	if (!host) return true;
	if (host === "localhost" || host === "127.0.0.1" || host === "::1") return false;
	if (host.endsWith(".local")) return false;
	return host === "frp.xopc.ai";
}
function maskTunnelSecretForWeb(secret) {
	const trimmed = secret.trim();
	if (!trimmed) return "";
	return "•".repeat(trimmed.length);
}
function isMaskedTunnelSecretPatchValue(value) {
	if (TUNNEL_MASKED_SECRET_SENTINELS.includes(value)) return true;
	return /^•+$/.test(value);
}
function effectiveBrokerUrl(brokerUrl, env) {
	return brokerUrl ?? env.XOPC_TUNNEL_BROKER_URL ?? "https://frp.xopc.ai/api";
}
/**
* Describe where the tunnel registration secret will be resolved from (no secret value returned).
*/
/** Plaintext registration secret from config file only (never env). */
function readTunnelRegistrationSecretFromConfigOnly(config) {
	return config?.tunnel?.registrationSecret?.trim() || null;
}
function getTunnelRegistrationSecretMeta(config, env = process.env, brokerUrl) {
	if (env.XOPC_TUNNEL_REGISTRATION_SECRET?.trim()) return {
		configured: true,
		source: "env"
	};
	if (config?.tunnel?.registrationSecret?.trim()) return {
		configured: true,
		source: "config"
	};
	if (isProductionTunnelBroker(effectiveBrokerUrl(brokerUrl ?? config?.tunnel?.brokerUrl, env))) return {
		configured: false,
		source: "missing"
	};
	return {
		configured: true,
		source: "dev_default"
	};
}
/**
* Registration secret for Tunnel Broker register API.
* Priority: env `XOPC_TUNNEL_REGISTRATION_SECRET` → `tunnel.registrationSecret` in config → dev default (non-production brokers only).
*/
function resolveTunnelRegistrationSecret(env = process.env, brokerUrl, configSecret) {
	const fromEnv = env.XOPC_TUNNEL_REGISTRATION_SECRET?.trim();
	if (fromEnv) return fromEnv;
	const fromConfig = configSecret?.trim();
	if (fromConfig) return fromConfig;
	if (isProductionTunnelBroker(effectiveBrokerUrl(brokerUrl, env))) throw new Error("Tunnel registration secret is required for the production broker (frp.xopc.ai). Create a Tunnel Registration Key at https://console.xopc.ai/keys/tunnel and save it under Remote access → Public internet.");
	return DEV_REGISTRATION_SECRET;
}
function resolveTunnelBrokerUrl(configBrokerUrl, env = process.env) {
	return env.XOPC_TUNNEL_BROKER_URL ?? configBrokerUrl ?? "https://frp.xopc.ai/api";
}
//#endregion
export { TUNNEL_MASKED_SECRET_SENTINELS, getTunnelRegistrationSecretMeta, isMaskedTunnelSecretPatchValue, isProductionTunnelBroker, maskTunnelSecretForWeb, readTunnelRegistrationSecretFromConfigOnly, resolveTunnelBrokerUrl, resolveTunnelRegistrationSecret };

//# sourceMappingURL=env.js.map