//#region src/tunnel/consent.ts
/** Bump when risk copy or terms change; users must re-accept. */
const CURRENT_TUNNEL_CONSENT_VERSION = "2026-05";
/** Bump when Tailscale Serve risk copy changes. */
const CURRENT_TAILSCALE_CONSENT_VERSION = "2026-05-serve";
function hasValidTailscaleConsent(config) {
	const consent = config.gateway?.tailscale?.consent;
	if (!consent?.acceptedAt?.trim()) return false;
	return consent.version === CURRENT_TAILSCALE_CONSENT_VERSION;
}
function buildTailscaleConsentRecord() {
	return {
		version: CURRENT_TAILSCALE_CONSENT_VERSION,
		acceptedAt: (/* @__PURE__ */ new Date()).toISOString()
	};
}
const TUNNEL_CONSENT_REQUIRED_CODE = "TUNNEL_CONSENT_REQUIRED";
var TunnelConsentError = class extends Error {
	code = TUNNEL_CONSENT_REQUIRED_CODE;
	constructor(message) {
		super(message);
		this.name = "TunnelConsentError";
	}
};
function hasValidTunnelConsent(config) {
	const consent = config.tunnel?.consent;
	if (!consent?.acceptedAt?.trim()) return false;
	return consent.version === CURRENT_TUNNEL_CONSENT_VERSION;
}
function getTunnelConsentState(config) {
	const consent = config.tunnel?.consent;
	const valid = hasValidTunnelConsent(config);
	const enabled = config.tunnel?.enabled === true;
	return {
		valid,
		consentRequired: !valid,
		acceptedAt: consent?.acceptedAt ?? null,
		acceptedVersion: consent?.version ?? null,
		currentVersion: CURRENT_TUNNEL_CONSENT_VERSION,
		canAutoStart: valid && enabled
	};
}
/** Gate tunnel start and autostart paths. */
function assertTunnelMayStart(config) {
	if (!hasValidTunnelConsent(config)) throw new TunnelConsentError(`Remote access requires accepting the security notice (version ${CURRENT_TUNNEL_CONSENT_VERSION}). Use the gateway settings page or \`xopc tunnel start --accept-risk\` after reading the risks.`);
}
function assertTunnelAutoStartAllowed(config) {
	assertTunnelMayStart(config);
	if (config.tunnel?.enabled !== true) throw new TunnelConsentError("tunnel.autoStart requires remote access to be enabled (start the tunnel once from settings or CLI).");
}
function buildTunnelConsentRecord() {
	return {
		version: CURRENT_TUNNEL_CONSENT_VERSION,
		acceptedAt: (/* @__PURE__ */ new Date()).toISOString()
	};
}
/** Short risk summary for CLI (keep in sync with web i18n). */
const TUNNEL_RISK_SUMMARY_LINES = [
	"Starting remote access exposes your gateway on the public internet via frp.xopc.ai.",
	"Anyone with the public URL or pairing QR may use your gateway Bearer token.",
	"Traffic is proxied through third-party infrastructure; use a strong token and stop the tunnel when not needed."
];
//#endregion
export { CURRENT_TAILSCALE_CONSENT_VERSION, CURRENT_TUNNEL_CONSENT_VERSION, TUNNEL_CONSENT_REQUIRED_CODE, TUNNEL_RISK_SUMMARY_LINES, TunnelConsentError, assertTunnelAutoStartAllowed, assertTunnelMayStart, buildTailscaleConsentRecord, buildTunnelConsentRecord, getTunnelConsentState, hasValidTailscaleConsent, hasValidTunnelConsent };

//# sourceMappingURL=consent.js.map