import { TunnelConfigSchema, TunnelConsentSchema, init_schema } from "../config/schema.js";
import { assertTunnelAutoStartAllowed, buildTunnelConsentRecord, hasValidTunnelConsent } from "./consent.js";
import { isMaskedTunnelSecretPatchValue } from "./env.js";
import { z } from "zod";
//#region src/tunnel/tunnel-config.ts
init_schema();
const TunnelConfigPatchSchema = z.object({
	enabled: z.boolean().optional(),
	brokerUrl: z.string().url().optional(),
	registrationSecret: z.union([z.string(), z.null()]).optional(),
	autoStart: z.boolean().optional(),
	subdomain: z.string().optional(),
	consent: TunnelConsentSchema.optional()
});
function mergeTunnelConfigPatch(config, patch) {
	const parsed = TunnelConfigPatchSchema.safeParse(patch);
	if (!parsed.success) return {
		ok: false,
		message: parsed.error.issues.map((i) => i.message).join("; ")
	};
	const patchFields = { ...parsed.data };
	if (parsed.data.registrationSecret !== void 0) if (parsed.data.registrationSecret === null) delete patchFields.registrationSecret;
	else {
		const trimmed = parsed.data.registrationSecret.trim();
		if (!trimmed || isMaskedTunnelSecretPatchValue(trimmed)) delete patchFields.registrationSecret;
		else patchFields.registrationSecret = trimmed;
	}
	const next = {
		...config.tunnel ?? TunnelConfigSchema.parse({}),
		...patchFields
	};
	if (parsed.data.registrationSecret === null) delete next.registrationSecret;
	if (parsed.data.autoStart === true) {
		const probeTunnel = TunnelConfigSchema.parse({
			...next,
			autoStart: true
		});
		const probe = {
			...config,
			tunnel: probeTunnel
		};
		try {
			assertTunnelAutoStartAllowed(probe);
		} catch (err) {
			return {
				ok: false,
				message: err instanceof Error ? err.message : String(err)
			};
		}
	}
	if (parsed.data.enabled === true && !hasValidTunnelConsent({
		...config,
		tunnel: TunnelConfigSchema.parse(next)
	})) return {
		ok: false,
		message: "Cannot enable tunnel without accepting the security notice. Start remote access from settings or record consent first."
	};
	config.tunnel = TunnelConfigSchema.parse(next);
	return { ok: true };
}
function applyTunnelConsentToConfig(config) {
	if (!config.tunnel) config.tunnel = TunnelConfigSchema.parse({});
	config.tunnel.consent = buildTunnelConsentRecord();
}
function setTunnelEnabledInConfig(config, enabled) {
	if (!config.tunnel) config.tunnel = TunnelConfigSchema.parse({});
	config.tunnel.enabled = enabled;
}
/**
* Clear stale tunnel flags when consent is missing or outdated (Phase 2: config/runtime alignment).
* Returns true when `config.tunnel` was modified.
*/
function sanitizeTunnelConfig(config) {
	const tunnel = config.tunnel;
	if (!tunnel) return false;
	if (hasValidTunnelConsent(config)) return false;
	let changed = false;
	if (tunnel.enabled) {
		tunnel.enabled = false;
		changed = true;
	}
	if (tunnel.autoStart) {
		tunnel.autoStart = false;
		changed = true;
	}
	return changed;
}
//#endregion
export { applyTunnelConsentToConfig, mergeTunnelConfigPatch, sanitizeTunnelConfig, setTunnelEnabledInConfig };

//# sourceMappingURL=tunnel-config.js.map