// POST /api/hail/setup-packages/validate  — dry-run validate a candidate setup
// package (no DB write). Mirrors /api/processes/definitions/validate.
//
// Body: { package: { engagement_id, dry_run, items: [...] } }. Returns
// { ok, errors, warnings }. Rejects any secret value and any non-dry-run package.
// Practitioner-gated.

import { validateSetupPackage } from '../../../../../lib/hail/validators.js';
import { requirePractitioner, errorResponse } from '../../guard.js';

export const runtime = 'nodejs';
export const dynamic = 'force-dynamic';

export async function POST(req) {
  let body;
  try { body = await req.json(); } catch { return Response.json({ ok: false, error: 'invalid_json' }, { status: 400 }); }
  try {
    await requirePractitioner(req);
    const pkg = body?.package;
    if (!pkg || typeof pkg !== 'object') return Response.json({ ok: false, error: 'package_required' }, { status: 400 });
    const result = validateSetupPackage(pkg);
    return Response.json({ ok: result.ok, errors: result.errors, warnings: result.warnings });
  } catch (err) {
    return errorResponse(err);
  }
}
