import { n as GATEWAY_CLIENT_IDS, r as GATEWAY_CLIENT_MODES } from "./client-info-UYcIi_5g.js";
import { r as roleScopesAllow } from "./operator-scope-compat-iV7_Lmth.js";
import { s as resolveUserProfileId } from "./user-profiles-9hlwjgAg.js";
import { i as hasEffectivePairedDeviceRole, j as listPairedDevicesReadOnly } from "./device-pairing-BPE4G1s1.js";
import { c as resolveOperatorRolePolicyForProfile } from "./operator-role-policy-Blv6BRJs.js";
import { m as listBoundWebPushSubscriptions } from "./push-web-store-MQ7v7d8I.js";
import "./push-web-BPUE6VUk.js";
//#region src/gateway/web-push-authority.ts
const OPERATOR_ROLE = "operator";
function resolveCurrentWebPushTarget(params) {
	const { device, subscription, cfg } = params;
	if (!device || !hasEffectivePairedDeviceRole(device, OPERATOR_ROLE)) return null;
	const operatorToken = device.tokens?.[OPERATOR_ROLE];
	const approvedScopes = device.approvedScopes ?? device.scopes;
	if (!operatorToken || operatorToken.revokedAtMs || !approvedScopes || !roleScopesAllow({
		role: OPERATOR_ROLE,
		requestedScopes: operatorToken.scopes,
		allowedScopes: approvedScopes
	})) return null;
	const storedProfileId = subscription.userProfileId;
	const userProfileId = storedProfileId ? resolveUserProfileId(storedProfileId) ?? null : null;
	if (storedProfileId && !userProfileId || cfg.gateway?.roles && !userProfileId) return null;
	const rolePolicy = userProfileId ? resolveOperatorRolePolicyForProfile(userProfileId, cfg) : void 0;
	if (cfg.gateway?.roles && !rolePolicy) return null;
	const tokenAllows = roleScopesAllow({
		role: OPERATOR_ROLE,
		requestedScopes: params.requiredScopes,
		allowedScopes: operatorToken.scopes
	});
	const profileAllows = !rolePolicy || roleScopesAllow({
		role: OPERATOR_ROLE,
		requestedScopes: params.requiredScopes,
		allowedScopes: rolePolicy.scopes
	});
	if (!tokenAllows || !profileAllows) return null;
	return {
		subscription,
		scopes: [...new Set(params.requiredScopes)],
		userProfileId
	};
}
/** Reads every mutable authority fact in the caller's network-I/O continuation. */
function listCurrentWebPushTargets(params) {
	const pairedByDeviceId = new Map(listPairedDevicesReadOnly(params.stateDir).map((device) => [device.deviceId, device]));
	return listBoundWebPushSubscriptions(params.stateDir).flatMap((subscription) => {
		const target = resolveCurrentWebPushTarget({
			subscription,
			device: pairedByDeviceId.get(subscription.deviceId),
			cfg: params.cfg,
			requiredScopes: params.requiredScopes
		});
		return target ? [target] : [];
	});
}
function webPushTargetClient(target) {
	return {
		connect: {
			minProtocol: 1,
			maxProtocol: 1,
			client: {
				id: GATEWAY_CLIENT_IDS.CONTROL_UI,
				version: "web-push",
				platform: "web",
				mode: GATEWAY_CLIENT_MODES.WEBCHAT
			},
			device: {
				id: target.subscription.deviceId,
				publicKey: "web-push",
				signature: "web-push",
				signedAt: 0,
				nonce: "web-push"
			},
			role: OPERATOR_ROLE,
			scopes: target.scopes
		},
		...target.userProfileId ? { authenticatedUserProfile: {
			profileId: target.userProfileId,
			displayName: null,
			hasAvatar: false,
			updatedAt: 0
		} } : {}
	};
}
//#endregion
export { webPushTargetClient as n, listCurrentWebPushTargets as t };
